Over-privilege detection method and device, electronic equipment and storage medium

Abstract

The application provides an over-authorization detection method and device, electronic equipment and a storage medium, and relates to the technical field of Internet. The over-authorization detection method comprises the following steps: obtaining traffic request data of a client; performing application program interface asset discovery by using bytecode enhancement based on the traffic request data, obtaining application program interface asset data; performing over-authorization detection on the traffic request data according to the application program interface asset data, and obtaining an over-authorization detection result, so that automatic over-authorization detection is realized, manual operation is not required in the whole detection process, human cost is saved, and the efficiency of over-authorization detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet, and particularly relates to an over-privilege detection method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, the security problems of various websites and application programs are becoming more and more prominent, and over-privilege is one of them. At present, the over-privilege detection in security testing still mainly relies on manual testing by detection personnel.

[0003] Specifically, the traditional over-privilege detection method usually relies on manual audit or static code checking, but has certain limitations, such as difficulty in finding potential over-privilege behaviors, high false negative and false positive rates, and the need for a large amount of manual participation. For some complex application programs (such as application programs with many data interfaces), a large amount of human cost needs to be paid in the process of manual testing, and the efficiency is low. SUMMARY

[0004] The purpose of the embodiments of the present application is to provide an over-privilege detection method, device, electronic equipment and storage medium to solve the problems of low detection efficiency and high false positive rate of the traditional over-privilege detection method. The specific technical solutions are as follows:

[0005] In a first aspect, the present application provides an over-privilege detection method, comprising:

[0006] obtaining traffic request data of a client;

[0007] based on the traffic request data, performing application program interface asset discovery by using bytecode enhancement to obtain application program interface asset data;

[0008] performing over-privilege detection on the traffic request data according to the application program interface asset data to obtain an over-privilege detection result.

[0009] In one possible implementation, the client includes an application program, and the obtaining of the traffic request data of the client comprises:

[0010] intercepting a class of the application program when the application program is running to obtain intercepted data;

[0011] determining the traffic request data by using the request path information.

[0012] In one possible implementation, the performing of application program interface asset discovery by using bytecode enhancement based on the traffic request data to obtain application program interface asset data comprises:

[0013] performing traffic preprocessing based on the traffic request data to obtain target traffic request data;

[0014] application program interface asset discovery is performed on the target traffic request data by using bytecode enhancement to obtain application program interface asset data.

[0015] In one possible implementation, the traffic preprocessing based on the traffic request data to obtain target traffic request data includes:

[0016] detecting whether the traffic request data contains a non-concerned traffic item, the non-concerned traffic item including at least one of static resource access request data, error status code request data, and external attack traffic data;

[0017] if the traffic request data contains the non-concerned traffic item, removing the non-concerned traffic item to obtain to-be-cleaned traffic request data;

[0018] de-duplication processing is performed on the to-be-cleaned traffic request data to obtain the target traffic request data.

[0019] In one possible implementation, the application program interface asset discovery based on the traffic request data by using bytecode enhancement to obtain application program interface asset data includes:

[0020] source code position information of application program interface initialization completion is acquired for the traffic request data;

[0021] based on the source code position information, an instance information of a request mapping class is acquired by using an acquisition method of the application program interface, the request mapping class being a class responsible for request mapping;

[0022] the instance information is used to call a method in the request mapping class to obtain interface information;

[0023] the interface information is analyzed to obtain the application program interface asset data.

[0024] In one possible implementation, the over-privilege detection based on the application program interface asset data on the traffic request data to obtain an over-privilege detection result includes:

[0025] a request operation resource type is determined by using the application program interface asset data, the request operation type being an operation resource type to which the traffic request data belongs;

[0026] vulnerability scanning is performed on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain the over-privilege detection result.

[0027] In a possible implementation, the request operation resource type is a resource query operation type, the traffic request data is scanned for vulnerabilities according to a preset scanning manner corresponding to the operation resource type, and an unauthorized access detection result is obtained, including:

[0028] The request response information corresponding to the traffic request data is obtained based on a preset scanning manner corresponding to the resource query operation type, the request response information being response information of an operation request contained in the traffic request data;

[0029] The request response information is scanned for vulnerabilities, and vulnerability scanning information is obtained;

[0030] The vulnerability scanning information is used to generate the unauthorized access detection result.

[0031] In a possible implementation, the request response information is scanned for vulnerabilities, and vulnerability scanning information is obtained, including:

[0032] It is detected whether the request response information contains target data, the target data being data carried by response information of a constructed request, the constructed request being a request constructed according to authentication information of a test account and the resource query operation type;

[0033] If the request response information does not contain the target data, it is detected whether a data format of the request response information is a preset data exchange format;

[0034] If the data format of the request response information is the data exchange format, it is detected that a string in the request response information matches a key character, and the vulnerability scanning information is generated according to the detected key character;

[0035] If the data format of the request response information is not the data exchange format, when a character length of the request response information is greater than a preset length threshold, the request response information and reference response information are used to determine a response similarity, and the vulnerability scanning information is generated based on the response similarity, where the reference response information is response information of the constructed request.

