Attack payload-based protection detection method and device, equipment and storage medium

Abstract

The application provides an attack payload-based protection detection method and device, equipment and a storage medium, and belongs to the technical field of computers. The method comprises the following steps: acquiring a detection workflow; every other preset period, for any sub-workflow in the detection workflow, sending a first data query request of the sub-workflow to a target object; based on the first data query request and an attack payload of the sub-workflow, sending a second data query request to the target object; based on a first data query response of the first data query request and a second data query response of the second data query request, determining a detection result of the sub-workflow; and based on detection results of the plurality of sub-workflows, sending result information. The above technical solution improves the construction efficiency and detection efficiency of the detection workflow, enables security problems to be discovered in a timely manner, and is beneficial to improving the security of the target object.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a protection detection method, apparatus, device and storage medium based on attack payload. Background Technology

[0002] With increasing emphasis on cybersecurity, Web Application Firewalls (WAFs) have emerged. Also known as website application-level intrusion prevention systems, WAFs protect web applications by implementing a series of protection policies. However, the complex configuration and layering of these protection policies often lead to conflicts, causing some policies to fail and jeopardizing web application security. Therefore, improving web application security has become a key research focus in this field.

[0003] Currently, the common approach involves technicians writing detection code that calls the web application's API (Application Programming Interface) to obtain the web application's WAF (Web Application Firewall) protection policy configuration information. This configuration information is then verified to identify security vulnerabilities within the WAF. Technicians then address these vulnerabilities to ensure the web application's security.

[0004] However, WAFs employ numerous protection strategies, each offering different protection functions, such as protection against vulnerability scanning behavior, backdoor connection behavior, and unauthorized access behavior. Because the detection code differs for each protection function, technical personnel must rewrite the detection code for each required function, leading to low detection efficiency and consequently reducing the security of web applications. Summary of the Invention

[0005] This application provides a protection detection method, apparatus, device, and storage medium based on attack payloads. It can construct a detection workflow for detecting multiple protection functions using pre-packaged sub-workflows as needed, improving the construction and detection efficiency of the detection workflow. This enables timely detection of security issues and enhances the security of the target object. The technical solution is as follows:

[0006] On the one hand, a protection detection method based on attack payload is provided, the method comprising:

[0007] A detection workflow is obtained, which is constructed from multiple sub-workflows in a low-code manner. Each sub-workflow is encapsulated by its corresponding detection code. The multiple sub-workflows are used to detect the target object for various protection functions.

[0008] Every preset period, for any sub-workflow in the detection workflow, a first data query request for the sub-workflow is sent to the target object. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow.

[0009] Based on the first data query request and the attack payload of the sub-workflow, a second data query request is sent to the target object. The second data query request is used to request the target data and includes the attack payload.

[0010] Based on the first data query response of the first data query request and the second data query response of the second data query request, the detection result of the sub-workflow is determined, and the detection result is used to indicate whether the protection function detected by the sub-workflow is normal;

[0011] Based on the detection results of the multiple sub-workflows, result information is sent, which is used to notify the target object of the detection results.

[0012] On the other hand, a protection detection device based on attack payload is provided, the device comprising:

[0013] The acquisition module is used to acquire the detection workflow, which is constructed from multiple sub-workflows in a low-code manner. Each of the multiple sub-workflows is encapsulated by its corresponding detection code. The multiple sub-workflows are used to detect the target object for various protection functions.

[0014] The first sending module is used to send a first data query request of any sub-workflow in the detection workflow to the target object at preset intervals. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow.

[0015] The first sending module is further configured to send a second data query request to the target object based on the first data query request and the attack payload of the sub-workflow, the second data query request being used to request the target data, and the second data query request including the attack payload;

[0016] The determination module is used to determine the detection result of the sub-workflow based on the first data query response of the first data query request and the second data query response of the second data query request. The detection result is used to indicate whether the protection function detected by the sub-workflow is normal.

[0017] The second sending module is used to send result information based on the detection results of the multiple sub-workflows, and the result information is used to notify the target object of the detection results.

[0018] In some embodiments, the first transmitting module includes:

[0019] The generation unit is configured to generate a preset number of second data query requests based on the first data query request and the attack payload;

[0020] The sending unit is used to send the preset number of second data query requests to the target object.

[0021] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads employ different attack methods;

[0022] The generation unit is configured to generate the preset number of second data query requests for any given attack payload, based on the first data query request and the attack payload.

[0023] The sending unit is used to send the preset number of second data query requests to the target object for any attack payload.

[0024] In some embodiments, the determining module includes:

[0025] A receiving unit is configured to receive the first data query response of the first data query request and a preset number of second data query responses of the second data query requests;

[0026] The processing unit is configured to perform hash operations on the first data query response and the preset number of second data query responses respectively to obtain a first hash value and the preset number of second hash values;

[0027] A determining unit is configured to determine the detection result of the sub-workflow based on the first hash value and the preset number of second hash values.

[0028] In some embodiments, the determining unit is configured to determine the consistency between the second hash value and the first hash value for any second hash value; and if the number of second hash values ​​that are consistent with the first hash value exceeds a target number among the preset number of second hash values, determine that the detection result of the sub-workflow is a protection anomaly.

[0029] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads employ different attack methods;

[0030] The determining unit is configured to determine the detection result of the sub-workflow as protection abnormal if the number of second hash values ​​corresponding to the target attack payload that match the first hash value exceeds the target number; and to determine the detection result of the sub-workflow as protection normal if the number of second hash values ​​corresponding to the multiple attack payloads that match the first hash value does not exceed the target number.

[0031] In some embodiments, the sending module is configured to send the result information if a protection anomaly is found in the detection results of the plurality of sub-workflows, the result information being used to indicate the presence of an abnormal protection function.

[0032] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory being used to store at least one computer program, the at least one computer program being loaded and executed by the processor to implement the attack payload-based protection detection method in the embodiments of this application.

[0033] On the other hand, a computer-readable storage medium is provided, wherein at least one computer program is stored in the computer-readable storage medium, the at least one computer program being loaded and executed by a processor to implement the attack payload-based protection detection method as described in the embodiments of this application.

[0034] On the other hand, a computer program product is provided, including a computer program stored in a computer-readable storage medium, a processor of a computer device reading the computer program from the computer-readable storage medium, and the processor executing the computer program, causing the computer device to perform the attack payload-based protection detection method provided in the various optional implementations described above.

