Interface traffic security detection method, device, equipment, medium and program product

Abstract

The present disclosure provides an interface traffic security detection method, device, equipment, medium and program product. The method includes: obtaining multiple first traffic data whose destination addresses belong to the same domain name; obtaining a set of interface access behavior sequences in the multiple first traffic data, the interface access behavior sequence set includes at least two interface access behavior sequences, and the interface access behavior sequence includes at least two interface access requests obtained from the multiple first traffic data; deduplication and aggregation processing of the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence; and security detection of the second traffic data based on the target interface access behavior sequence. The present disclosure can obtain the target interface access behavior sequence caused by automated attacks, and use the target interface access behavior sequence to perform security detection on the interface access request, thereby improving the capabilities of network security products such as Web application firewalls.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an interface traffic security detection method, device, equipment, medium and program product. Background Art

[0002] With the development of information technology, network security is becoming more and more important. Some people use automated tools to attack and deceive user networks and programs, causing losses to users.

[0003] At present, the use of automated scripts to carry out attacks is becoming more and more covert. Existing security protection products find it difficult to identify automated script attack behaviors and can only rely on manual work, which creates a huge workload and difficulty for users. Summary of the invention

[0004] In view of this, the purpose of the present disclosure is to provide an interface traffic security detection method, device, equipment, medium and program product.

[0005] Based on the above purpose, the first aspect of the present disclosure provides an interface traffic security detection method, including:

[0006] Acquire multiple first flow data whose destination addresses belong to the same domain name;

[0007] Acquire an interface access behavior sequence set in the plurality of first traffic data, the interface access behavior sequence set comprising at least two interface access behavior sequences, the interface access behavior sequence comprising at least two interface access requests acquired from the plurality of first traffic data;

[0008] Deduplication and aggregation processing are performed on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence;

[0009] A security check is performed on the second traffic data based on the target interface access behavior sequence.

[0010] In some embodiments, the obtaining of a set of interface access behavior sequences in the plurality of first traffic data includes:

[0011] The interface access behavior sequence set is obtained from the access logs corresponding to the plurality of first traffic data.

[0012] In some embodiments, the obtaining of a set of interface access behavior sequences in the plurality of first traffic data includes:

[0013] Based on user access information, acquiring a first interface access behavior sequence corresponding to the user access information, wherein the user access information includes at least one of an Internet Protocol address and a user agent;

[0014] Processing the first interface access behavior sequence to obtain a second interface access behavior sequence belonging to a different session;

[0015] Dividing the second interface access behavior sequence to obtain a third interface access behavior sequence;

[0016] The interface access behavior sequence set is determined based on the third interface access behavior sequence, the user access information, and the session identifier of the session, wherein the interface access behavior sequence in the interface access behavior sequence set includes the third interface access behavior sequence, the user access information, and the session identifier.

[0017] In some embodiments, the deduplication processing of the interface access behavior sequences in the interface access behavior sequence set includes:

[0018] Deleting the interface access behavior sequence having the same third interface access behavior sequence, the user access information, and the session identifier from the interface access behavior sequence set;

[0019] The interface access behavior sequences in the interface access behavior sequence set that are identical to the third interface access behavior sequence or have a similarity greater than a first preset threshold are deleted.

[0020] In some embodiments, the aggregating the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence includes:

[0021] Performing clustering processing on the third interface access behavior sequence based on sequence characteristics to generate multiple clusters;

[0022] Obtain a preset number of clusters with the largest number of elements in the clusters, and obtain a fourth interface access behavior sequence corresponding to the cluster center;

[0023] The target interface access behavior sequence is determined based on the fourth interface access behavior sequence.

[0024] In some embodiments, the performing security detection on the second traffic data based on the target interface access behavior sequence includes:

[0025] Obtaining at least one of the number of node branches, corresponding user access information, and a corresponding session of the target interface access behavior sequence;

[0026] Calculate the confidence based on the number of node branches of the target interface access behavior sequence, the corresponding user access information, and at least one of the sessions to which it belongs;

[0027] In response to the confidence being greater than a second preset threshold, a security check is performed on the interface access behavior request based on the target interface access behavior sequence.

[0028] In some embodiments, the calculating of the confidence based on at least one of the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session includes at least one of the following:

[0029] If the number of node branches of the target interface access behavior sequence decreases, increasing the value of the confidence;

[0030] If the user access information corresponding to the target interface access behavior sequence increases, then the confidence value is increased;

[0031] If the number or proportion of Internet Protocol addresses corresponding to the target interface access behavior sequence greater than a first preset proportion is less than a preset value, increasing the value of the confidence level;

[0032] If the number of sessions to which the target interface access behavior sequence belongs increases, the value of the confidence level is increased.

[0033] In some embodiments, the method further comprises:

[0034] In response to the target interface access behavior sequence satisfying a preset condition, modifying the identification state of the target interface access behavior sequence and updating the confidence level;

[0035] The preset condition includes at least one of the following:

[0036] Acquiring the same target interface access behavior sequence within multiple cycles of a preset time length;

[0037] A difference in a change in a detection result of a security detection performed on the second traffic data based on the target interface access behavior sequence is within a third preset threshold.

[0038] In some embodiments, the performing security detection on the second traffic data based on the target interface access behavior sequence includes:

[0039] Setting a protection strategy based on the target interface access behavior sequence, and performing security detection on the second traffic data based on the protection strategy;

[0040] The protection strategies include:

[0041] In response to the second traffic data including the target interface access behavior sequence, determining the protection status as passed or detected.