[0036] In a possible implementation, the request operation resource type is a resource modification operation type, the traffic request data is scanned for vulnerabilities according to a preset scanning manner corresponding to the operation resource type, and an unauthorized access detection result is obtained, including:

[0037] The database operation calling method contained in the traffic request data is intercepted based on a preset scanning manner corresponding to the resource modification operation type, the database operation calling method being a method called by a database operation;

[0038] The data operation call method corresponds to a database operation, and permission detection is performed on the database operation to obtain permission detection information;

[0039] The permission detection information is used to generate the over-authorization detection result.

[0040] In a second aspect, an over-authorization detection device is provided, which includes:

[0041] A traffic request data acquisition module is configured to acquire traffic request data of a client.

[0042] An interface asset discovery module is configured to perform application program interface asset discovery based on the traffic request data and using bytecode enhancement to obtain application program interface asset data.

[0043] An over-authorization detection module is configured to perform over-authorization detection on the traffic request data based on the application program interface asset data to obtain an over-authorization detection result.

[0044] In a third aspect, an electronic device is provided, which includes a processor, a communication interface, a memory, and a communication bus. The processor, the communication interface, and the memory can communicate with each other through the communication bus.

[0045] The memory is configured to store a computer program.

[0046] The processor is configured to execute the program stored in the memory to implement the over-authorization detection method of any one of the first aspect.

[0047] In a fourth aspect, a computer readable storage medium is provided, which stores a computer program. The computer program is executed by a processor to implement the over-authorization detection method of any one of the first aspect.

[0048] In a fifth aspect, a computer program product including instructions is provided, which, when executed on a computer, causes the computer to perform the steps of the over-authorization detection method of any one of the above aspects.

[0049] The embodiments of the present application provide an over-authorization detection method, device, electronic device, and storage medium. The traffic request data of a client is acquired, and the application program interface asset data is obtained by performing application program interface asset discovery based on the acquired traffic request data and using bytecode enhancement. Then, the over-authorization detection result is obtained by performing over-authorization detection on the traffic request data based on the application program interface asset data. The automatic over-authorization detection is implemented, and no manual operation is required in the entire detection process, thereby saving the labor cost and improving the efficiency and accuracy of over-authorization detection. The problems of low detection efficiency and high false positive rate of the existing traditional over-authorization detection method are solved.

[0050] Of course, practicing either of the products or methods of the present application does not necessarily require achieving all of the above-mentioned advantages at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0051] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments consistent with the present application and, together with the description, further serve to explain the principles of the application.

[0052] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings required to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, other drawings can also be obtained from these drawings without any creative effort.

[0053] One or more embodiments are illustrated by way of example with reference to the drawings, which are not necessarily drawn to scale, and which are not intended to limit the scope of the embodiments, the elements being shown with the same reference numerals or symbols where possible being similar in structure and function unless otherwise described in detail. The drawings are not intended to limit the scope of the embodiments.

[0054] Figure 1 A flowchart of an over-authorization detection method provided by an embodiment of the present application;

[0055] Figure 2 A flowchart of an over-authorization detection method provided by an optional embodiment of the present application;

[0056] Figure 3 A structural schematic diagram of an over-authorization detection device provided by an embodiment of the present application;

[0057] Figure 4 A structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0058] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without any creative effort fall within the scope of protection of the present application.

[0059] The following disclosure provides many different embodiments, or examples, for implementing different structures of the application. For the purpose of simplifying the present disclosure, components and arrangements of specific examples are described below. Of course, they are merely examples and are not intended to limit the present application. In addition, the present application can repeatedly refer to reference numerals and / or letters in different examples. Such repetition is for the purpose of simplification and clarity, and does not indicate the relationship between the various embodiments and / or arrangements discussed.

[0060] Figure 1 A flowchart of an overreach detection method provided by an embodiment of the present application is shown. The method can be applied to one or more electronic devices such as a smartphone, a notebook computer, a desktop computer, a portable computer, and a server. In addition, the execution subject of the method can be hardware or software. When the execution subject is hardware, the execution subject can be one or more of the electronic devices. For example, a single electronic device can execute the method, or multiple electronic devices can cooperate with each other to execute the method. When the execution subject is software, the method can be implemented as multiple software or software modules, or as a single software or software module. No specific limitation is made herein.

[0061] As shown in Figure 1 The overreach detection method provided by the embodiment of the present application specifically includes the following steps:

[0062] Step S101: Obtain traffic request data of a client.

[0063] The client refers to the sending end of the traffic request data, such as an application program or a terminal device that sends the traffic request data, and the present application does not make any limitation thereon. The traffic request data refers to traffic request, such as a Hyper Text Transfer Protocol (HTTP) request.

[0064] In an optional embodiment of the present application, a hook can be used for interception to intercept the relevant traffic request data as the traffic request data of the client, thereby achieving automatic interception and obtaining of the traffic request.

[0065] Step S102: Based on the traffic request data, use bytecode enhancement to perform application program interface asset discovery, and obtain application program interface asset data.