[0035] This application provides a protection detection method based on attack payload. It constructs a detection workflow by encapsulating multiple sub-workflows with pre-packaged detection code in a low-code manner. Because the detection code for various protection functions is encapsulated into sub-workflows, it eliminates the need to rewrite the detection code when detecting the required protection function. The encapsulated sub-workflows can be used as needed to construct a detection workflow capable of detecting multiple protection functions, improving the construction efficiency of the detection workflow and thus enhancing detection efficiency. Furthermore, at preset intervals, for the detection of any protection function, a first data query request and a second data query request can be sent to the target object. The detection result of the protection function is determined based on the first and second data query responses, improving the accuracy of the detection results from the attacker's perspective. Additionally, by sending result information through the detection results of multiple sub-workflows, it is possible to promptly identify and resolve security issues existing in the target object, thereby improving the security of the target object. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a schematic diagram of the implementation environment of a protection detection method based on attack payload provided in an embodiment of this application;

[0038] Figure 2 This is a flowchart of a protection detection method based on attack payload provided according to an embodiment of this application;

[0039] Figure 3 This is a flowchart of another protection detection method based on attack payload provided according to an embodiment of this application;

[0040] Figure 4 This is a schematic diagram of a visual editor and workflow engine provided according to an embodiment of this application;

[0041] Figure 5 This is a schematic diagram of a startup detection workflow provided according to an embodiment of this application;

[0042] Figure 6 This is a schematic diagram illustrating a configuration preset period according to an embodiment of this application;

[0043] Figure 7 This is a schematic diagram of a sub-workflow detection process provided according to an embodiment of this application;

[0044] Figure 8 This is a schematic diagram of the detection process of a detection workflow provided according to an embodiment of this application;

[0045] Figure 9 This is a schematic diagram of result information provided according to an embodiment of this application;

[0046] Figure 10 This is a schematic diagram of a protection detection device based on attack payload provided in an embodiment of this application;

[0047] Figure 11 This is a schematic diagram of another protection and detection device based on attack payload provided in an embodiment of this application;

[0048] Figure 12 This is a structural block diagram of a terminal provided according to an embodiment of this application;

[0049] Figure 13 This is a schematic diagram of the structure of a server according to an embodiment of this application. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0051] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items with essentially the same function. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor are there any restrictions on quantity or execution order.

[0052] In this application, the term "at least one" means one or more, and "multiple" means two or more.

[0053] It should be noted that all information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in this application have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the target objects and target data involved in this application were obtained with full authorization.

[0054] For ease of understanding, the terms used in this application are explained below.

[0055] Workflow: refers to the automation of part or all of a workflow business process in a computer application environment. It is a general description of the business rules between workflow business processes and their various operation steps.

[0056] Workflow APP (application): refers to an application module that abstracts some commonly used functions or interface services. When implementing user functions, users only need to configure them through a graphical interface, without having to start writing code.

[0057] Workflow instance: refers to all the functions of a complete workflow by connecting multiple workflow apps in a certain process sequence.

[0058] Visual editors refer to development tools that introduce a low-code build approach, allowing workflow arrangement through drag-and-drop and connection methods, enabling rapid workflow building without requiring a large number of developers. These visual editors employ configuration-based coding, implementing functional logic through a graphical interface, reducing usage costs, and allowing even non-professional code developers to "develop."

[0059] Workflow engine: refers to the process of abstracting commonly used functional logic into a general-purpose APP based on the idea of ​​functional modular decomposition, separating the main program execution and configuration, and ensuring that the configuration can be flexibly changed under different application scenarios while the main functional logic remains stable.

[0060] SQL (Structured Query Language) injection attacks refer to attacks where attackers add malicious SQL commands to the parameters submitted when accessing a normal business interface. Due to security vulnerabilities in the application itself, these SQL commands can penetrate the database through the front-end interface. The database receives and executes these SQL commands, ultimately leading to data leakage, or even data modification or corruption. In this application's embodiments, the attack payload for SQL injection attacks may reside in HTTP (Hypertext Transfer Protocol) message parameters, cookies, or custom headers; this application's embodiments do not impose such limitations.

[0061] Cross-Site Scripting (XSS) attacks refer to attackers exploiting security vulnerabilities in application systems to force users to execute and load maliciously crafted web programs. Attackers then use the user's privileges to perform non-compliant operations, obtaining the user's private web content, session data, cookies, and other sensitive information. Essentially, XSS injection is a form of HTML (Hypertext Markup Language) injection; user input is treated as part of HTML code and executed, thus obfuscating the original semantics and generating new meaning.

[0062] System command injection attack: This refers to a situation where a business system does not strictly filter externally input parameters. When an attacker inputs a system command, the business system directly executes the command, allowing the attacker to remotely control the business system and ultimately compromise it.

[0063] Vulnerability scanning refers to the act of probing a target site for security vulnerabilities. It often occurs as the first step in an attack. Attackers use vulnerability scanning to discover potential security vulnerabilities in a target site, thereby launching targeted attacks to obtain private data from the target system or even gain full access to it.

[0064] Web attacks refer to attacks on web servers and web applications. Web server attacks primarily exploit security vulnerabilities inherent in the web server itself, mainly targeting servers such as IIS (Internet Information Services), Apache (a web server software), and nginx (engine x, a high-performance HTTP and reverse proxy web server). Attacks include unauthorized file uploads, parsing vulnerabilities, and overflow vulnerabilities. Web application attacks primarily target web applications. Due to the rich variety of web applications on the internet today, web application attacks are the most diverse, mainly including unauthorized access, command execution, and overflow vulnerabilities.

[0065] Backdoor connection behavior: This refers to the typical practice of leaving a backdoor on the target site during a network attack. It is also one of the important characteristics for identifying network attacks. The main attack behaviors include uploading files with malicious extensions, inserting dangerous functions, and directly connecting to backdoor files.

[0066] Unauthorized access: This refers to situations where the server typically only provides a business interface for external access, while the system's private resources, including directories and files, should not be directly accessed by external users. When unauthorized access to private resources occurs, the system itself may have security vulnerabilities.

[0067] The attack payload-based protection detection method provided in this application can be executed by a computer device. In some embodiments, the computer device is a terminal or a server. The following describes the implementation environment of the attack payload-based protection detection method provided in this application, using a server as an example. Figure 1 This is a schematic diagram illustrating the implementation environment of a protection detection method based on attack payloads provided in an embodiment of this application. See also... Figure 1The implementation environment includes a terminal 101 and a server 102. The terminal 101 and the server 102 can be connected directly or indirectly via wired or wireless communication, and this embodiment of the application does not limit this.

[0068] In some embodiments, terminal 101 may be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, smart voice interaction device, smart home appliance, vehicle terminal, aircraft, etc., but is not limited thereto. Terminal 101 has an application installed and running that supports workflow configuration. This application includes a visual editor. Users can use this visual editor to connect multiple encapsulated sub-workflows by dragging and dropping and connecting lines to build a detection workflow. That is, terminal 101 generates a detection workflow based on multiple sub-workflows selected by the user. Then, terminal 101 can send the detection workflow to server 102, which performs protection detection on the target object. The target object may be a web application, web server, or system with WAF installed, etc., and this embodiment does not limit this.

[0069] In some embodiments, server 102 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), big data, and artificial intelligence platforms. Server 102 can receive the detection workflow sent by terminal 101. Then, server 102 sequentially performs various detections on the target object with different protection functions according to the order of multiple sub-workflows in the detection workflow. In some embodiments, server 102 undertakes the main computing work, and terminal 101 undertakes the secondary computing work; or, server 102 undertakes the secondary computing work, and terminal 101 undertakes the main computing work; or, server 102 and terminal 101 collaborate on computing using a distributed computing architecture.

[0070] The attack payload-based protection detection method provided in this application can be applied to protection detection scenarios in transportation systems, education systems, or medical systems, etc., and this application does not impose any limitations on it.