[0042] In some embodiments, the second traffic data includes the target interface access behavior sequence, and determining the protection state includes at least one of the following:

[0043] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data and an interval between each interface access request is less than or equal to a third preset threshold, it is determined that the protection status is passed;

[0044] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data, an interval time of some interface access requests is less than or equal to a third preset threshold and an interval time of some interface access requests is greater than the third preset threshold, it is determined that the protection state is detected;

[0045] If there is a sequence of interface access requests in the second traffic data whose similarity with the target interface access behavior sequence is greater than a fourth preset threshold, it is determined that the protection state is detected.

[0046] In some embodiments, the performing security detection on the second traffic data based on the protection strategy includes:

[0047] In response to at least one of the number of passes when the protection status is passed, the number of detections when the protection status is detected, the pass rate when the protection status is passed, and the detection rate when the protection status is detected being greater than a third preset threshold within a preset time period, the corresponding interface access request in the second traffic data is marked or intercepted.

[0048] A second aspect of the present disclosure provides an interface traffic security detection device, comprising:

[0049] The first acquisition module is configured to: acquire a plurality of first flow data whose destination addresses belong to the same domain name;

[0050] A second acquisition module is configured to: acquire an interface access behavior sequence set from the plurality of first traffic data, the interface access behavior sequence set comprising at least two interface access behavior sequences, the interface access behavior sequence comprising at least two interface access requests acquired from the plurality of first traffic data;

[0051] An aggregation module is configured to: perform deduplication and aggregation processing on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence;

[0052] The detection module is configured to: perform security detection on the second flow data based on the target interface access behavior sequence.

[0053] A third aspect of the present disclosure provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0054] A fourth aspect of the present disclosure provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions are used to cause the computer to execute the method described in the first aspect.

[0055] A fifth aspect of the present disclosure provides a computer program product, comprising computer program instructions, which, when executed on a computer, cause the computer to execute the method as described in the first aspect.

[0056] From the above, it can be seen that the interface traffic security detection method, device, equipment, medium and program product provided by the present invention obtain traffic data under the same domain name, and obtain a set of interface access behavior sequences in the traffic data, and obtain the target interface access behavior sequence caused by the automated attack by deduplicating and aggregating the interface access behavior sequences in the interface access behavior sequence set, and then use the target interface access behavior sequence to perform security detection on the interface access request, thereby determining the automated attack behavior in the interface access request, so as to further select or push security protection strategies for users, block automated attack behaviors, and protect the security of applications, websites and other systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 A flowchart of an exemplary method provided by an embodiment of the present disclosure is shown.

[0059] Figure 2 A schematic diagram of an exemplary process according to an embodiment of the present disclosure is shown.

[0060] Figure 3 A flowchart of an exemplary method provided by an embodiment of the present disclosure is shown.

[0061] Figure 4 A schematic diagram of an exemplary device provided by an embodiment of the present disclosure is shown.

[0062] Figure 5A schematic diagram of the hardware structure of an exemplary computer device provided in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0063] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0064] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0065] It is understandable that before using the technical solutions of each embodiment of the present disclosure, the type, scope of use, usage scenarios, etc. of the personal information involved will be informed to the user in an appropriate manner, and the user's authorization will be obtained.

[0066] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly remind the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can independently choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0067] As an optional but non-limiting implementation, in response to receiving the user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0068] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0069] As described in the background technology, automated tools were originally used to replace user operations to perform some simple and repetitive tasks to improve production efficiency. However, gradually, some people use automated tools to conduct malicious attacks or deceptions, such as: quickly swiping orders to grab tickets and then reselling them, maliciously registering accounts in batches to receive event rewards, swiping traffic to rush to hot searches, or exhaustively enumerating other people's accounts and passwords, etc. These behaviors have caused great losses to users.

[0070] In related technologies, the identification and detection of automated attack tools mainly include human-machine verification, feature recognition, browser verification and other methods. However, these technical solutions are designed based on the difference between human access and machine access.

[0071] However, with the increasing degree of automation and high integration, there are more and more automated attacks, and it is becoming increasingly difficult to identify and distinguish the attack behaviors of automated attack tools.

[0072] In view of this, an embodiment of the present disclosure provides an interface traffic security detection method to solve the above-mentioned problem.

[0073] like Figure 1 As shown, the interface traffic security detection method includes:

[0074] Step S101, obtaining a plurality of first flow data whose destination addresses belong to the same domain name.

[0075] In this embodiment, when analyzing automated attack behaviors, automated attack behaviors targeting the same application, website, etc. are considered, and automated attack behaviors targeting different applications, websites, etc. are not analyzed simultaneously. Therefore, traffic data can be obtained by classification based on domain names, and multiple first traffic data with destination addresses belonging to the same domain name, that is, traffic data with destination addresses belonging to the same domain name, are obtained, and automated attack behaviors in the traffic data belonging to the same domain name are analyzed.

[0076] Among them, the domain name (English: Domain Name), also known as the network domain, is the name of a computer or a group of computers on the Internet composed of a string of names separated by dots, and is used to locate the computer during data transmission (sometimes also refers to the geographical location).

[0077] Step S103: Obtain a set of interface access behavior sequences from the multiple first traffic data, wherein the set of interface access behavior sequences includes at least two interface access behavior sequences, and the interface access behavior sequence includes at least two interface access requests obtained from the multiple first traffic data.