[0066] Specifically, after obtaining the traffic request data of the client, the embodiment of the application can perform application program interface (API) asset discovery by using bytecode enhancement. For example, the source code location information of the application program interface initialization completion can be obtained, and based on the source code location information, the instance information of the request mapping class is obtained by using the getBean method of the application program interface, and the method getHandlerMethods() in the request mapping class is called to obtain all interface information by using the instance information, so as to analyze the obtained interface information, identify potential API assets, and then determine the application program interface asset data based on the identified potential API assets, so that subsequent over-authorization detection can be performed based on the application program interface asset data, and the detected over-authorization behavior has high accuracy.

[0067] It should be noted that the request mapping class in the embodiment of the application is a class responsible for request mapping, such as the class RequestMappingHandlerMapping responsible for processing request mapping in the network architecture Spring MVC.

[0068] Step S103, performing over-authorization detection on the traffic request data based on the application program interface asset data to obtain an over-authorization detection result.

[0069] Specifically, after obtaining the application program interface asset data, the embodiment can perform deep analysis on the traffic request data during code running based on the application program interface asset data, to detect whether the operation corresponding to the traffic request data has over-authorization behavior, and thus accurately find over-authorization behavior, generate an over-authorization detection result corresponding to the traffic request data, and solve the false negative and false positive problems existing in the existing traditional static checking and manual auditing.

[0070] It can be seen that, by obtaining the traffic request data of the client, the embodiment of the application performs application program interface asset discovery based on the obtained traffic request data by using bytecode enhancement, so that the application program interface asset data can be obtained, and then the traffic request data is detected based on the application program interface asset data, which realizes automatic over-authorization detection, and no manual operation is required in the entire detection process, thereby saving labor costs and improving the efficiency and accuracy of over-authorization detection, and solving the problems of low detection efficiency and high false positive rate existing in the existing traditional over-authorization detection method.

[0071] In some optional embodiments of the present application, the client sending the traffic request data can be an application installed in the smart device. Optionally, in the case where the client comprises an application, the present application can specifically obtain the traffic request data of the client by the following steps: intercepting the classes of the application when the application is running to obtain intercepted data; and determining the traffic request data by using the request path information.

[0072] As an example of the present application, in the case where the application is a Java application, the classes of the application can be enhanced or intercepted by a Java agent when the application is running to use the Java agent to intercept and obtain the HTTP request and return value of the application, so as to realize the acquisition of the HTTP request data. Specifically, a Java agent class (JavaAgent) can be first created, and a META-INF / MANIFEST.MF file can be created under the root directory to inform the Java virtual machine to load the JavaAgent class when running, and then the premain method is called, and the JavaAgent and the META-INF / MANIFEST.MF file are packaged into a JAR file, so that the JAR file can be loaded by adding the JavaAgent parameter when the application is running, so that the HTTP request information of the application can be obtained by the JavaAgent class in the JAR file, such as adding code in the transform method of the MyTransformer class by the JavaAgent class to intercept and record the information of the HTTP request and return value as the HTTP request information, that is, the bytecode is modified to realize the acquisition of all related traffic request data of the application during the running of the application, so as to realize real-time privilege escalation detection.

[0073] Optionally, the present application can use bytecode enhancement to perform application interface asset discovery based on the obtained traffic request data of the client to obtain application interface asset data, which can specifically comprise: obtaining source code position information of the application interface initialization completion for the traffic request data; obtaining instance information of a request mapping class based on the source code position information and by using the obtaining method of the application interface, the request mapping class being a class responsible for request mapping; calling a method in the request mapping class by using the instance information to perform interface information acquisition to obtain interface information; and analyzing the interface information to obtain the application interface asset data. The instance information of the request mapping class refers to the instance of the request mapping class, such as the instance of the RequestMappingHandlerMapping class obtained by using the getBean method.

[0074] Specifically, API asset discovery is performed using bytecode enhancement, which can include the following processes: first, the location where the initialization of the ApplicationContext is completed is found to obtain the source code location of the initialization of the ApplicationContext as the source code location information; then, the instance of the RequestMappingHandlerMapping is obtained using the getBean method of the ApplicationContext to obtain the mapping relationship of all processor methods (i.e., interfaces) through the getHandlerMethods() method in the RequestMappingHandlerMapping class, and then all interfaces can be determined based on the obtained mapping relationship of all processor methods to obtain the data of all interfaces as the interface information; the interface information includes the request path, HTTP method, and corresponding processing method of all interfaces, and this step is limited by the embodiments of the present application; after the interface information is obtained, the interface information can be encapsulated and sent to the server side to obtain API asset data through the server side, such as encapsulating the obtained interface information into a data structure format, for example, a JSON format, which includes the class name, interface parameter URL of the class, interface type POST GET API, and the like, and then sending the encapsulated data to the server side for further processing and analysis, so that the server side can analyze and identify potential API assets based on the received interface information, thereby realizing the discovery and acquisition of API asset data.

[0075] In an embodiment, the traffic request data obtained can be preprocessed to fill in traffic information and remove unnecessary traffic entries before traffic analysis, so that the necessary information can be ensured for each traffic request to be analyzed comprehensively by filling in the traffic information, and the analysis efficiency can be improved by removing unnecessary traffic entries to be analyzed, so as to realize real-time monitoring of unauthorized behavior during program execution. Optionally, the embodiments of the present application use bytecode enhancement to discover application program interface assets based on the traffic request data to obtain application program interface asset data, which can specifically include: preprocessing the traffic request data to obtain target traffic request data; using bytecode enhancement to discover application program interface assets from the target traffic request data to obtain the application program interface asset data.