[0071] Figure 2 This is a flowchart of a protection detection method based on attack payload provided according to an embodiment of this application. See also... Figure 2 In this embodiment, the method is described using server execution as an example. The attack payload-based protection detection method includes the following steps:

[0072] 201. The server obtains the detection workflow, which is constructed from multiple sub-workflows in a low-code manner. Each sub-workflow is encapsulated by its corresponding detection code. These sub-workflows are used to detect the target object for various protection functions.

[0073] In this embodiment, for any sub-workflow, the sub-workflow is used to detect a protection function of the target object. The target object can be a web application, web server, website, or system with WAF installed, etc., and this embodiment does not limit this. The protection function can be protection against SQL injection attacks, XSS attacks, system command injection attacks, vulnerability scanning behavior, web attacks, backdoor connection behavior, or unauthorized access behavior, etc., and this embodiment does not limit this. Different sub-workflows detect different protection functions. The server can construct a detection workflow based on multiple sub-workflows; alternatively, the server can also obtain a pre-constructed detection workflow from the terminal, and this embodiment does not limit this.

[0074] 202. Every preset period, for any sub-workflow in the detection workflow, the server sends a first data query request for the sub-workflow to the target object. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow.

[0075] In this embodiment, the server performs periodic checks on the target object based on a preset period. The duration of this preset period can be 30 minutes, 1 hour, or 90 minutes, etc., and this embodiment does not impose any limitation on it. Every preset period, the server sequentially performs various checks on the target object for different protection functions according to the order of multiple sub-workflows in the detection workflow. For any sub-workflow, the server can send a first data query request to the target object based on the target object's address to request the target object's target data. This first data query request does not include an attack payload for attacking the target object's protection functions; that is, the server sends a compliant request to the target object, requesting the target data in a compliant manner.

[0076] 203. Based on the first data query request and the attack payload of the sub-workflow, the server sends a second data query request to the target object. The second data query request is used to request target data and includes the attack payload.

[0077] In this embodiment, the server generates a second data query request based on the first data query request and the attack payload of the sub-workflow. The server then sends this second data query request to the target object. The second data query request serves the same purpose as the first data query request—to request target data. The difference is that the second data query request carries an attack payload. This attack payload can attack the protection functions detected by the sub-workflow. That is, the server sends an non-compliant request to the target object, requesting target data in an non-compliant manner.

[0078] 204. Based on the first data query response of the first data query request and the second data query response of the second data query request, the server determines the detection result of the sub-workflow. The detection result is used to indicate whether the protection function detected by the sub-workflow is normal.

[0079] In this embodiment, after sending a first data query request to the target object, the server can receive a first data query response returned by the target object based on the first data query request. After sending a second data query request to the target object, the server can receive a second data query response returned by the target object based on the second data query request. Then, the server can determine whether the protection function detected by the workflow is normal by comparing the first data query response and the second data query response.

[0080] 205. The server sends result information based on the detection results of multiple sub-workflows. This result information is used to notify the target object of the detection results.

[0081] In this embodiment, the server can aggregate the detection results of multiple sub-workflows. Then, based on these sub-workflow detection results, the server determines the detection result of the target object. The server can then send the result information to notify the user of the target object's detection result, enabling timely detection and resolution of security issues related to the target object, thereby improving the target object's security.

[0082] This application provides a protection detection method based on attack payload. It constructs a detection workflow by encapsulating multiple sub-workflows with pre-packaged detection code in a low-code manner. Because the detection code for various protection functions is encapsulated into sub-workflows, it eliminates the need to rewrite the detection code when detecting the required protection function. The encapsulated sub-workflows can be used as needed to construct a detection workflow capable of detecting multiple protection functions, improving the construction efficiency of the detection workflow and thus enhancing detection efficiency. Furthermore, at preset intervals, for the detection of any protection function, a first data query request and a second data query request can be sent to the target object. The detection result of the protection function is determined based on the first and second data query responses, improving the accuracy of the detection results from the attacker's perspective. In addition, by sending the detection results from multiple sub-workflows, it is possible to promptly identify and resolve security issues existing in the target object, thereby improving the security of the target object.

[0083] Figure 3 This is a flowchart of another protection detection method based on attack payload provided according to an embodiment of this application. See also... Figure 3 In this embodiment, the method is described using server execution as an example. The attack payload-based protection detection method includes the following steps:

[0084] 301. The server obtains the detection workflow, which is constructed from multiple sub-workflows in a low-code manner. Each sub-workflow is encapsulated by its corresponding detection code. These sub-workflows are used to detect various protection functions of the target object.

[0085] In this embodiment, low-code refers to a visual application development method, primarily based on more efficient methods such as graphical drag-and-drop and parameterized configuration to achieve the rapid construction of a detection workflow. The terminal uses low-code to chain together multiple sub-workflows to construct the detection workflow. The server then obtains this detection workflow from the terminal. The server then sequentially detects the target object according to the order of the sub-workflows in the detection workflow, i.e., continues executing steps 302 to 306.

[0086] The construction and operation of this detection workflow are primarily based on a visual editor and a workflow engine. A visual editor is installed on the terminal. In this editor, each encapsulated sub-workflow is represented by a corresponding graph. Users can use this editor to drag and drop and connect the graphs of multiple sub-workflows to build the detection workflow. The workflow engine provides support for the operation of the detection workflow.

[0087] For example, Figure 4 This is a schematic diagram of a visual editor and workflow engine provided according to an embodiment of this application. See also Figure 4 This visual editor includes an orchestration canvas, application parameter configurator, debugger, version controller, application selector, and graphics rendering engine. The orchestration canvas is used to build and display the detection workflow. Each encapsulated sub-workflow can be viewed as a workflow application. The application parameter configurator is used to configure the parameters of each sub-workflow. These parameters can be attack payloads. The debugger is used to debug the built detection workflow. The version controller is used to control the version of the detection workflow. The application selector is used to select the desired sub-workflow. The graphics rendering engine is used to render the graphics corresponding to the sub-workflow. The workflow engine includes a logic processing engine, application execution engine, trigger detector, syntax parsing engine, and credential authentication engine. The logic processing engine handles the working logic in the detection workflow. The application execution engine controls the execution of each sub-workflow. The trigger detector detects the triggering timing of the detection workflow. The syntax parsing engine parses the detection results of each sub-workflow. The credential authentication engine checks whether the execution of the detection workflow has the necessary detection permissions for the target object.

[0088] After the terminal completes the detection workflow, it can display the tasks corresponding to that workflow. Once the detection workflow is started, it can periodically detect the protection functions of the target object. For example, Figure 5 This is a schematic diagram illustrating a workflow for initiating a detection process according to an embodiment of this application. See also... Figure 5 The terminal displays the tasks corresponding to the detection workflow in a list format. Each task includes the name of the detection workflow, the triggers within the workflow, the username of the user who created the workflow, the creation time of the workflow, and a startup control. In response to triggering the startup control, the terminal sends a startup command to the server, which then performs detection on the target object based on the workflow.

[0089] 302. Every preset period, for any sub-workflow in the detection workflow, the server sends a first data query request for the sub-workflow to the target object. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow.