[0078] In this embodiment, the traffic data may include interface access traffic data, where the interface access traffic data is traffic data accessed through an application programming interface (Application Programming Interface, API).

[0079] In this embodiment, by identifying and extracting the traffic data, multiple interface access behavior sequences can be obtained, and then an interface access behavior sequence set can be obtained based on the multiple interface access behavior sequences. The interface access behavior sequence may include at least two nodes, each node corresponds to an interface access request, that is, each interface access behavior sequence may include at least two interface access requests.

[0080] The interface access requests of the interface access behavior sequence may form a continuous sequence without branches, or may form a sequence including one or more branches, which is not limited in this embodiment.

[0081] Step S105 , performing deduplication and aggregation processing on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence.

[0082] In this embodiment, different interface access behavior sequences may include the same or different nodes and the front-to-back dependencies between nodes, that is, the same or different interface access requests and the front-to-back dependencies between each interface access request. In this embodiment, the interface access behavior sequences in the interface access behavior sequence set are deduplicated and repeated sequences are merged; the interface access behavior sequences in the interface access behavior sequence set are aggregated to remove noise or error sequences, and the range of interface access behavior sequences is reduced, thereby screening out more important interface access behavior sequences, and then discovering interface access abuse and traffic information of frequent swiping of interface information, and mining or confirming interface access behavior sequences caused by automated attacks as target interface access behavior sequences.

[0083] Step S107: Perform security detection on the second traffic data based on the target interface access behavior sequence.

[0084] In this embodiment, after obtaining the target interface access behavior sequence caused by the automated attack, the target interface access behavior sequence can be used to perform security checks on the interface access request, thereby determining the automated attack behavior in the interface access request, so as to further select or push security protection strategies for the user, block the automated attack behavior, and protect the security of applications, websites and other systems.

[0085] In this embodiment, traffic data under the same domain name can be obtained, and a set of interface access behavior sequences in the traffic data can be obtained. The target interface access behavior sequence caused by the automated attack is obtained by deduplicating and aggregating the interface access behavior sequences in the interface access behavior sequence set. The target interface access behavior sequence is then used to perform security detection on the interface access request, thereby determining the automated attack behavior in the interface access request, so as to further select or push security protection strategies for users, block automated attack behaviors, and protect the security of applications, websites and other systems.

[0086] In some embodiments, the step S103 of obtaining the interface access behavior sequence set in the plurality of first traffic data includes: obtaining the interface access behavior sequence set from an access log corresponding to the plurality of first traffic data.

[0087] In this embodiment, the access status of the interface access traffic data is recorded in the access log of the Web application protection system (also known as: website application-level intrusion prevention system, WebApplication Firewall, WAF). Through the access log, each interface access request and the front-end dependency relationship between each interface access request can be obtained, and then each interface access behavior sequence can be determined based on each interface access request and the front-end dependency relationship between each interface access request, and an interface access behavior sequence set can be generated.

[0088] Through the above embodiments, the present disclosure can obtain data from the access log of the Web application protection system, and thus perform security detection based on the data, which can improve the capabilities of network security products such as Web application firewalls, and can effectively improve the capabilities of network security products, better defend against automated attacks, and protect the security of target interfaces.

[0089] In some embodiments, the step of obtaining a set of interface access behavior sequences in the plurality of first traffic data in step S103 includes:

[0090] Step S201: based on user access information, obtaining a first interface access behavior sequence corresponding to the user access information, wherein the user access information includes at least one of an Internet Protocol address and a user agent.

[0091] In this embodiment, the possible behavior sequences in the traffic data can be mined from the access log. For the same domain name, the user access information tuple (Client IP, User Agent) consisting of the user's Internet Protocol address (Client IP) and the user agent (User Agent) is used as the user unit to identify the original behavior sequence in the access log, that is, the first interface access behavior sequence, such as Figure 2 shown.

[0092] The first interface access behavior sequence obtained based on the user access information will have a label of the user access information, that is, a label of the user access information tuple (Client IP, User Agent).

[0093] Step S203: Process the first interface access behavior sequence to obtain a second interface access behavior sequence belonging to a different session.

[0094] In this embodiment, each first interface access behavior sequence is identified based on the session, so as to identify the interface access behavior sequences belonging to different sessions and obtain the second interface access behavior sequence.

[0095] A session refers to a group of interactions between a user and the source site within a certain period of time. A session contains multiple interface access behavior sequences.

[0096] In this embodiment, the second interface access behavior sequences belonging to different sessions may be determined based on the session identifier (Session ID).

[0097] like Figure 2 As shown, different interface access behavior sequences belonging to session A and session B can be distinguished based on the session identifier.

[0098] In some embodiments, a session window can be used to identify a session in a streaming WAF access log, and information such as the start time of the session window can be used as a session identifier of the session. Different session windows can be identified based on time intervals. For example, if the interval between the current and the next two interface access requests is greater than a first preset value (e.g., 2 minutes), the next interface access request is used as the start of a new session.

[0099] After the session identification process, each obtained second interface access behavior sequence will have a label of the session identifier, that is, a label with a triplet (Client IP, User Agent, Session ID).

[0100] Step S205: divide the second interface access behavior sequence to obtain a third interface access behavior sequence.

[0101] In this embodiment, the interface access behavior sequence is divided in a single session using a triplet (Client IP, User Agent, Session ID) as a unit.