[0076] For example, after obtaining the traffic request data containing the complete Request and Response from the JavaAgent class based on bytecode enhancement, a series of traffic data that does not need to be concerned by the scanner, such as static resources, error status codes, external attack traffic, etc. can be removed, and the sensitive data detection engine can be used to mark the interface containing sensitive information in the request / return while filling in the routing information. Based on the marked interface, the necessary information required by each request can be added to the traffic request data, and the traffic request data obtained after preprocessing can be determined as target traffic request data, so that subsequent application program interface asset discovery based on bytecode enhancement can be performed based on the target traffic request data, and the efficiency of privilege escalation detection and analysis can be improved.

[0077] In an optional embodiment of the present application, the traffic preprocessing based on the traffic request data to obtain target traffic request data can specifically include: detecting whether the traffic request data contains a traffic entry that does not need to be concerned, the traffic entry that does not need to be concerned containing at least one of static resource access request data, error status code request data and external attack traffic data; if the traffic request data contains the traffic entry that does not need to be concerned, removing the traffic entry that does not need to be concerned to obtain to-be-cleaned traffic request data; and performing deduplication processing on the to-be-cleaned traffic request data to obtain the target traffic request data.

[0078] The static resource access request data refers to the data of a static resource access request, and the static resource access request refers to a request for accessing a static resource. The static resource usually includes a picture, a style sheet (such as a cascading style sheet), a script (such as an interpreted or just-in-time compiled programming language JavaScript script), etc. These static resources in the webpage are not helpful for actual privilege escalation detection, and thus can be removed. Specifically, the static resource access request can be identified in the following ways.

[0079] Method one: according to a file extension: identifying a file extension carried in an access request, if the file extension is a static resource file extension (such as.jpg,.png,.css,.js, etc.), it is determined that the access request is a static resource access request.

[0080] Method two: according to a request path: identifying an access path corresponding to an access request, if the access path contains a keyword of a static resource path (such as / img, or / static), it is determined that the access request is a static resource access request.

[0081] The error status code request data refers to data of an error status code request, the error status code request refers to an error request generated due to server failure or non-existent resource, and is not a normal access request of a user, and thus can be removed. Specifically, whether a traffic request is an error status code request can be determined by an HTTP status code of the traffic request. For example, if the HTTP status code of a traffic request is a 4xx error code (such as 404 Not Found or 403 Forbidden) representing a client error, it can be determined that the traffic request is an error status code request. For another example, if the HTTP status code of a traffic request is a 5xx error code (such as 500 Internal Server Error) representing a server error, it can be determined that the traffic request is an error status code request.

[0082] In the foregoing manner, all static resource access request data and error status code request data can be removed from the acquired traffic request data, so that the interference of a vulnerability on a scanner can be effectively reduced, and the remaining traffic request data can be used as to-be-cleaned traffic request data, so as to obtain target traffic request data by de-duplication processing, so that subsequent vulnerability scanning can be performed according to the target traffic request data, and privilege detection can be implemented. For example, interface marking and de-duplication can be used to perform de-duplication processing on the traffic request data, so that the traffic request data for the same interface is not scanned multiple times, efficiency is improved, and de-duplication also helps to reduce redundant traffic request scanning, and ensures that the least amount of traffic request is used to discover a vulnerability.

[0083] In addition, in order to ensure that the target traffic request data contains necessary information required in the traffic request, detection is performed on each original traffic request in the traffic request data, a detection result of each original traffic request is generated, and when the detection result of a certain original request is that necessary information (such as service information and routing information) is missing, information supplementing operation is performed on the original request according to pre-set content, so as to complete the information of the original request, thereby solving the problem that some traffic requests cannot be subjected to privilege detection due to incomplete information, and ensuring that privilege detection can be performed on the traffic request subsequently.

[0084] Reference Figure 2 , a flowchart of a privilege detection method provided by an optional embodiment of the application is shown. As shown in Figure 2 , the privilege detection method provided by the optional embodiment of the application can include the following steps:

[0085] Step S201, acquiring traffic request data of a client;

[0086] Step S202, performing traffic preprocessing based on the traffic request data to obtain target traffic request data;

[0087] In step S203, the bytecode enhancement is used to perform application interface asset discovery on the target traffic request data to obtain application interface asset data.

[0088] In step S204, the traffic request data is subjected to privilege violation detection according to the application interface asset data to obtain a privilege violation detection result.

[0089] It can be seen that, after the traffic preprocessing removes the traffic items that do not need to be concerned in the traffic request data, the embodiment of the present application can perform API asset discovery on the target traffic request data by using bytecode enhancement, and perform privilege violation detection based on the discovered application interface asset data, so as to realize automatic detection and real-time analysis at runtime through automatic detection, effectively discover potential privilege violation behaviors, and greatly reduce the workload and complexity of manual audit of privilege violation behaviors. In addition, bytecode enhancement can dynamically modify and enhance the code at runtime without changing the source code and recompiling, thereby realizing real-time detection of privilege violation.