[0090] In this embodiment, the detection workflow includes a time trigger. This time trigger is used to activate the detection workflow at preset intervals. Specifically, when the time trigger detects that the time elapsed since the last trigger reaches the preset interval, it instructs the server to sequentially detect the target object according to the order of the sub-workflows within the detection workflow. For any sub-workflow, the server can send a first data query request to the target object to request target data. This first data query request is a query-type request used to query, access, or obtain target data, but it does not modify the target data. The first data query request can be an HTTP request, and this embodiment does not impose any restrictions on this. The first data query request is a compliant request and does not carry attack payloads intended to compromise the target object's protection features.

[0091] This preset period is configured during the construction of the detection workflow. For example, Figure 6 This is a schematic diagram illustrating a configuration preset period according to an embodiment of this application. See also... Figure 6 This is the configuration interface for the time trigger. This interface displays the configured application name as the time trigger. The preset period is one hour, meaning the protection detection workflow is performed once every hour.

[0092] 303. Based on the first data query request and the attack payload, the server generates a preset number of second data query requests, which are used to request target data.

[0093] In this embodiment, since the attack payload can attack the protection functions detected by the sub-workflow, the second data query request generated based on the attack payload is an non-compliant request. That is, the second data query request can also attack the protection functions detected by the sub-workflow. This embodiment generates a second data query request to simulate an attack on the target object to detect its protection functions. This second data query request is a query request and does not change the target object's data. That is, the second data query request can obtain the target object's target data in a non-compliant manner, but it does not perform any operations that modify, add, or delete the target data itself. Therefore, this method can ensure the accuracy of the target object's data while simulating an attack.

[0094] For a given attack payload, the server can generate a preset number of second data query requests carrying that attack payload. This preset number can be 15, 20, or 30, etc., and this embodiment does not impose any limitation on it. Then, the server can continue to execute step 304, sending all the generated preset number of second data query requests to the target object to simulate an attack. The solution provided in this embodiment, by generating and sending a preset number of second data query requests, enables a continuous and frequent simulated attack on the target object, ensuring the stability of the simulated attack and avoiding failures due to network latency or other factors, thus facilitating more accurate detection results later.

[0095] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads. The multiple attack payloads employ different attack methods. Accordingly, step 303 includes the following steps: for any attack payload, the server generates a preset number of second data query requests based on a first data query request and the attack payload. That is, a sub-workflow corresponds to multiple attack payloads. Each attack payload corresponds to a preset number of second data query requests. For any sub-workflow, the attack payload of that sub-workflow is configured during the construction of the detection workflow. The solution provided in this application embodiment, by configuring multiple different attack payloads for each sub-workflow, enables the server to generate multiple second data query requests. Because the different attack payloads employ different attack methods, the server can use multiple attack methods to simulate attacks for each protection function, achieving the purpose of detecting each protection function from multiple aspects, and improving the accuracy of the detection results.

[0096] In this application, the number of attack payloads in any sub-workflow can be 5, 6, or 8, etc., and this embodiment does not impose any limitation on this. The attack payloads in different sub-workflows are also different. The attack payloads used in each sub-workflow in this embodiment are described below as examples.

[0097] (a) The sub-workflow for detecting SQL injection attacks includes the following attack payloads:

[0098] (1)and 1=2union select 1,database(),3

[0099] (2)id=100'union select 1,(select database()),3-+

[0100] (3)union select 1,(select group_concat(table_name)from information_sche

[0101] ma.tables

[0102] (4)union select 1,(SELECT load_file(' / etc / passwd'))-+

[0103] (5)and(extractvalue(1,concat(0x7e,(select user()),0x7e)))

[0104] Of the above attack payloads, the first attack payload is used to read the database list; the second attack payload is used to read the database list by using single quotes to mask comments; the third attack payload is used to read the list name in the database; the fourth attack payload is used to read the password file; and the fifth attack payload is used to read the username.

[0105] (ii) The sub-workflow for detecting protection against XSS attacks includes the following attack payloads:

[0106] (1) <script>alert('hello，gaga！')；< / script>

[0107] (2)'> <script>alert(document.cookie)< / script>

[0108] (3) <img src＝" javascript.:alert"('XSS')>

[0109] (4) <img SRC＝javascript:alert(String.fromCharCode(88,83,83))>

[0110] (5) <video onerror＝"alert(1)">

[0111] The principle behind all the above attack payloads is to insert a certain instruction during the process of sending information to the target object and see if the target object executes the instruction. If the instruction is executed, the attack is considered successful. The first attack payload is used to insert a script instruction. If the target object returns "hello, gaga!", the attack is considered successful. The second attack payload is used to insert a script instruction by disabling comments. The third attack payload is used to insert instructions related to images. The fourth attack payload is used to insert instructions related to images based on string encoding. The fifth attack payload is used to insert instructions related to page errors.

[0112] (iii) The sub-workflow for detecting protection against system command injection attacks includes the following attack payloads:

[0113] (1) id = cat / etc / passwd

[0114] (2) id = netstat -luntp

[0115] (3) id = useradd tester123

[0116] (4) id = whoami

[0117] (5) id = ls - a

[0118] The principle behind all the above attack payloads is to pass parameters to the target object using an ID (identity document) to execute a command. The first attack payload is used to read the password; the second attack payload is used to read the target object's network information, which indicates the network device connected to the target object; the third attack payload is used to add a new user account, which has no password and therefore does not affect the target object's data; the fourth attack payload is used to read the identity information of the current account on the target object; and the fifth attack payload is used to read the directory in the file receiving the parameters.

[0119] (iv) The sub-workflow for detecting the protective functions against vulnerability scanning behavior includes the following attack payloads:

[0120] (1) User-Agent:hydra

[0121] (2) User-Agent:pango

[0122] (3) User-Agent:w3af

[0123] (4) User-Agent: Nikto

[0124] (5) User-Agent: zmeu

[0125] The principle behind the aforementioned attack payloads is to inform the target of the scanner's name during vulnerability scanning, and then see if the target can recognize and block the scanner's scanning process. Hydra, Pango, W3af, Nikto, and Zmeu are all scanner names.

[0126] (v) The sub-workflow for detecting protection against web attacks includes the following attack payloads:

[0127] (1) Cookie:

[0128] GLOBALS[_DCACHE][smilies][searcharray]= / .* / eui; GLOBALS[_DCACHE][smilies][replacearray]=phpinfo(); (2)

[0130] / index.php?s=index / \\think\\app / invokefunction&function=phpinfo&vars[0]=100

[0131] (3) / iisadmin / bdir.htr? c

[0132] (4) / vendor / phpunit / phpunit / src / Util / PHP / eval-stdin.php

[0133] (5) / admin / servlet / org.apache.catalina.servlets.DefaultServlet / target.jsp

[0134] Of the above attack payloads, the first attack payload is added to the cookie in the HTTP request and is used to print out the PHP (Hypertext Preprocessor, a scripting language executed on the server side) information of the target object; the second attack payload is used to obtain PHP information by invoking function; the third attack payload is used to read the file information in the iis file directory; the fourth and fifth attack payloads are both used to obtain the file information in the relevant file directory.