[0102] In some embodiments, the second interface access behavior sequence in the same user session is divided into sequences using a session window, the sequences are sorted by timestamp, and the maximum depth of the sequences is set. Different session windows can be identified based on time intervals, for example, if the interval between the current and the next two interface access requests is greater than a second preset value (the second preset value is usually less than the first preset value, for example, it can be 10s), then the next interface access request is used as the beginning of a new interface access behavior sequence, thereby completing the division of the interface access behavior sequence in a single session and obtaining each third interface access behavior sequence.

[0103] like Figure 2 As shown, for the second interface access behavior sequence in session A, the interface access behavior sequence is divided based on the interval time with the threshold being the second preset value, and three third interface access behavior sequences, sequence 1, sequence 2 and sequence 3, are obtained.

[0104] Step S207, determining the interface access behavior sequence set based on the third interface access behavior sequence, the user access information, and the session identifier of the session, wherein the interface access behavior sequence in the interface access behavior sequence set includes the third interface access behavior sequence, the user access information, and the session identifier.

[0105] In this embodiment, after the division is completed, each interface access behavior sequence in the interface access behavior sequence set is obtained. Each interface access behavior sequence includes the third interface access behavior sequence and the corresponding triplet (Client IP, User Agent, Session ID) information.

[0106] In some embodiments, since there are too many interface access behavior sequences in the interface access behavior sequence set, there are obvious negative impacts on subsequent processing and the generated target interface access behavior sequence; at the same time, the original behavior sequence divided based on the session window may have problems of incorrect division and some discrete points in the sequence, and the data quality needs to be improved. Therefore, it is necessary to deduplicate and aggregate the interface access behavior sequences in the interface access behavior sequence set to reduce the range of the original behavior sequence.

[0107] In some embodiments, Figure 3 As shown, before performing deduplication and aggregation processing on the interface access behavior sequences in the interface access behavior sequence set, it is necessary to first delete the interface access behavior sequences with a length less than 2, that is, delete the discrete points that do not constitute a sequence.

[0108] Afterwards, if Figure 3As shown, the interface access behavior sequence with abnormal interface access requests is deleted, such as the interface access behavior sequence to which the interface access request with a status other than "" or "200" belongs, so as to retain the normally executed interface access behavior sequence, so as to facilitate the subsequent generation of a higher quality target interface access behavior sequence and reduce the impact of noise or attacks.

[0109] In some embodiments, the step S105 of performing deduplication processing on the interface access behavior sequences in the interface access behavior sequence set includes:

[0110] Step S301: Delete the interface access behavior sequence having the same third interface access behavior sequence, the user access information, and the session identifier in the interface access behavior sequence set.

[0111] In this embodiment, for each interface access behavior sequence in the interface access behavior sequence set, if there are at least two interface access behavior sequences whose third interface access behavior sequence and triplet (Client IP, User Agent, Session ID) information are the same, then these at least two interface access behavior sequences are exactly the same repeated sequences, and the repeated interface access behavior sequences can be deleted and only one of them can be retained.

[0112] Step S303: Delete the interface access behavior sequence in the interface access behavior sequence set that is identical to the third interface access behavior sequence or has a similarity greater than a first preset threshold.

[0113] In this embodiment, for other interface access behavior sequences in the interface access behavior sequence set, it is not considered whether the triplet (Client IP, User Agent, Session ID) information is exactly the same, and only whether the sequence characteristics of the third interface access behavior sequence in each interface access behavior sequence are the same or similar is considered. For at least two interface access behavior sequences in the interface access behavior sequence set, if the sequence characteristics of the third interface access behavior sequence are exactly the same, or the sequence characteristics of the third interface access behavior sequence are similar (for example, the similarity is greater than the first preset threshold), then it can be determined that the at least two interface access behavior sequences are the same or similar sequences, and the same or similar interface access behavior sequences can be deleted and only one of them can be retained, thereby effectively reducing the storage overhead of each sequence under the premise of losing limited information.

[0114] In this embodiment, a rolling window can be used to count the interface access behavior sequences under each domain name, so as to remove repeated, identical or similar interface access behavior sequences. After window aggregation, the storage overhead of each sequence can be effectively reduced under the premise of losing limited information.

[0115] In some embodiments, the step S105 of aggregating the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence includes:

[0116] Step S401: clustering the third interface access behavior sequence based on sequence features to generate multiple clusters.

[0117] In this embodiment, similar interface access behavior sequences can be aggregated through a clustering algorithm, and more important interface access behavior sequences can be screened. Since important sequences do not necessarily have only large capacity features, and the set of interface access behavior sequences may be very large, it is necessary to identify important sequences rather than just displaying frequent sequences.

[0118] In this embodiment, a single uniform resource locator path (URL path) of an interface access request can be encoded through a pre-trained language model, and then additional pooling is used to aggregate the encodings of all paths in the interface access behavior sequence to generate an embedding of the sequence; an agglomerative clustering algorithm is used for clustering processing to form multiple clusters.

[0119] Step S403: obtaining a preset number of clusters with the largest number of elements in the clusters, and obtaining a fourth interface access behavior sequence corresponding to the cluster center.

[0120] Afterwards, the multiple clusters generated by the clustering algorithm are sorted according to the number of elements in the clusters, a preset number of clusters with the largest number of elements in the clusters are selected, and the fourth interface access behavior sequence corresponding to the cluster center is obtained.

[0121] In this embodiment, based on the sequence corresponding to the cluster center, the fourth interface access behavior sequence corresponding to the cluster center may be determined by weighted summing of sequence features within the cluster through cosine similarity.