[0090] Optionally, the embodiment of the present application performs privilege violation detection on the traffic request data according to the application interface asset data to obtain a privilege violation detection result, which can specifically include: determining a request operation resource type by using the application interface asset data, the request operation type being an operation resource type to which the traffic request data belongs; and performing vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain the privilege violation detection result.

[0091] Specifically, after the application interface asset data is obtained, the embodiment of the present application can enter real scanning based on the application interface asset data to realize privilege violation detection through privilege violation scanning. In an embodiment, the privilege violation vulnerabilities can be divided into resource query type privilege violation types and resource modification type privilege violation types according to operation resource types, and different scanning logics can be executed for different operation resource types to perform vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type, so as to perform in-depth analysis during code running and improve the accuracy of privilege violation detection.

[0092] The resource query operation type is an operation type of a resource reading type. Optionally, in the case where the request operation resource type is the resource query operation type, the embodiment of the present application performs vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain an overreach detection result, including: obtaining request response information corresponding to the traffic request data based on a preset scanning mode corresponding to the resource query operation type, the request response information being response information of an operation request contained in the traffic request data; performing vulnerability scanning using the request response information to obtain vulnerability scanning information; and generating the overreach detection result using the vulnerability scanning information.

[0093] Specifically, the resource reading type overreach is mainly to obtain sensitive data through an interface, for example, the resource reading type overreach can include a query type overreach, which obtains sensitive data of other users through an interface. For example, if it is found that the traffic contains sensitive data, the request response information corresponding to the traffic request data can be used to perform vulnerability scanning according to a preset scanning mode corresponding to the resource query operation type, to determine whether the sensitive data is obtained through the resource reading type overreach. The sensitive data can be set by the user according to actual needs, for example, the user's mobile phone number, identity information and other private data can be set as sensitive data, and the embodiment of the present application does not limit this.

[0094] In an optional embodiment of the present application, the request response information is used to perform vulnerability scanning to obtain vulnerability scanning information, specifically including: detecting whether the request response information contains target data, the target data being data carried by response information of a constructed request, the constructed request being a request constructed according to authentication information of a test account and the resource query operation type; if the request response information does not contain the target data, detecting whether a data format of the request response information is a preset data exchange format; if the data format of the request response information is the data exchange format, detecting a key character matched by a string in the request response information, and generating the vulnerability scanning information according to the detected key character; if the data format of the request response information is not the data exchange format, when a character length of the request response information is greater than a preset length threshold, determining response similarity using the request response information and reference response information, and generating the vulnerability scanning information based on the response similarity, wherein the reference response information is response information of the constructed request.

[0095] As an example of the present application, in the case of setting the target data as sensitive data, if the traffic containing sensitive data is obtained, the scanning logic corresponding to the resource query operation type is executed, as shown in the following return of obtaining the user bill orderID, there is a sensitive data mobile phone number field "phone": 13300000000, the scanning logic is as follows: after establishing the test account pool in advance, creating the resource type and filling the sensitive data for each test account, the scanner worker end obtains the traffic request data, and can replace the login state with the authentication information of the test account from the user pool to construct the request, so as to replace the resource ID of other accounts in the user pool according to the dynamic parameter resource type identified in advance, that is, to send the constructed request; if the return value contains the sensitive data set in advance by the test account, it means that the interface has query type unauthorized. Since the resource query type unauthorized feature is obvious and depends less on external information, it can be determined whether it is necessary to traverse all strings in the request response information by judging whether the data format of the request response information is the preset data exchange format JSON; if the data format of the request response information is the preset data exchange format JSON, it can be matched whether the string of the request response information contains the keyword by traversing all strings in the request response information, so as to determine that the resource reading type is unauthorized when the string in the request response information contains the matching key character, and generate the corresponding vulnerability scanning information; when the data format of the request response information is not the preset data exchange format JSON, it is judged whether the response length is greater than the preset length threshold 100, that is, whether the character length of the request response information is greater than the preset length threshold, so as to exclude the short length request response by the preset length threshold, because the very short response may be only a JSON skeleton; when the character length of the request response information is greater than the preset length threshold, the response similarity can be determined by the request response information and the reference response information, and the vulnerability scanning information is generated based on the response similarity, such as when the response similarity is greater than 0.8, that is, when the response similarity is greater than 0.8, it is determined that there is a vulnerability, and then the corresponding vulnerability scanning information can be generated, so that the subsequent unauthorized detection result can be generated according to the vulnerability scanning information.