[0135] (vi) The sub-workflow for detecting backdoor connection behavior includes the following attack payloads: (1)

[0137] IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGNtZD0gImx5bngiOw0KJHN5c3RlbT0gJ2VjaG8gImB1bmFtZSAtYWAiO2Vj (2)

[0139] I2luY2x1ZGUgPHN0ZGlvLmg+DQojaW5jbHVkZSA8c3lzL3NvY2tldC5oPg0KI2luY2x1ZGUgPG5ldGluZXQvaW4uaD4NCmludC

[0140] (3) / spider_php_shell.php (4)

[0142] action=sqladmin,dbhost=localhost,dbport=3306,dbuser=root,dbpass=1qaz2wsx,connect=connect

[0143] (5) / phpspy.php

[0144] Of the above attack payloads, the first attack payload and the second attack payload are typical backdoor request signatures. When accessing the backdoor, the corresponding backdoor can be directly accessed through the signature. The third attack payload is the name of a backdoor Trojan. The fourth attack payload connects to the backdoor through the database name and password. The fifth attack payload is also the name of a backdoor Trojan.

[0145] (vii) The sub-workflow for detecting unauthorized access includes the following attack payloads:

[0146] (1) file = / etc / passwd

[0147] (2) file = / etc / shadow

[0148] (3) file = / etc / sudoers

[0149] (4) file = / etc / bashrc

[0150] (5)file= / etc / httpd / conf / httpd.conf

[0151] The principle behind the aforementioned attack payloads is based on the file function taking the address of a directory as input, thereby retrieving the relevant target directory from that address. Specifically, passwd, shadow, sudoers, bashrc, and httpd / conf / httpd.conf are used to indicate different addresses.

[0152] It should be noted that the data read by the aforementioned attack payload is all private information, that is, information that cannot be read without authorization.

[0153] In this embodiment, for any sub-workflow in the above detection workflow, the attack principles of the attack payloads in that sub-workflow are similar, but the attack methods are different. The generation methods for the second data query request differ depending on the attack payload's attack method. The generation process of a second data query request will be used as an example. Accordingly, in the process of generating the second data query request, for any attack payload, the server obtains the attack method of that attack payload. Then, the server uses a generation method related to that attack method to generate the second data query request corresponding to that attack payload based on the attack payload and the first data query request. The solution provided in this embodiment generates the second data query request by using a generation method related to the attack method of the attack payload, enabling the generated second data query request to accurately reflect the attack capability of the attack payload. This improves the accuracy of the detection results when the second data query request is subsequently used to simulate an attack on the target object.

[0154] In some embodiments, the server can insert an attack payload into a first data query request to generate a second data query request. The position where the attack payload of different attack methods is inserted into the first data query request may differ. Accordingly, during the generation of the second data query request, for any attack payload, the server obtains the attack method of the attack payload. Then, based on the attack method, the server determines the target position in the first data query request. The server then inserts the attack payload into the target position to obtain the second data query request. The solution provided in this application generates a second data query request by inserting the attack payload into the first data query request at a target position related to the attack method of the attack payload. This ensures that the generated second data query request accurately reflects the attack capability of the attack payload, thereby improving the accuracy of detection results when subsequently using the second data query request to simulate an attack on a target object.

[0155] In some embodiments, the server can fuse the attack payload and the first data query request based on a certain fusion method to generate a second data query request. The fusion method used for attack payloads of different attack methods may be different. Accordingly, in the process of generating the second data query request, for any attack payload, the server obtains the attack method of the attack payload. Then, based on the attack method, the server determines a target fusion method. Then, based on the target fusion method, the server fuses the attack payload and the first data query request to obtain the second data query request. The solution provided in this application embodiment, by employing a target fusion method related to the attack method of the attack payload to fuse the attack payload and the first data query request, enables the fused second data query request to accurately reflect the attack capability of the attack payload, thereby improving the accuracy of detection results when subsequently using the second data query request to simulate an attack on a target object.

[0156] 304. The server sends a preset number of second data query requests to the target object.

[0157] In this embodiment, for any sub-workflow, the server sends a generated second data query request to the target object to simulate an attack on the target object. This method, by continuously sending multiple malicious second data query requests to the target object, enables a sustained simulated attack, ensuring the stability of the simulated attack and avoiding failures due to network latency or other factors, thus facilitating more accurate detection results in the future.

[0158] When a sub-workflow includes multiple attack payloads, for any given attack payload, the server sends a preset number of second data query requests to the target object. Because different attack payloads employ different attack methods, this method can simulate attacks using multiple attack methods for each protection function, achieving the goal of detecting each protection function from multiple perspectives and improving the accuracy of the detection results. Within a preset period, for the detection of any protection function, the number of second data query requests the server can send to the target object is equal to the product of the preset number and the number of attack payloads.

[0159] 305. Based on the first data query response of the first data query request and the second data query response of a preset number of second data query requests, the server determines the detection result of the sub-workflow. The detection result is used to indicate whether the protection function detected by the sub-workflow is normal.

[0160] In this embodiment, for any sub-workflow, after receiving a first data query request from the server, the target object returns a first data query response to the server. After receiving a second data query request from the server, the target object returns a second data query response to the server. There is a one-to-one correspondence between the request and the response. The server can compare a preset number of received second data query responses sequentially with the first data query responses to determine the detection result of the sub-workflow.

[0161] In some embodiments, the server can compare the first data query response and the second data query response using a hash algorithm to determine the detection result of the sub-workflow. Accordingly, step 305 includes the following steps: the server receives a first data query response to a first data query request and a preset number of second data query responses to a second data query request. Then, the server performs hash operations on the first data query response and the preset number of second data query responses respectively to obtain a first hash value and a preset number of second hash values. Then, the server determines the detection result of the sub-workflow based on the first hash value and the preset number of second hash values. The solution provided in this application uses a hash algorithm to process the received first data query response and the second data query response to obtain a first hash value and a second hash value. Then, by comparing the first hash value and the second hash value, the detection result of the sub-workflow is determined. Since the first hash value and the second hash value can accurately represent the first data query response and the second data query response, and the data volume is small, the process of determining the detection result of the sub-workflow based on comparing the first hash value and the second hash value ensures both detection accuracy and detection efficiency.

[0162] Optionally, the server compares a preset number of second data query responses sequentially with the first data query response. The server can determine the detection result of the sub-workflow based on the number of second data query responses that match the first data query response. Accordingly, the process of determining the detection result of the sub-workflow based on the first hash value and a preset number of second hash values ​​is as follows: for any second hash value, the server determines the consistency between the second hash value and the first hash value. Then, among the preset number of second hash values, if the number of second hash values ​​that match the first hash value exceeds a target number, the server determines that the detection result of the sub-workflow is a protection anomaly. The target number can be 10, 12, or 13, etc., and this embodiment does not limit this. The solution provided in this application determines whether the detection result of the sub-workflow is abnormal by comparing the consistency between the first hash value and the second hash value and based on the number of second hash values ​​that match the first hash value. Since the first hash value and the second hash value can accurately represent the first data query response and the second data query response, and the data volume is small, the process of determining the detection result of the sub-workflow based on comparing the first hash value and the second hash value ensures both the accuracy of the detection and the efficiency of the detection. Furthermore, when there are a large number of second hash values ​​that match the first hash value, it is determined that there are more second data query responses that match the first data query response, thereby determining that the protection of the target object is abnormal, which also ensures the accuracy of the detection result to a certain extent.