[0122] Step S405: determining the target interface access behavior sequence based on the fourth interface access behavior sequence.

[0123] In this embodiment, the fourth interface access behavior sequence corresponding to the cluster center may be used as the target interface access behavior sequence, so as to perform security detection using the target interface access behavior sequence.

[0124] In this embodiment, the interface access behavior sequences in the interface access behavior sequence set are aggregated through a clustering algorithm, which can alleviate infrequent attack traffic, alleviate the noise or false alarms generated by the interface access behavior sequences, aggregate approximate interface access behavior sequences, abstract representative interface access behavior sequences, and assign behavioral semantics. In addition to the frequency factor, the interface access behavior sequence selection process provides semantic guidance for the sequence.

[0125] In some embodiments, the step S107 of performing security detection on the second traffic data based on the target interface access behavior sequence includes:

[0126] Step S501: obtaining at least one of the number of node branches, corresponding user access information, and a corresponding session of the target interface access behavior sequence.

[0127] In this embodiment, after obtaining the target interface access behavior sequence, the node arrangement structure corresponding to each interface access request in the target interface access behavior sequence can be determined, and then the node branch corresponding to each interface access request can be obtained. At the same time, based on the triplet (Client IP) information corresponding to each target interface access behavior sequence, the corresponding Internet Protocol address (Client IP), user agent (User Agent) and session identifier (Session ID) can be obtained.

[0128] Step S503: Calculate the confidence based on at least one of the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session.

[0129] In this embodiment, a weighted calculation may be performed based on the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session, so as to obtain the confidence level.

[0130] In some embodiments, the calculating of the confidence based on at least one of the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session includes at least one of the following:

[0131] If the number of node branches of the target interface access behavior sequence decreases, the value of the confidence is increased; that is, in this embodiment, the smaller the number of node branches of the target interface access behavior sequence, the higher the value of the confidence will be.

[0132] If the user access information corresponding to the target interface access behavior sequence increases, the confidence value is increased; that is, in this embodiment, if more users (ie, Client IP+UserAgent) access the same target interface access behavior sequence, the confidence value will be higher.

[0133] If the number or proportion of Internet Protocol addresses corresponding to the target interface access behavior sequence that is greater than the first preset ratio is less than a preset value, the confidence value is increased; that is, in this embodiment, if the same target interface access behavior sequence is accessed only by the Internet Protocol addresses (Client IP) of a few specific users, the confidence value will be higher.

[0134] If the number of sessions to which the target interface access behavior sequence belongs increases, the confidence value is increased; that is, in this embodiment, if the same target interface access behavior sequence is distributed in more user sessions, the confidence value will be higher.

[0135] Step S505: in response to the confidence being greater than a second preset threshold, performing a security check on the interface access behavior request based on the target interface access behavior sequence.

[0136] In this embodiment, when the confidence level is high, the target interface access behavior sequence may be used to perform security detection on the interface access behavior request.

[0137] In some embodiments, the method further includes: in response to the target interface access behavior sequence satisfying a preset condition, modifying the identification status of the target interface access behavior sequence and updating the confidence level; wherein the preset condition includes at least one of the following: obtaining the same target interface access behavior sequence within multiple cycles of a preset time length; the difference in the change in the detection result of the security detection of the second traffic data based on the target interface access behavior sequence is within a third preset threshold.

[0138] In this embodiment, obtaining the target interface access behavior sequence based on the traffic data through steps S101-S103 is regarded as a cycle, and the target interface access behavior sequence obtained for the first time in the first cycle can be marked as a "discovering" state.

[0139] When the same target interface access behavior sequence is obtained based on traffic data in multiple cycles within a preset time range, the status of the target interface access behavior sequence can be modified to "discovered"; and / or, when the target interface access behavior sequence is used to perform security detection on the interface access request, the detection result, such as the difference in the interception rate change, is within a third preset threshold, the status of the target interface access behavior sequence can be modified to "discovered".

[0140] In some embodiments, different protection strategies may be set based on different states of the target interface access behavior sequence, so as to perform security detection on the interface access request based on different protection strategies, which is not limited in this embodiment.

[0141] In some embodiments, the security check on the second traffic data based on the target interface access behavior sequence in step S107 includes: setting a protection strategy based on the target interface access behavior sequence, and performing a security check on the second traffic data based on the protection strategy.

[0142] In this embodiment, a preset number of protection strategies can be set based on the target interface access behavior sequence and displayed on the console to use the protection strategy to perform security detection and protection on the interface access request. Among them, an interface access behavior map can be drawn based on the association relationship between each node in the target interface access behavior sequence.

[0143] In some embodiments, the protection strategy includes:

[0144] In response to the second traffic data including the target interface access behavior sequence, determining the protection status as passed or detected.

[0145] In some embodiments, the second traffic data includes the target interface access behavior sequence, and determining the protection state includes at least one of the following:

[0146] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data and an interval between each interface access request is less than or equal to a third preset threshold, it is determined that the protection status is passed;

[0147] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data, an interval time of some interface access requests is less than or equal to a third preset threshold and an interval time of some interface access requests is greater than the third preset threshold, it is determined that the protection state is detected;

[0148] If there is a sequence of interface access requests in the second traffic data whose similarity with the target interface access behavior sequence is greater than a fourth preset threshold, it is determined that the protection state is detected.