[0096] In addition, since resource modification type requests are mainly in the form of POST / PUT / DELETE methods, the response content is generally less, and it is difficult to determine whether there is an unauthorized vulnerability by returning a value. Therefore, in an optional embodiment of the present application, bytecode is inserted to add link information in the sensitive interface marking link, and the original request link information is obtained from the link tracking platform. If there is an add, delete or modify operation on the database in the link, it is marked as a resource modification type interface, and the original call link information is stored. Thus, when the vulnerability scanner worker obtains such an interface, it can replace the login state and parameters of the request by replaying the request from the user pool, determine whether the response is normal, and determine whether there is an unauthorized resource modification type by comparing the new request (i.e. the constructed request) with the original request call link. If there is an add, delete or modify operation on the new request link, it means that there is a high probability of unauthorized access, which can be determined by manual retesting to determine whether there is unauthorized access. Through the above detection method, the range of interfaces with unauthorized vulnerabilities can be quickly reduced, greatly reducing the manpower and labor input for unauthorized detection, and saving human resources.

[0097] In another optional embodiment of the present application, the request operation resource type is a resource modification operation type, and the vulnerability scanning of the traffic request data according to the preset scanning mode corresponding to the operation resource type to obtain an unauthorized detection result includes: based on the resource modification operation type corresponding to the preset scanning mode, intercepting a database operation call method contained in the traffic request data, the database operation call method being a method called by a database operation; performing authority detection on the database operation corresponding to the data operation call method to obtain authority detection information; and generating the unauthorized detection result using the authority detection information.

[0098] As an example of the present application, at the application runtime, the bytecode instrumentation technology is used to change or increase the behavior of the program, such as by intercepting the SQL execution function in the driver program of the database, which can be specifically implemented by modifying the method, inserting additional code to monitor and intercept the SQL statement, and avoiding the generation of dirty data. Specifically, in the interceptor, the relevant information of each request, such as the request path, request parameter, user identifier, etc., is recorded as the traffic request data and stored in a data structure; then a globally unique identifier can be generated for each request, and this identifier can be used as part of the request and passed through the entire request link to serve as the unique identifier of the request, such as using UUID (Universally Unique Identifier) or other similar algorithms to generate the identifier, so as to be able to identify each request, such as passing the generated unique identifier into the database operation method, such as passing it in the form of a parameter, and intercepting the database operation method call in the interceptor to process before and after the call, such as returning the request identifier after the database operation is completed to associate the database operation with the original request, and then the unique identifier of the request and the relevant information of the database operation can be associated, such as storing them in the same database record, establishing the association between the request and the database operation, and implementing the association operation, so as to use the association information to identify the unauthorized behavior in the subsequent permission check.

[0099] For example, clear permission rules can be defined in the system in advance, including which users have permission to access which resources and perform which operations; then, the permission check can be performed on each database operation in the interceptor, including checking whether the user has permission to perform the operation and whether the user has permission to access the resource, such as writing the corresponding permission check logic according to the specific needs of the system and the permission rules to check whether the user belongs to a certain specific role or is in the access control list of the resource, thereby realizing the detection of unauthorized behavior. Specifically, in the permission check process, the previously established association information of the request and the database operation can be used to determine that the operator can only access the resources that he or she has permission to access by comparing the association information, such as comparing the association information in the database operation and the original request information.

[0100] In addition, the present example is based on bytecode for unauthorized detection, which can avoid the generation of dirty data by intercepting the database insertion operation, and the accuracy of unauthorized detection is higher, which can effectively reduce the impact of unauthorized detection on business.

[0101] It should be noted that, for the method embodiments, the series of acts / combinations thereof are described for simplicity, but the person skilled in the art should know that the embodiments of the present application are not limited to the sequence of acts described, because according to the embodiments of the present application, certain steps can be performed in other sequences or at the same time.

[0102] Based on the same technical concept, the embodiments of the present application also provide an overreach detection device, as shown in the figure, which comprises: Figure 3

[0103] The traffic request data acquisition module 310 is configured to acquire traffic request data of the client.

[0104] The interface asset discovery module 320 is configured to perform application program interface asset discovery on the traffic request data by using bytecode enhancement to obtain application program interface asset data.

[0105] The overreach detection module 330 is configured to perform overreach detection on the traffic request data according to the application program interface asset data to obtain an overreach detection result.

[0106] In a possible implementation, the client comprises an application program, and the traffic request data acquisition module 310 comprises:

[0107] The interception submodule is configured to intercept a class of the application program when the application program is running to obtain interception data.

[0108] The request data determination module is configured to determine the traffic request data by using the request path information.

[0109] In a possible implementation, the interface asset discovery module 320 comprises:

[0110] The traffic preprocessing submodule is configured to perform traffic preprocessing on the traffic request data to obtain target traffic request data.

[0111] The asset discovery submodule is configured to perform application program interface asset discovery on the target traffic request data by using bytecode enhancement to obtain the application program interface asset data.

[0112] ​In a possible implementation, the traffic preprocessing submodule is specifically configured to: detect whether the traffic request data contains a non-concerned traffic item, the non-concerned traffic item including at least one of static resource access request data, error status code request data, and external attack traffic data; if the traffic request data contains the non-concerned traffic item, remove the non-concerned traffic item to obtain to-be-cleaned traffic request data; and perform deduplication processing on the to-be-cleaned traffic request data to obtain the target traffic request data.