[0163] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads. These multiple attack payloads employ different attack methods. Correspondingly, if the number of second hash values ​​matching the first hash value exceeds a target number among a preset number of second hash values, the server determines the sub-workflow's detection result as a protection anomaly as follows: if the number of second hash values ​​corresponding to a target attack payload that match the first hash value exceeds the target number, the server determines the sub-workflow's detection result as a protection anomaly. If the number of second hash values ​​corresponding to each of the multiple attack payloads that match the first hash value does not exceed the target number, the server determines the sub-workflow's detection result as a protection normal. The solution provided in this application embodiment, because different attack payloads employ different attack methods, allows the server to simulate attacks using multiple attack methods for each protection function detection, achieving the purpose of detecting each protection function from multiple aspects. Only when the number of second data query responses matching the first data query response corresponding to each attack payload does not exceed the target number is it determined that the protection function of the target object is without problems, thereby improving the accuracy of the detection results.

[0164] To more clearly describe the detection process of a single sub-workflow, the detection process will be described again below with reference to the accompanying drawings. Figure 7 This is a schematic diagram of a sub-workflow detection process provided according to an embodiment of this application. See also... Figure 7 First, for this sub-workflow, the server sends a first data query request to the target object. The server receives a first data query response from the target object based on the first data query request. Then, based on the first data query requests and the attack payload of the sub-workflow, the server generates a preset number of second data query requests. The server receives a second data query response from the target object based on the second data query requests. The server then calculates a first hash value for the first data query response and a second hash value for the second data query response. Finally, the server performs a conditional judgment based on the first and second hash values. If the condition is met, the protection function is deemed effective; otherwise, the protection function is deemed ineffective. The condition is that the number of second hash values ​​corresponding to the multiple attack payloads that match the first hash value does not exceed the target number.

[0165] It should be noted that the server uses steps 302 to 305 to sequentially test each protection function of the target object according to the order of multiple sub-workflows in the detection workflow, until the detection work of multiple sub-workflows is completed, and then continues to execute step 306.

[0166] 306. The server sends result information based on the detection results of multiple sub-workflows. This result information is used to notify the target object of the detection results.

[0167] In this embodiment, the server acquires the detection results of multiple sub-workflows. Then, based on the detection results of these multiple sub-workflows, the server sends result information to the terminal to notify the user of the detection results of the target object.

[0168] In some embodiments, the server only sends result information when the detection result indicates a protection anomaly. Correspondingly, if a protection anomaly exists in the detection results of multiple sub-workflows, the terminal sends result information. This result information is used to indicate the presence of an abnormal protection function. The solution provided in this application embodiment does not send result information if no protection anomaly is found in the detection results of multiple sub-workflows; it only sends result information when a protection anomaly exists in the detection results of multiple sub-workflows. This not only prompts the user to handle protection anomalies promptly but also reduces operational overhead.

[0169] To more clearly describe the detection process of the detection workflow, the detection process will be described again below with reference to the accompanying drawings. Figure 8 This is a schematic diagram of the detection process of a detection workflow provided according to an embodiment of this application. See also... Figure 8 The detection workflow includes a time trigger, sub-workflows for detecting SQL injection attacks, XSS attacks, system command injection attacks, vulnerability scanning, web attacks, backdoor connections, and unauthorized access. The time trigger activates the detection workflow at preset intervals. The server sequentially checks the protection against SQL injection, XSS, system command injection, vulnerability scanning, web attacks, backdoor connections, and unauthorized access according to the order of the sub-workflows. The server then analyzes the results of each sub-workflow. Based on the data analysis, the server performs a conditional judgment; if the condition is met, it sends the result information; otherwise, it does not send any information, resulting in a no-response operation. The condition is the presence of protection anomalies in the detection results of multiple sub-workflows.

[0170] After the server sends the result information to the terminal, the terminal can display the result information. Figure 9 This is a schematic diagram illustrating a result information provided in an embodiment of this application. See also: Figure 9 The results show the protection status of the target object as follows: [SQL Injection Attack Protection]: Normal protection; [XSS Attack Protection]: Normal protection; [System Command Injection Attack Protection]: Protection ineffective; [Vulnerability Scanning Protection]: Normal protection; [Web Attack Protection]: Normal protection; [Backdoor Connection Protection]: Normal protection; [Unauthorized Access Protection]: Normal protection.

[0171] This application provides a protection detection method based on attack payload. It constructs a detection workflow by encapsulating multiple sub-workflows with pre-packaged detection code in a low-code manner. Because the detection code for various protection functions is encapsulated into sub-workflows, it eliminates the need to rewrite the detection code when detecting the required protection function. The encapsulated sub-workflows can be used as needed to construct a detection workflow capable of detecting multiple protection functions, improving the construction efficiency of the detection workflow and thus enhancing detection efficiency. Furthermore, at preset intervals, for the detection of any protection function, a first data query request and a second data query request can be sent to the target object. The detection result of the protection function is determined based on the first and second data query responses, improving the accuracy of the detection results from the attacker's perspective. In addition, by sending the detection results from multiple sub-workflows, it is possible to promptly identify and resolve security issues existing in the target object, thereby improving the security of the target object.

[0172] Figure 10 This is a schematic diagram of a protection detection device based on attack payloads according to an embodiment of this application. This protection detection device based on attack payloads is used to perform the steps of the aforementioned protection detection method based on attack payloads. See [link to relevant documentation]. Figure 10 The attack payload-based protection detection device includes: an acquisition module 1001, a first sending module 1002, a determination module 1003, and a second sending module 1004.

[0173] The acquisition module 1001 is used to acquire the detection workflow. The detection workflow is constructed from multiple sub-workflows in a low-code manner. Each sub-workflow is encapsulated by its corresponding detection code. The multiple sub-workflows are used to detect the target object for various protection functions.

[0174] The first sending module 1002 is used to send a first data query request of the sub-workflow to the target object every preset period for any sub-workflow in the detection workflow. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow.

[0175] The first sending module 1002 is also used to send a second data query request to the target object based on the first data query request and the attack payload of the sub-workflow. The second data query request is used to request target data and includes the attack payload.

[0176] The determination module 1003 is used to determine the detection result of the sub-workflow based on the first data query response of the first data query request and the second data query response of the second data query request. The detection result is used to indicate whether the protection function detected by the sub-workflow is normal.

[0177] The second sending module 1004 is used to send result information based on the detection results of multiple sub-workflows. The result information is used to notify the target object of the detection results.

[0178] This application provides a protection detection device based on attack payload. It constructs a detection workflow by encapsulating multiple sub-workflows with pre-packaged detection code using a low-code approach. Because the detection code for various protection functions is encapsulated into sub-workflows, it eliminates the need to rewrite the detection code when detecting the required protection function. The encapsulated sub-workflows can be used as needed to construct a detection workflow capable of detecting multiple protection functions, improving the construction efficiency of the detection workflow and thus enhancing detection efficiency. Furthermore, at preset intervals, for the detection of any protection function, a first data query request and a second data query request can be sent to the target object. The detection result of the protection function is determined based on the first and second data query responses, improving the accuracy of the detection results from the attacker's perspective. Additionally, by sending result information through the detection results of multiple sub-workflows, it is possible to promptly identify and resolve security issues existing in the target object, thereby improving the security of the target object.