[0149] In some embodiments, the protection strategy may also include detection of the number of passes, the number of detections, and the number of hits.

[0150] In some embodiments, the performing security detection on the second traffic data based on the protection strategy includes:

[0151] In response to at least one of the number of passes when the protection status is passed, the number of detections when the protection status is detected, the pass rate when the protection status is passed, and the detection rate when the protection status is detected being greater than a third preset threshold within a preset time period, the corresponding interface access request in the second traffic data is marked or intercepted.

[0152] The pass count is used to indicate that the sequence formed by the interface access request to be detected is completely consistent with the target interface access behavior sequence. During detection, matching begins when the user's first interface access request hits the request entry of the target interface access behavior sequence. Among them, the pass condition includes: hitting the request entry of the target interface access behavior sequence, if the interface access request matching the next node in the target interface access behavior sequence arrives within a preset time range, and the interface access requests matching each node in the target interface access behavior sequence have all arrived, then the pass count is increased by one.

[0153] The number of detections is used to indicate that there is a certain deviation between the sequence formed by the interface access request to be detected and the target interface access behavior sequence. During detection, matching begins when the user's first interface access request hits the request entry of the target interface access behavior sequence. Among them, the detection conditions include: if the interface access request that matches the next node in the target interface access behavior sequence arrives or does not arrive within the preset time range, and there is an interface access request that matches a node in the target interface access behavior sequence that has not arrived, the number of detections is increased by one.

[0154] The number of hits is obtained by summing the number of passes and the number of detections.

[0155] In some embodiments, the triggering condition of the protection strategy may include at least one of the following:

[0156] The number of times the interface access request for accessing information of the same user passes within a preset time range meets a preset pass number threshold;

[0157] The number of detections of the interface access request for access information of the same user within a preset time range meets the preset detection number threshold;

[0158] The number of detections exceeds the preset detection threshold;

[0159] The detection rate exceeds the preset detection rate threshold; where detection rate = number of detections / total number of interface access requests.

[0160] The passing number threshold and the detecting number threshold may be fixed values ​​or dynamic values ​​calculated according to the total number of interface access requests, which is not limited in this embodiment.

[0161] When a client's interface access request is detected to have abnormal behavior based on the protection policy, protection actions such as observation, interception, JS challenge, and human-machine verification will be triggered, and the number of abnormalities will be counted and displayed in the policy list, and the log and overview identification rule information will be displayed.

[0162] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0163] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0164] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides an interface traffic security detection device.

[0165] refer to Figure 4 , the device comprises:

[0166] The first acquisition module 11 is configured to: acquire a plurality of first flow data whose destination addresses belong to the same domain name;

[0167] The second acquisition module 13 is configured to: acquire an interface access behavior sequence set from the plurality of first traffic data, the interface access behavior sequence set comprising at least two interface access behavior sequences, the interface access behavior sequence comprising at least two interface access requests acquired from the plurality of first traffic data;

[0168] The aggregation module 15 is configured to: perform deduplication and aggregation processing on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence;

[0169] The detection module 17 is configured to perform security detection on the second flow data based on the target interface access behavior sequence.

[0170] In some embodiments, the obtaining of a set of interface access behavior sequences in the plurality of first traffic data includes:

[0171] The interface access behavior sequence set is obtained from the access logs corresponding to the plurality of first traffic data.

[0172] In some embodiments, the obtaining of a set of interface access behavior sequences in the plurality of first traffic data includes:

[0173] Based on user access information, acquiring a first interface access behavior sequence corresponding to the user access information, wherein the user access information includes at least one of an Internet Protocol address and a user agent;

[0174] Processing the first interface access behavior sequence to obtain a second interface access behavior sequence belonging to a different session;

[0175] Dividing the second interface access behavior sequence to obtain a third interface access behavior sequence;

[0176] The interface access behavior sequence set is determined based on the third interface access behavior sequence, the user access information, and the session identifier of the session, wherein the interface access behavior sequence in the interface access behavior sequence set includes the third interface access behavior sequence, the user access information, and the session identifier.

[0177] In some embodiments, the deduplication processing of the interface access behavior sequences in the interface access behavior sequence set includes:

[0178] Deleting the interface access behavior sequence having the same third interface access behavior sequence, the user access information, and the session identifier from the interface access behavior sequence set;

[0179] The interface access behavior sequences in the interface access behavior sequence set that are identical to the third interface access behavior sequence or have a similarity greater than a first preset threshold are deleted.

[0180] In some embodiments, the aggregating the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence includes:

[0181] Performing clustering processing on the third interface access behavior sequence based on sequence characteristics to generate multiple clusters;

[0182] Obtain a preset number of clusters with the largest number of elements in the clusters, and obtain a fourth interface access behavior sequence corresponding to the cluster center;

[0183] The target interface access behavior sequence is determined based on the fourth interface access behavior sequence.

[0184] In some embodiments, the performing security detection on the second traffic data based on the target interface access behavior sequence includes:

[0185] Obtaining at least one of the number of node branches, corresponding user access information, and a corresponding session of the target interface access behavior sequence;

[0186] Calculate the confidence based on the number of node branches of the target interface access behavior sequence, the corresponding user access information, and at least one of the sessions to which it belongs;

[0187] In response to the confidence being greater than a second preset threshold, a security check is performed on the interface access behavior request based on the target interface access behavior sequence.

