A web attack detection method and apparatus

Abstract

The application provides a Web attack detection method and device, and relates to the technical field of computers.The method comprises the following steps: receiving a Web request sent by a user; extracting a plurality of dimensional request features from the Web request; identifying the encoding mode of each request feature based on encoding detection; decoding the request features based on the encoding mode of the request features to obtain original features corresponding to the request features; determining whether there are original features matching a preset current attack rule, and if not, forwarding the Web request to a source station server, otherwise, extracting an attack payload from the original features matching the current attack rule, and updating the current attack rule based on the attack payload.The application can update the attack rule in a timely manner and improve the security of the source station server.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a Web attack detection method and device. BACKGROUND

[0002] With the rapid development of Internet technology, Web applications have become an integral part of modern society. However, the security problem of Web applications is increasingly prominent, various Web attacks such as SQL injection, cross-site scripting, cross-site request forgery, etc. pose a serious threat to the privacy and data security of users. Therefore, efficient and accurate Web attack detection methods have become an important research topic in the field of network security.

[0003] Traditional Web attack detection methods mainly perform pattern matching based on set attack rules, and the set attack rules are updated by the management party according to a certain period.

[0004] However, new attack types may appear in Web requests, and the set attack rules cannot be detected. The existing method cannot update the attack rules in time, resulting in system attacks. SUMMARY

[0005] The present application provides a Web attack detection method and device, which can update attack rules in time and improve the security of source station servers.

[0006] In a first aspect, the embodiments of the present application provide a Web attack detection method, comprising:

[0007] receiving a Web request sent by a user;

[0008] extracting a plurality of dimensional request features from the Web request;

[0009] identifying the encoding mode of each request feature based on encoding detection;

[0010] decoding the request features based on the encoding mode of the request features to obtain the original features corresponding to the request features;

[0011] determining whether there is an original feature matching a preset current attack rule, if not, forwarding the Web request to a source station server, otherwise, extracting an attack payload from the original feature matching the current attack rule, and updating the current attack rule based on the attack payload.

[0012] In a second aspect, the embodiments of the present application provide a Web attack detection device, comprising:

[0013] a receiving module configured to receive a Web request sent by a user;

[0014] extracting a plurality of dimensions of request features from the Web request;

[0015] a decoding module configured to identify an encoding mode of each of the request features based on the encoding probe, and decode the request features based on the encoding mode of the request features to obtain original features corresponding to the request features;

[0016] a determining module configured to determine whether there is an original feature matching a preset current attack rule, if not, forward the Web request to a source server, otherwise, extract an attack payload from the original feature matching the current attack rule, and update the current attack rule based on the attack payload.

[0017] In a third aspect, an electronic device is provided, including:

[0018] one or more processors;

[0019] a storage device configured to store one or more programs,

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of the above embodiments.

[0021] In a fourth aspect, a computer readable medium is provided, which stores a computer program, and the program is executed by a processor to implement the method according to any one of the above embodiments.

[0022] One embodiment of the above application has the following advantages or beneficial effects: for the request with Web attack, the attack payload is further extracted from the original feature, and when there is a new attack type or the characteristics of the original attack type change, the attack related features will be reflected in the attack payload, therefore, the attack rule is updated through the attack payload, which can make the attack rule detect the new attack type or more accurately identify the original attack type, and further improve the security of the source server.

[0023] The further effects of the above non-conventional optional mode will be described in the following combined with the specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 is a flowchart of a Web attack detection method provided by one embodiment of the application;

[0025] Figure 2 is a flowchart of a Web attack detection method provided by another embodiment of the application;

[0026] Figure 3FIG. 1 is a schematic diagram of a web attack detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] Exemplary embodiments of the present application are described herein with reference to the accompanying drawings, in which various details are set forth to assist in an understanding of the present application. It will be apparent to those skilled in the art that various changes and modifications can be made to the embodiments described herein without departing from the spirit and scope of the present application. Thus, the present application is not intended to be limited to the embodiments described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein. Further, descriptions of well-known functions and constructions are omitted for clarity and conciseness.

[0028] As shown in FIG. 1, the present application provides a web attack detection method, comprising: Figure 1

[0029] Step 101: receiving a web request sent by a user.

[0030] The web request is used to access a source station server, and the web request comprises a request header, a request body, etc.

[0031] Step 102: extracting a plurality of dimensional request features from the web request.

[0032] The dimensions can comprise any one or more of a URL, a request body, a User-Agent, and a cookie.

[0033] Step 103: identifying an encoding mode of each request feature based on an encoding detection.

[0034] The encoding detection is decoding by different decoding modes to determine the encoding mode of the request feature. The encoding mode comprises base64 encoding, Unicode encoding, etc.