[0179] In some embodiments, Figure 11 This is a schematic diagram of another attack payload-based protection detection device provided according to an embodiment of this application. The first transmitting module 1002 includes:

[0180] The generation unit 1101 is used to generate a preset number of second data query requests based on the first data query request and the attack payload;

[0181] The sending unit 1102 is used to send a preset number of second data query requests to the target object.

[0182] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads employ different attack methods;

[0183] The generation unit 1101 is used to generate a preset number of second data query requests for any attack payload based on the first data query request and the attack payload.

[0184] The sending unit 1102 is used to send a preset number of second data query requests to the target object for any attack payload.

[0185] In some embodiments, the determining module 1003 includes:

[0186] The receiving unit 1103 is used to receive a first data query response to a first data query request and a preset number of second data query responses to a second data query request;

[0187] Processing unit 1104 is used to perform hash operations on the first data query response and a preset number of second data query responses respectively to obtain a first hash value and a preset number of second hash values;

[0188] The determining unit 1105 is used to determine the detection result of the sub-workflow based on the first hash value and a preset number of second hash values.

[0189] In some embodiments, the determining unit 1105 is configured to determine the consistency between the second hash value and the first hash value for any second hash value; and if the number of second hash values ​​that are consistent with the first hash value exceeds the target number among a preset number of second hash values, determine that the detection result of the sub-workflow is a protection anomaly.

[0190] In some embodiments, for any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads employ different attack methods;

[0191] The determining unit 1105 is used to determine the detection result of the sub-workflow as protection abnormal if the number of second hash values ​​corresponding to the target attack payload that match the first hash value exceeds the target number; and to determine the detection result of the sub-workflow as protection normal if the number of second hash values ​​corresponding to multiple attack payloads that match the first hash value does not exceed the target number.

[0192] In some embodiments, the sending module 1004 is configured to send result information when a protection anomaly is found in the detection results of multiple sub-workflows, the result information being used to indicate the presence of an abnormal protection function.

[0193] It should be noted that the attack payload-based protection and detection device provided in the above embodiments is only illustrated by the division of the above functional modules when running the application. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the attack payload-based protection and detection device and the attack payload-based protection and detection method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0194] In the embodiments of this application, the computer device can be configured as a terminal or a server. When the computer device is configured as a terminal, the terminal can act as the execution subject to implement the technical solutions provided in the embodiments of this application. When the computer device is configured as a server, the server can act as the execution subject to implement the technical solutions provided in the embodiments of this application. Alternatively, the technical solutions provided in this application can be implemented through the interaction between the terminal and the server. The embodiments of this application do not limit this.

[0195] In this embodiment of the application, the computer device can be configured as a terminal. Figure 12 This is a structural block diagram of a terminal 1200 according to an embodiment of this application. The terminal 1200 can be a portable mobile terminal, such as a smartphone, tablet computer, MP3 player (Moving Picture Experts Group Audio Layer III), MP4 player (Moving Picture Experts Group Audio Layer IV), laptop computer, or desktop computer. The terminal 1200 may also be referred to as a user device, portable terminal, laptop terminal, desktop terminal, or other names.

[0196] Typically, terminal 1200 includes a processor 1201 and a memory 1202.

[0197] Processor 1201 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1201 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1201 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1201 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 1201 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0198] The memory 1202 may include one or more computer-readable storage media, which may be non-transitory. The memory 1202 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1202 are used to store at least one computer program, which is executed by the processor 1201 to implement the attack payload-based protection detection method provided in the method embodiments of this application.

[0199] In some embodiments, the terminal 1200 may also optionally include a peripheral device interface 1203 and at least one peripheral device. The processor 1201, memory 1202, and peripheral device interface 1203 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 1203 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of the following: radio frequency circuitry 1204, display screen 1205, camera assembly 1206, audio circuitry 1207, and power supply 1208.

[0200] Peripheral device interface 1203 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 1201 and memory 1202. In some embodiments, processor 1201, memory 1202 and peripheral device interface 1203 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 1201, memory 1202 and peripheral device interface 1203 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0201] The radio frequency (RF) circuit 1204 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 1204 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 1204 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. In some embodiments, the RF circuit 1204 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The RF circuit 1204 can communicate with other terminals via at least one wireless communication protocol. This wireless communication protocol includes, but is not limited to: the World Wide Web, metropolitan area networks, intranets, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 1204 may also include circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0202] Display screen 1205 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 1205 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 1201 for processing. In this case, display screen 1205 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, there may be one display screen 1205, disposed on the front panel of terminal 1200; in other embodiments, there may be at least two display screens, disposed on different surfaces of terminal 1200 or in a folded design; in still other embodiments, display screen 1205 may be a flexible display screen, disposed on a curved or folded surface of terminal 1200. Furthermore, display screen 1205 may also be configured as a non-rectangular, irregular shape, i.e., a non-rectangular screen. The display screen 1205 can be made of materials such as LCD (Liquid Crystal Display) and OLED (Organic Light-Emitting Diode).

[0203] The camera assembly 1206 is used to acquire images or videos. In some embodiments, the camera assembly 1206 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the terminal, and the rear-facing camera is located on the back of the terminal. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments, the camera assembly 1206 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash is a combination of a warm-light flash and a cool-light flash, which can be used for light compensation at different color temperatures.

[0204] The audio circuit 1207 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, converting the sound waves into electrical signals that are input to the processor 1201 for processing, or input to the radio frequency circuit 1204 for voice communication. For stereo sound acquisition or noise reduction purposes, multiple microphones may be used, each positioned at a different location on the terminal 1200. The microphone may also be an array microphone or an omnidirectional microphone. The speaker is used to convert electrical signals from the processor 1201 or the radio frequency circuit 1204 into sound waves. The speaker may be a conventional diaphragm speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can convert electrical signals not only into audible sound waves but also into inaudible sound waves for purposes such as distance measurement. In some embodiments, the audio circuit 1207 may also include a headphone jack.

[0205] Power supply 1208 is used to power the various components in terminal 1200. Power supply 1208 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 1208 includes a rechargeable battery, the rechargeable battery can be a wired rechargeable battery or a wireless rechargeable battery. A wired rechargeable battery is a battery that is charged via a wired line, and a wireless rechargeable battery is a battery that is charged via a wireless coil. The rechargeable battery can also be used to support fast charging technology.

[0206] In some embodiments, the terminal 1200 further includes one or more sensors 1209. The one or more sensors 1209 include, but are not limited to: an acceleration sensor 1120, a gyroscope sensor 1211, a pressure sensor 1212, an optical sensor 1213, and a proximity sensor 1214.

[0207] Accelerometer 1120 can detect the magnitude of acceleration along the three coordinate axes of a coordinate system established with terminal 1200. For example, accelerometer 1120 can be used to detect the components of gravitational acceleration along the three coordinate axes. Processor 1201 can control display screen 1205 to display the user interface in either a landscape or portrait view based on the gravitational acceleration signal acquired by accelerometer 1120. Accelerometer 1120 can also be used for games or for acquiring user motion data.