[0188] In some embodiments, the calculating of the confidence based on at least one of the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session includes at least one of the following:

[0189] If the number of node branches of the target interface access behavior sequence decreases, increasing the value of the confidence;

[0190] If the user access information corresponding to the target interface access behavior sequence increases, then the confidence value is increased;

[0191] If the number or proportion of Internet Protocol addresses corresponding to the target interface access behavior sequence greater than a first preset proportion is less than a preset value, increasing the value of the confidence level;

[0192] If the number of sessions to which the target interface access behavior sequence belongs increases, the value of the confidence level is increased.

[0193] In some embodiments, the method further comprises:

[0194] In response to the target interface access behavior sequence satisfying a preset condition, modifying the identification state of the target interface access behavior sequence and updating the confidence level;

[0195] The preset condition includes at least one of the following:

[0196] Acquiring the same target interface access behavior sequence within multiple cycles of a preset time length;

[0197] A difference in a change in a detection result of a security detection performed on the second traffic data based on the target interface access behavior sequence is within a third preset threshold.

[0198] In some embodiments, the performing security detection on the second traffic data based on the target interface access behavior sequence includes:

[0199] Setting a protection strategy based on the target interface access behavior sequence, and performing security detection on the second traffic data based on the protection strategy;

[0200] The protection strategies include:

[0201] In response to the second traffic data including the target interface access behavior sequence, determining the protection status as passed or detected.

[0202] In some embodiments, the second traffic data includes the target interface access behavior sequence, and determining the protection state includes at least one of the following:

[0203] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data and an interval between each interface access request is less than or equal to a third preset threshold, it is determined that the protection status is passed;

[0204] If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data, an interval time of some interface access requests is less than or equal to a third preset threshold and an interval time of some interface access requests is greater than the third preset threshold, it is determined that the protection state is detected;

[0205] If there is a sequence of interface access requests in the second traffic data whose similarity with the target interface access behavior sequence is greater than a fourth preset threshold, it is determined that the protection state is detected.

[0206] In some embodiments, the performing security detection on the second traffic data based on the protection strategy includes:

[0207] In response to at least one of the number of passes when the protection status is passed, the number of detections when the protection status is detected, the pass rate when the protection status is passed, and the detection rate when the protection status is detected being greater than a third preset threshold within a preset time period, the corresponding interface access request in the second traffic data is marked or intercepted.

[0208] For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the present disclosure, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0209] The device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0210] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in any of the above embodiments is implemented.

[0211] Figure 5A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0212] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0213] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0214] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0215] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WIFI, Bluetooth, etc.).

[0216] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0217] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0218] The electronic device of the above embodiment is used to implement the corresponding method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0219] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method described in any of the above embodiments.

[0220] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0221] The computer instructions stored in the storage medium of the above embodiments are used to enable the computer to execute the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0222] Based on the same inventive concept, corresponding to the method described in any of the above embodiments, the present disclosure further provides a computer program product, which includes computer program instructions. In some embodiments, the computer program instructions can be executed by one or more processors of a computer so that the computer and / or the processor execute the method. Corresponding to the execution subject corresponding to each step in each embodiment of the method described, the processor that executes the corresponding step can belong to the corresponding execution subject.

[0223] The computer program product of the above embodiment is used to enable the computer and / or the processor to execute the method described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0224] Those skilled in the art will appreciate that the embodiments of the present disclosure may be implemented as a system, method, or computer program product. Therefore, the present disclosure may be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software, generally referred to herein as a "circuit," "module," or "system." In addition, in some embodiments, the present disclosure may also be implemented in the form of a computer program product in one or more computer-readable media, which contains computer-readable program code.

[0225] Any combination of one or more computer-readable media may be used. A computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive examples) of computer-readable storage media may include, for example: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.

[0226] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0227] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0228] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0229] It should be understood that each box in the flowchart and / or block diagram and the combination of boxes in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable flow detection device, thereby producing a machine, and these computer program instructions are executed by a computer or other programmable flow detection device to produce a device that implements the functions / operations specified in the boxes in the flowchart and / or block diagram.

[0230] These computer program instructions can also be stored in a computer-readable medium that enables a computer or other programmable flow detection device to operate in a specific manner. In this way, the instructions stored in the computer-readable medium produce a product that includes an instruction device that implements the functions / operations specified in the boxes in the flowchart and / or block diagram.

[0231] Computer program instructions may also be loaded onto a computer, other programmable flow detection device, or other equipment so that a series of operating steps are performed on the computer, other programmable flow detection device, or other equipment to produce a computer-implemented process, thereby enabling the instructions executed on the computer or other programmable device to provide a process for implementing the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0232] In addition, although the operations of the disclosed method are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0233] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0234] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0235] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0236] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present disclosure difficult to understand, the known power / ground connections to the integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present disclosure difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0237] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0238] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A method for detecting interface traffic security, comprising: Acquire multiple first flow data whose destination addresses belong to the same domain name; Obtaining a set of interface access behavior sequences from the multiple first traffic data, wherein the set of interface access behavior sequences includes at least two interface access behavior sequences, and the interface access behavior sequence includes at least two interface access requests obtained from the multiple first traffic data; the set of interface access behavior sequences is determined based on a third interface access behavior sequence, user access information, and a session identifier of a session; the third interface access behavior sequence is obtained by dividing the second interface access behavior sequence; the second interface access behavior sequence belonging to a different session is obtained by processing the first interface access behavior sequence; The first interface access behavior sequence corresponding to the user access information is obtained based on the user access information; Deduplication and aggregation processing are performed on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence; A security check is performed on the second traffic data based on the target interface access behavior sequence.