[0035] Step 104: decoding the request feature based on the encoding mode of the request feature to obtain an original feature corresponding to the request feature.

[0036] The decoded request feature is the original feature.

[0037] Step 105: determining whether there is an original feature matching a preset current attack rule, if not, executing step 106, otherwise, executing step 107.

[0038] The current attack rule can comprise a rule corresponding to any one or more of an equal match, a containing match, and a regular match model. Taking the regular match as an example, the current attack rule comprises a regular expression. One attack rule is usually used to detect one type of attack, of course, in some scenarios, one type of attack can also be detected by multiple attack rules.

[0039] ​Step 106: forwarding the Web request to the origin server.

[0040] If there is no current attack rule matching the original feature, it is considered that the Web request does not exist Web attack, and can be directly forwarded to the origin server.

[0041] Step 107: extracting an attack load from the original feature matching the current attack rule, and updating the current attack rule based on the attack load.

[0042] In the embodiment of the application, for the request existing Web attack, the attack load is further extracted from the original feature. When there is a new attack type or the characteristics of the original attack type change, the attack-related characteristics will be reflected in the attack load. Therefore, by updating the attack rule through the attack load, the attack rule can be used to detect new attack types or more accurately identify the original attack types, thereby improving the security of the origin server.

[0043] In an embodiment of the application, the attack rule includes: a plurality of target dimensions, a target matching mode;

[0044] Determining whether there is an original feature matching the preset current attack rule includes:

[0045] Combining the original features of the plurality of target dimensions;

[0046] Determining whether the combined original feature matches the target matching mode;

[0047] The target matching mode includes any one of: equal matching, including matching and regular matching.

[0048] The current attack rule can involve multiple target dimensions. At this time, the original features of the multiple target dimensions need to be combined according to the current attack rule. For example, the current attack rule involves two dimensions of URL and request body. The specific contents corresponding to the two dimensions need to be combined, and the combined content needs to be matched with the target matching mode. For different target matching modes, the contents included in the target matching mode are different. For regular matching, the target matching mode includes a regular expression. For equal matching, the target matching mode includes a set threshold.

[0049] Through the embodiment of the application, the original feature can be detected from multiple dimensions and by using different matching modes, the accuracy of Web attack detection is improved, and the security of the origin server is improved.

[0050] In an embodiment of the application, the attack rule includes: a target dimension and a target matching mode;

[0051] extracting an attack payload from the original feature matched with the current attack rule, including:

[0052] determining a position of content in the original feature matched with the current attack rule;

[0053] determining an extraction range based on the target matching mode and the position of the content;

[0054] extracting the attack payload from the original feature based on the extraction range.

[0055] Considering that there may be other types of attacks near the current attack, therefore, the embodiment of the application determines the extraction range by the position of the content matched with the current attack rule, and for different target matching modes, the extraction range can be adaptively adjusted, so as to reduce the amount of calculation while ensuring the accuracy of Web attack detection.

[0056] In an embodiment of the application, updating the current attack rule based on the attack payload includes:

[0057] determining a type of the attack payload; the type of the attack payload includes any one or more of malicious code, session token and sensitive data;

[0058] updating the current attack rule based on the type of the attack payload.

[0059] For example, the current attack rule is only for malicious code, and there is no attack rule for sensitive data, if the attack payload contains sensitive data, an attack rule for sensitive data needs to be added. The added attack rule can be obtained from a pre-established rule library.

[0060] In actual application scenarios, the added attack rule can also come from the management party, at this time, updating the current attack rule based on the attack payload includes: sending the attack payload to the management party to enable the management party to analyze the attack payload and update the current attack rule.

[0061] Through the embodiment of the application, the current attack rule can be updated in a timely manner based on the attack payload, so that the current attack rule is applicable to new Web attacks, and the accuracy of Web attack detection is improved.

[0062] In an embodiment of the application, in the case that there is an original feature matched with the preset current attack rule, the method further includes:

[0063] determining whether there is a target attack rule matched with the attack payload in the preset plurality of other attack rules, if there is, determining that the attack type corresponding to the target attack rule and the attack type corresponding to the current attack rule are both the current attack type, otherwise, determining that the attack type corresponding to the current attack rule is the current attack type;

[0064] updating the current attack rule based on the type of the attack payload, including:

[0065] updating the attack rule based on the type of the attack payload and the current attack type;

[0066] The attack type corresponding to the target attack rule is different from the attack types corresponding to other attack rules.

[0067] In view of the fact that there can be various web attacks in the web request, in order to identify other types of web attacks, other attack rules can also be used to detect the web request on the basis of the current attack rule. Through the embodiment of the application, web attacks can be more comprehensively identified, and the security of the source station server is improved.