[0208] The gyroscope sensor 1211 can detect the orientation and rotation angle of the terminal 1200. The gyroscope sensor 1211 can work in conjunction with the accelerometer sensor 1120 to collect the user's 3D movements on the terminal 1200. Based on the data collected by the gyroscope sensor 1211, the processor 1201 can perform the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0209] The pressure sensor 1212 can be disposed on the side bezel of the terminal 1200 and / or on the lower layer of the display screen 1205. When the pressure sensor 1212 is disposed on the side bezel of the terminal 1200, it can detect the user's grip signal on the terminal 1200, and the processor 1201 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor 1212. When the pressure sensor 1212 is disposed on the lower layer of the display screen 1205, the processor 1201 can control the operable controls on the UI interface based on the user's pressure operation on the display screen 1205. The operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0210] Optical sensor 1213 is used to collect ambient light intensity. In one embodiment, processor 1201 can control the display brightness of display screen 1205 based on the ambient light intensity collected by optical sensor 1213. Specifically, when the ambient light intensity is high, the display brightness of display screen 1205 is increased; when the ambient light intensity is low, the display brightness of display screen 1205 is decreased. In another embodiment, processor 1201 can also dynamically adjust the shooting parameters of camera assembly 1206 based on the ambient light intensity collected by optical sensor 1213.

[0211] The proximity sensor 1214, also known as a distance sensor, is typically located on the front panel of the terminal 1200. The proximity sensor 1214 is used to detect the distance between the user and the front of the terminal 1200. In one embodiment, when the proximity sensor 1214 detects that the distance between the user and the front of the terminal 1200 is gradually decreasing, the processor 1201 controls the display screen 1205 to switch from a screen-on state to a screen-off state; when the proximity sensor 1214 detects that the distance between the user and the front of the terminal 1200 is gradually increasing, the processor 1201 controls the display screen 1205 to switch from a screen-off state to a screen-on state.

[0212] Those skilled in the art will understand that Figure 12 The structure shown does not constitute a limitation on terminal 1200 and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0213] Figure 13 This is a schematic diagram of a server structure according to an embodiment of this application. The server 1300 can vary considerably due to different configurations or performance. It may include one or more Central Processing Units (CPUs) 1301 and one or more memories 1302. The memory 1302 stores at least one computer program, which is loaded and executed by the processor 1301 to implement the attack payload-based protection detection method provided in the above-described method embodiments. Of course, the server may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The server may also include other components for implementing device functions, which will not be elaborated here.

[0214] This application also provides a computer-readable storage medium storing at least one computer program. This computer program is loaded and executed by the processor of a computer device to implement the operations performed by the computer device in the attack payload-based protection detection method of the above embodiments. For example, the computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device, etc.

[0215] This application also provides a computer program product, including computer program code, which is stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium and executes the computer program, causing the computer device to perform the attack payload-based protection detection method provided in the various optional implementations described above.

[0216] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0217] The above description is merely an optional embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.< / video>

Claims

1. A protection detection method based on attack payload, characterized in that, The method includes: A detection workflow is obtained, which is constructed from multiple sub-workflows in a low-code manner. Each sub-workflow is encapsulated by its corresponding detection code. The multiple sub-workflows are used to detect the target object for various protection functions. Every preset period, for any sub-workflow in the detection workflow, a first data query request for the sub-workflow is sent to the target object. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow. Based on the first data query request and the attack payload of the sub-workflow, a second data query request is sent to the target object. The second data query request is used to request the target data and includes the attack payload. Based on the first data query response of the first data query request and the second data query response of the second data query request, the detection result of the sub-workflow is determined, and the detection result is used to indicate whether the protection function detected by the sub-workflow is normal; Based on the detection results of the multiple sub-workflows, result information is sent, which is used to notify the target object of the detection results.

2. The method according to claim 1, characterized in that, The step of sending a second data query request to the target object based on the first data query request and the attack payload of the sub-workflow includes: Based on the first data query request and the attack payload, a preset number of second data query requests are generated; Send the preset number of second data query requests to the target object.

3. The method according to claim 2, characterized in that, For any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads use different attack methods; The step of generating a preset number of second data query requests based on the first data query request and the attack payload includes: For any attack payload, based on the first data query request and the attack payload, generate the preset number of second data query requests; Sending the preset number of second data query requests to the target object includes: For any attack payload, send the preset number of second data query requests to the target object.

4. The method according to claim 1, characterized in that, The determination of the detection result of the sub-workflow based on the first data query response of the first data query request and the second data query response of the second data query request includes: Receive the first data query response to the first data query request and the second data query responses to a preset number of second data query requests; Perform hash operations on the first data query response and the preset number of second data query responses respectively to obtain a first hash value and the preset number of second hash values; The detection result of the sub-workflow is determined based on the first hash value and the preset number of second hash values.

5. The method according to claim 4, characterized in that, Determining the detection result of the sub-workflow based on the first hash value and the preset number of second hash values ​​includes: For any second hash value, determine the consistency between the second hash value and the first hash value; If, among the preset number of second hash values, the number of second hash values ​​that match the first hash value exceeds the target number, the detection result of the sub-workflow is determined to be a protection anomaly.

6. The method according to claim 5, characterized in that, For any sub-workflow in the detection workflow, the sub-workflow includes multiple attack payloads, and the multiple attack payloads use different attack methods; If, among the preset number of second hash values, the number of second hash values ​​that match the first hash value exceeds the target number, the detection result of the sub-workflow is determined to be a protection anomaly, including: If the number of second hash values ​​corresponding to the target attack payload that match the first hash value exceeds the target number, the detection result of the sub-workflow is determined to be a protection anomaly. If the number of second hash values ​​corresponding to the multiple attack payloads that match the first hash value does not exceed the target number, the detection result of the sub-workflow is determined to be normal protection.

7. The method according to claim 1, characterized in that, The sending of result information based on the detection results of the multiple sub-workflows includes: If a protection anomaly is found in the detection results of the multiple sub-workflows, the result information is sent, which is used to indicate the presence of an abnormal protection function.

8. A protection detection device based on attack payload, characterized in that, The device includes: The acquisition module is used to acquire the detection workflow, which is constructed from multiple sub-workflows in a low-code manner. Each of the multiple sub-workflows is encapsulated by its corresponding detection code. The multiple sub-workflows are used to detect the target object for various protection functions. The first sending module is used to send a first data query request of any sub-workflow in the detection workflow to the target object at preset intervals. The first data query request is used to request target data. The first data query request does not include an attack payload. The attack payload is used to launch an attack on the protection function detected by the sub-workflow. The first sending module is further configured to send a second data query request to the target object based on the first data query request and the attack payload of the sub-workflow, the second data query request being used to request the target data, and the second data query request including the attack payload; The determination module is used to determine the detection result of the sub-workflow based on the first data query response of the first data query request and the second data query response of the second data query request. The detection result is used to indicate whether the protection function detected by the sub-workflow is normal. The second sending module is used to send result information based on the detection results of the multiple sub-workflows, and the result information is used to notify the target object of the detection results.

9. A computer device, characterized in that, The computer device includes a processor and a memory, the memory being used to store at least one computer program, the at least one computer program being loaded by the processor and executed as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store at least one computer program for executing the attack payload-based protection detection method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the attack payload-based protection detection method as described in any one of claims 1 to 7.

Images