2. The method according to claim 1, wherein: The obtaining of a set of interface access behavior sequences in the plurality of first traffic data includes: The interface access behavior sequence set is obtained from the access logs corresponding to the plurality of first traffic data.

3. The method according to claim 1, wherein: The user access information includes at least one of an Internet Protocol address and a user agent; the interface access behavior sequence in the interface access behavior sequence set includes the third interface access behavior sequence, the user access information and the session identifier.

4. The method according to claim 3, wherein: The deduplication processing of the interface access behavior sequences in the interface access behavior sequence set includes: Deleting the interface access behavior sequence having the same third interface access behavior sequence, the user access information, and the session identifier from the interface access behavior sequence set; The interface access behavior sequences in the interface access behavior sequence set that are identical to the third interface access behavior sequence or have a similarity greater than a first preset threshold are deleted.

5. The method according to claim 3, wherein: The aggregating the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence includes: Performing clustering processing on the third interface access behavior sequence based on sequence characteristics to generate multiple clusters; Obtain a preset number of clusters with the largest number of elements in the clusters, and obtain a fourth interface access behavior sequence corresponding to the cluster center; The target interface access behavior sequence is determined based on the fourth interface access behavior sequence.

6. The method according to claim 5, wherein: The performing security detection on the second flow data based on the target interface access behavior sequence includes: Obtaining at least one of the number of node branches, corresponding user access information, and a corresponding session of the target interface access behavior sequence; Calculate the confidence based on the number of node branches of the target interface access behavior sequence, the corresponding user access information, and at least one of the sessions to which it belongs; In response to the confidence being greater than a second preset threshold, a security check is performed on the second traffic data based on the target interface access behavior sequence.

7. The method according to claim 6, wherein: The calculating of the confidence based on at least one of the number of node branches of the target interface access behavior sequence, the corresponding user access information, and the corresponding session includes at least one of the following: If the number of node branches of the target interface access behavior sequence decreases, increasing the value of the confidence; If the user access information corresponding to the target interface access behavior sequence increases, then the confidence value is increased; If the number or proportion of Internet Protocol addresses corresponding to the target interface access behavior sequence greater than a first preset proportion is less than a preset value, increasing the value of the confidence level; If the number of sessions to which the target interface access behavior sequence belongs increases, the value of the confidence level is increased.

8. The method according to claim 6, further comprising: In response to the target interface access behavior sequence satisfying a preset condition, modifying the identification state of the target interface access behavior sequence and updating the confidence level; The preset condition includes at least one of the following: Acquiring the same target interface access behavior sequence within multiple cycles of a preset time length; A difference in a change in a detection result of a security detection performed on the second traffic data based on the target interface access behavior sequence is within a third preset threshold.

9. The method according to claim 1, wherein: The performing security detection on the second flow data based on the target interface access behavior sequence includes: Setting a protection strategy based on the target interface access behavior sequence, and performing security detection on the second traffic data based on the protection strategy; The protection strategies include: In response to the second traffic data including the target interface access behavior sequence, determining the protection status as passed or detected.

10. The method according to claim 9, wherein: The second traffic data includes the target interface access behavior sequence, and determining the protection state includes at least one of the following: If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data and an interval between each interface access request is less than or equal to a third preset threshold, it is determined that the protection status is passed; If a sequence of interface access requests that is consistent with the target interface access behavior sequence exists in the second traffic data, an interval time of some interface access requests is less than or equal to a third preset threshold and an interval time of some interface access requests is greater than the third preset threshold, it is determined that the protection state is detected; If there is a sequence of interface access requests in the second traffic data whose similarity with the target interface access behavior sequence is greater than a fourth preset threshold, it is determined that the protection state is detected.

11. The method according to claim 9, wherein: The performing security detection on the second flow data based on the protection strategy includes: In response to at least one of the number of passes when the protection status is passed, the number of detections when the protection status is detected, the pass rate when the protection status is passed, and the detection rate when the protection status is detected being greater than a third preset threshold within a preset time period, the corresponding interface access request in the second traffic data is marked or intercepted.

12. An interface traffic security detection device, comprising: The first acquisition module is configured to: acquire a plurality of first flow data whose destination addresses belong to the same domain name; The second acquisition module is configured to: acquire a set of interface access behavior sequences from the multiple first traffic data, wherein the set of interface access behavior sequences includes at least two interface access behavior sequences, and the interface access behavior sequence includes at least two interface access requests acquired from the multiple first traffic data; the set of interface access behavior sequences is determined based on a third interface access behavior sequence and user access information and a session identifier of a session; the third interface access behavior sequence is obtained by dividing the second interface access behavior sequence; the second interface access behavior sequence belonging to different sessions is obtained by processing the first interface access behavior sequence; The first interface access behavior sequence corresponding to the user access information is obtained based on the user access information; An aggregation module is configured to: perform deduplication and aggregation processing on the interface access behavior sequences in the interface access behavior sequence set to obtain a target interface access behavior sequence; The detection module is configured to: perform security detection on the second flow data based on the target interface access behavior sequence.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the interface traffic security detection method according to any one of claims 1 to 11 when executing the program.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute the interface traffic security detection method according to any one of claims 1 to 11.

15. A computer program product, characterized in that It includes computer program instructions, and when the computer program instructions are executed on a computer, the computer executes the interface traffic security detection method as described in any one of claims 1 to 11.

Images