[0068] In an embodiment of the application, determining whether there is a target attack rule matching the attack payload in the preset plurality of other attack rules includes:

[0069] selecting an attack rule corresponding to the type of the attack payload from the preset plurality of other attack rules;

[0070] determining whether there is a target attack rule matching the attack payload in the attack rule corresponding to the type of the attack payload.

[0071] The preset attack rules can correspond to the types of attack payloads, for example, attack rules 1, 2 and 3 correspond to type A, and attack rules 4 and 5 correspond to type B. In the case where the type of the attack payload is determined, the target attack rule matching the attack payload can be determined only in the attack rules corresponding to the type of the attack payload. Through the embodiment of the application, the number of attack rules matched with the attack payload can be reduced, the calculation amount is reduced, and the detection efficiency is improved.

[0072] In an embodiment of the application, the method further includes: encoding the attack payload;

[0073] providing the current attack type and the attack payload to an external management party, including:

[0074] providing the current attack type and the encoded attack payload to the management party for storage.

[0075] In view of the fact that the attack payload can be some special characters and cannot be directly stored, therefore, the embodiment of the application encodes the attack payload and then provides it to the management party for storage. For example, the attack payload is base64 encoded. The management party can analyze the attack payload based on the current attack type to determine whether there is other attack type in the attack payload, and if so, update the current attack rule.

[0076] For example, Figure 2As shown, this embodiment of the invention provides a web attack detection method, including:

[0077] Step 201: Receive the web request sent by the user.

[0078] Step 202: Extract request features from multiple dimensions of the web request.

[0079] Step 203: Identify the encoding method of each request feature based on encoding detection.

[0080] Step 204: Decode the request features based on the encoding method of the request features to obtain the original features corresponding to the request features.

[0081] Step 205: Determine if there is an original feature that matches the preset current attack rule. If not, proceed to step 206; otherwise, proceed to step 207.

[0082] Step 206: Forward the web request to the origin server.

[0083] Step 207: Determine the location of the content in the original features that matches the current attack rule.

[0084] Step 208: Determine the extraction range based on the target matching pattern and the location of the content.

[0085] Step 209: Extract the attack payload from the original features based on the extraction range and determine the type of attack payload.

[0086] Step 210: Update the current attack rules based on the type of attack payload.

[0087] This invention identifies potential attacks in requests from different dimensions, combines code detection to identify bypass attempts by forged attacks in requests, and analyzes the extracted attack payload to further understand potential vulnerabilities in the current request, update attack rules, and improve protection capabilities.

[0088] like Figure 3 As shown, this embodiment of the invention provides a web attack detection device, including:

[0089] The receiving module 301 is configured to receive web requests sent by users;

[0090] Extraction module 302 is configured to extract request features from multiple dimensions of web requests;

[0091] The decoding module 303 is configured to identify each request feature based on the encoding detection method; it decodes the request features based on the encoding method of the request features to obtain the original features corresponding to the request features;

[0092] The determining module 304 is configured to determine whether there is original feature matching the preset current attack rule, if not, forward the web request to the source station server, otherwise, extract the attack payload from the original feature matching the current attack rule, and update the current attack rule based on the attack payload.

[0093] In an embodiment of the present application, the attack rule includes: a plurality of target dimensions, a target matching mode.

[0094] The determining module 304 is configured to combine the original features of the plurality of target dimensions, and determine whether the combined original features match the target matching mode, wherein the target matching mode includes any one of: equal matching, including matching, and regular matching.

[0095] In an embodiment of the present application, the attack rule includes: a target dimension and a target matching mode.

[0096] Determine the position of the content in the original feature matching the current attack rule, determine the extraction range based on the target matching mode and the position of the content, and extract the attack payload from the original feature based on the extraction range.

[0097] In an embodiment of the present application, the determining module 304 is configured to determine the type of the attack payload, wherein the type of the attack payload includes any one or more of: malicious code, session token, and sensitive data, and update the current attack rule based on the type of the attack payload.

[0098] In an embodiment of the present application, the determining module 304 is configured to determine whether there is a target attack rule matching the attack payload in the preset plurality of other attack rules, if yes, determine that the attack type corresponding to the target attack rule and the attack type corresponding to the current attack rule are the current attack type, otherwise, determine that the attack type corresponding to the current attack rule is the current attack type.

[0099] The determining module 304 is configured to update the attack rule based on the type of the attack payload and the current attack type, wherein the attack type corresponding to the target attack rule is different from the attack type corresponding to the other attack rules.

[0100] In an embodiment of the present application, the determining module 304 is configured to select an attack rule corresponding to the type of the attack payload from the preset plurality of other attack rules, and determine whether there is a target attack rule matching the attack payload in the attack rule corresponding to the type of the attack payload.

[0101] In an embodiment of the present application, the determining module 304 is configured to encode the attack payload, and provide the current attack type and the encoded attack payload to the management party for saving.