[0113] In a possible implementation, the interface asset discovery module 320 includes:

[0114] a source code location acquisition submodule configured to acquire source code location information of application program interface initialization completion for the traffic request data;

[0115] an instance information acquisition submodule configured to acquire instance information of a request mapping class by using an acquisition method of the application program interface based on the source code location information, the request mapping class being a class responsible for request mapping;

[0116] an interface information acquisition submodule configured to acquire interface information by calling a method in the request mapping class by using the instance information;

[0117] an interface information analysis submodule configured to analyze the interface information to obtain the application program interface asset data.

[0118] In a possible implementation, the privilege detection module 330 includes:

[0119] a resource type determination submodule configured to determine a request operation resource type by using the application program interface asset data, the request operation type being an operation resource type to which the traffic request data belongs;

[0120] a vulnerability scanning submodule configured to perform vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain the privilege detection result.

[0121] In a possible implementation, the request operation resource type is a resource query operation type, and the vulnerability scanning submodule is specifically configured to: acquire request response information corresponding to the traffic request data based on the preset scanning mode corresponding to the resource query operation type, the request response information being response information of an operation request included in the traffic request data; perform vulnerability scanning by using the request response information to obtain vulnerability scanning information; and generate the privilege detection result by using the vulnerability scanning information.

[0122] Optionally, the vulnerability scanning by using the request response information to obtain vulnerability scanning information comprises: detecting whether the request response information contains target data, the target data being data carried by response information of a constructed request, the constructed request being a request constructed according to authentication information of a test account and the resource query operation type; if the request response information does not contain the target data, detecting whether a data format of the request response information is a preset data exchange format; if the data format of the request response information is the data exchange format, detecting a key character matched by a string in the request response information, and generating the vulnerability scanning information according to the detected key character; if the data format of the request response information is not the data exchange format, when a character length of the request response information is greater than a preset length threshold, determining response similarity by using the request response information and reference response information, and generating the vulnerability scanning information based on the response similarity, wherein the reference response information is response information of the constructed request.

[0123] In another possible implementation, the request operation resource type is a resource modification operation type, and the vulnerability scanning submodule is specifically configured to: based on a preset scanning mode corresponding to the resource modification operation type, intercept a database operation calling method contained in the traffic request data, the database operation calling method being a method called by a database operation; perform authority detection on the database operation corresponding to the database operation calling method to obtain authority detection information; and generate the unauthorized detection result by using the authority detection information.

[0124] In a specific implementation, the above unauthorized detection device can be integrated in an electronic device, so that the electronic device can obtain traffic request data of a client, perform application program interface asset discovery by using bytecode enhancement based on the obtained traffic request data to obtain application program interface asset data, and then perform unauthorized detection on the traffic request data according to the application program interface asset data, thereby realizing automatic unauthorized detection and obtaining an unauthorized detection result. In the entire detection process, no manual operation is required, thereby saving labor cost and improving the efficiency and accuracy of unauthorized detection, and solving the problems of low detection efficiency and high false positive rate of the existing traditional unauthorized detection method.

[0125] Based on the same technical concept, the embodiments of the present application also provide an electronic device, such as Figure 4As shown, the electronic device includes a processor 111, a communication interface 112, a memory 113 and a communication bus 114, wherein the processor 111, the communication interface 112 and the memory 113 complete mutual communication through the communication bus 114, the memory 113 is configured to store a computer program, and the processor 111 is configured to execute the program stored in the memory 113 to implement the steps of the over-authorization detection method provided in any one of the preceding method embodiments.

[0126] In an embodiment of the present application, the processor 111 is configured to execute the program stored in the memory 113 to implement the over-authorization detection method provided in any one of the preceding method embodiments, including: obtaining traffic request data of a client; performing application program interface asset discovery based on the traffic request data by using bytecode enhancement to obtain application program interface asset data; and performing over-authorization detection on the traffic request data according to the application program interface asset data to obtain an over-authorization detection result.

[0127] The communication bus 114 mentioned in the above electronic device can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The communication bus 114 can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is shown in the figure, but it does not mean that there is only one bus or only one type of bus.

[0128] The communication interface 112 is configured to perform communication between the above electronic device and other devices.

[0129] The memory 113 can include a random access memory (RAM) and can also include a non-volatile memory (NVM), for example, at least one disk memory. Optionally, the memory 113 can also be at least one storage device located away from the processor 111.

[0130] The processor 111 described above can be a general processor, including a central processing unit (CPU), a network processor (NP), etc.; can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0131] In yet another embodiment provided in the present application, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. The computer program is executed by a processor to implement any of the above-mentioned privilege violation detection methods.

[0132] In yet another embodiment provided in the present application, a computer program product containing instructions is provided, and when the computer program product is run on a computer, the computer is caused to perform the steps of the privilege violation detection method in any of the above-mentioned embodiments.

[0133] The device embodiments described above are merely illustrative, wherein the units illustrated as separate components can or can not be physically separated, and the components illustrated as units can or can not be physical units, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0134] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software plus a general hardware platform, and of course can also be implemented by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute the methods described in the various embodiments or some parts of the embodiments.