[0102] The computer readable medium according to an embodiment of the present application stores computer instructions, and the computer instructions, when executed by a processor, cause the processor to perform the method according to the first aspect.

[0103] Specifically, a system or an apparatus equipped with a storage medium storing software program codes implementing the functions of any of the above embodiments can be provided, and a computer (or CPU or MPU) of the system or the apparatus reads out and executes the program codes stored in the storage medium.

[0104] In this case, the program codes read out from the storage medium can implement the functions of any of the above embodiments by themselves, and therefore the program codes and the storage medium storing the program codes constitute a part of the present application.

[0105] Embodiments of the storage medium for providing the program codes include a floppy disk, a hard disk, a magneto-optical disk (e.g., CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program codes can be downloaded from a server computer via a communication network.

[0106] Further, it should be understood that not only the program codes read out by the computer, but also an operating system or the like operating on the computer can perform part or all of the actual operations based on the instructions of the program codes, thereby implementing the functions of any of the above embodiments.

[0107] Further, it should be understood that the program codes read out from the storage medium can be written into a memory provided in an extension board inserted into the computer or a memory provided in an extension module connected to the computer, and then part or all of the actual operations can be performed based on the instructions of the program codes by a CPU or the like mounted on the extension board or the extension module, thereby implementing the functions of any of the above embodiments.

[0108] It should be understood that the explanation of the contents, the detailed description, the advantageous effects, the examples, and the like of the computer readable medium according to an embodiment of the present application can refer to the corresponding parts of the method according to the first aspect, and thus the detailed description will not be repeated here.

[0109] One embodiment of the present specification provides a computing device including a memory and a processor, the memory storing executable codes, and the processor executing the executable codes to implement the method according to any one of the embodiments of the present specification.

[0110] It can be understood that the explanation, implementation, advantages, examples and the like of the content related to the computing device provided by the embodiments of the present application can refer to the corresponding part of the method, and will not be repeated here.

[0111] Each of the embodiments in the specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the device embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the part of the method embodiments.

[0112] Those skilled in the art should be aware that, in one or more examples described above, the functions described by the present application can be implemented in hardware, software, plug-in or any combination thereof. When implemented by using software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0113] The above specific embodiments further explain the purpose, technical solutions and advantages of the present application. It should be understood that the above description is only a specific embodiment of the present application, and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement and the like made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method of web attack detection, the method comprising: The method comprises: receiving a web request sent by a user; extracting a plurality of dimensional request features from the web request; identifying an encoding mode of each of the request features based on an encoding probe; decoding the request features based on the encoding mode of the request features to obtain original features corresponding to the request features; determining whether there is an original feature matching a preset current attack rule, if not, forwarding the web request to a source server, otherwise, extracting an attack payload from the original feature matching the current attack rule, and updating the current attack rule based on the attack payload; updating the current attack rule based on the attack payload, comprising: determining the type of the attack payload; the type of the attack payload includes any one or more of malicious code, session token and sensitive data; updating the current attack rule based on the type of the attack payload; in the case where there is an original feature matching a preset current attack rule, the method further comprises: determining whether there is a target attack rule matching the attack payload in a plurality of preset other attack rules, if so, determining that the attack type corresponding to the target attack rule and the attack type corresponding to the current attack rule are both a current attack type, otherwise, determining that the attack type corresponding to the current attack rule is the current attack type; updating the current attack rule based on the type of the attack payload, comprising: updating the attack rule based on the type of the attack payload and the current attack type; wherein the attack type corresponding to the target attack rule is different from the attack type corresponding to the other attack rules.

2. The method of claim 1, wherein: the attack rule includes a plurality of target dimensions and a target matching mode; determining whether there is an original feature matching a preset current attack rule, comprising: combining the original features of the plurality of target dimensions; determining whether the combined original features match the target matching mode; the target matching mode includes any one of equal matching, including matching and regular matching.

3. The method of claim 1, wherein: the attack rule includes a target dimension and a target matching mode; extracting an attack payload from the original feature matching the current attack rule, comprising: determining the position of the content matching the current attack rule in the original feature; determining an extraction range based on the target matching mode and the position of the content; extracting the attack payload from the original feature based on the extraction range.

4. The method of claim 3, wherein: determining whether there is a target attack rule matching the attack payload in a plurality of preset other attack rules, comprising: selecting an attack rule corresponding to the type of the attack payload from the plurality of preset other attack rules; determining whether there is a target attack rule matching the attack payload in the attack rule corresponding to the type of the attack payload.

5. The method of claim 4, wherein, further comprising: encoding the attack payload; providing the current attack type and the attack payload to an external manager, comprising: The current attack type and encoded attack payload are provided to the authority for storage. The current attack type and encoded attack payload are provided to the authority for storage.

Images