[0135] It is to be understood that the terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. The terms "comprises", "comprising", "includes", "including" and "has" are inclusive and therefore specify the presence of stated features, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or groups thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order

[0136] The above description is merely that of the specific embodiments of the application and as such is not to be taken in a limiting sense. Various modifications and alterations of the embodiments described herein will become apparent to those skilled in the art from the foregoing description, which does not limit the generality presented. It is the intention that all such modifications and alterations be considered equaliy by the spirit and scope of this application. It is therefore intended to cover in the appended claims all such changes and alterations that come within the scope of this application.

Claims

1. An overreach detection method, characterized by, The method comprises: acquiring traffic request data of a client; based on the traffic request data, using bytecode enhancement to perform application program interface asset discovery to obtain application program interface asset data; based on the application program interface asset data, performing out-of-authority detection on the traffic request data to obtain an out-of-authority detection result; wherein the step of based on the traffic request data, using bytecode enhancement to perform application program interface asset discovery to obtain application program interface asset data comprises: for the traffic request data, acquiring source code location information of application program interface initialization completion; based on the source code location information, using an acquisition method of the application program interface to acquire instance information of a request mapping class, the request mapping class being a class responsible for request mapping; using the instance information, calling a method in the request mapping class to perform interface information acquisition to obtain interface information; based on the interface information, performing analysis to obtain the application program interface asset data.

2. The method of claim 1, wherein, The client comprises an application program, and the step of acquiring traffic request data of a client comprises: when the application program is running, intercepting classes of the application program to obtain intercepted data; using the request path information to determine the traffic request data.

3. The method of claim 1, wherein, The step of based on the traffic request data, using bytecode enhancement to perform application program interface asset discovery to obtain application program interface asset data comprises: based on the traffic request data, performing traffic preprocessing to obtain target traffic request data; using bytecode enhancement, performing application program interface asset discovery on the target traffic request data to obtain the application program interface asset data.

4. The method of claim 3, wherein, The step of based on the traffic request data, performing traffic preprocessing to obtain target traffic request data comprises: detecting whether the traffic request data comprises a non-attention traffic item, the non-attention traffic item comprising at least one of static resource access request data, error status code request data, and external attack traffic data; if the traffic request data comprises the non-attention traffic item, removing the non-attention traffic item to obtain to-be-cleaned traffic request data; performing deduplication processing on the to-be-cleaned traffic request data to obtain the target traffic request data.

5. The method of claim 1, wherein, The step of based on the application program interface asset data, performing out-of-authority detection on the traffic request data to obtain an out-of-authority detection result comprises: using the application program interface asset data to determine a request operation resource type, the request operation type being an operation resource type to which the traffic request data belongs; performing vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain the out-of-authority detection result.

6. The method of claim 5, wherein, The request operation resource type is a resource query operation type, and the step of performing vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type to obtain the out-of-authority detection result comprises: The request response information is used for vulnerability scanning to obtain vulnerability scanning information. The request response information is used to generate the privilege violation detection result. The request response information is used for vulnerability scanning to obtain vulnerability scanning information.

7. The method of claim 6, wherein, The request response information is used for vulnerability scanning to obtain vulnerability scanning information. If the request response information does not contain the target data, it is detected whether the data format of the request response information is a preset data exchange format. If the data format of the request response information is the data exchange format, it is detected that a string in the request response information matches a key character, and the vulnerability scanning information is generated according to the detected key character. If the data format of the request response information is not the data exchange format, when the character length of the request response information is greater than a preset length threshold, the request response information and reference response information are used to determine response similarity, and the vulnerability scanning information is generated based on the response similarity, wherein the reference response information is the response information of the constructed request. The request operation resource type is a resource modification operation type, and the privilege violation detection result is obtained by performing vulnerability scanning on the traffic request data according to a preset scanning mode corresponding to the operation resource type.

8. The method of claim 5, wherein, Based on the resource modification operation type corresponding to the preset scanning mode, the database operation calling method contained in the traffic request data is intercepted, and the database operation calling method is a method called by a database operation. The database operation corresponding to the database operation calling method is detected for permission to obtain permission detection information. The device comprises: A traffic request data acquisition module is configured to acquire traffic request data of a client.

9. An overreach detection apparatus, characterized by, An interface asset discovery module is configured to perform application program interface asset discovery on the traffic request data by using bytecode enhancement to obtain application program interface asset data. A privilege violation detection module is configured to perform privilege violation detection on the traffic request data according to the application program interface asset data to obtain a privilege violation detection result. The interface asset discovery module comprises a source code location acquisition submodule, an instance information acquisition submodule, an interface information acquisition submodule, and an interface information analysis submodule. The source code location acquisition submodule is configured to acquire source code location information of an application program interface initialization completion for the traffic request data. The instance information acquisition submodule is configured to acquire instance information of a request mapping class by using an acquisition method of the application program interface based on the source code location information, wherein the request mapping class is a class responsible for request mapping. ​ ​ The interface information acquisition sub-module is configured to acquire interface information by calling a method in the request mapping class using the instance information. The interface information analysis sub-module is configured to analyze the interface information to obtain the application program interface asset data.

10. An electronic device, comprising: The system includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The memory is configured to store a computer program. The processor is configured to execute the program stored in the memory to implement the privilege escalation detection method in any one of claims 1-8.

11. A computer readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the privilege escalation detection method in any one of claims 1-8.

Images