Data processing method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data processing method and device, equipment and a medium. The method comprises the following steps: creating a target proxy class; the target agent class is used for intercepting a calling operation of a to-be-detected application program on an application programming interface; inserting the target proxy class into a to-be-detected class corresponding to the application programming interface based on a byte code enhancement library; and in response to a calling operation on the application programming interface during running of the to-be-detected application, running the target agent class to obtain interaction data corresponding to the calling operation, and detecting the interaction data to obtain a security detection result. The data processing efficiency is improved, and the labor cost is reduced.

Description

Technical Field

[0001] The present invention belongs to the field of computer technology, and in particular relates to a data processing method, device, electronic equipment and storage medium. Background Art

[0002] With the development of computer technology, various application programming interfaces (APIs) have been widely used, and different interaction terminals can achieve data interaction through API interfaces. However, as the amount of data increases, there may be a large amount of sensitive data in the interaction through API interfaces, so it is necessary to detect the interaction data of API interfaces.

[0003] In the prior art, data from API interfaces is often captured manually for analysis, which is inefficient and has high labor costs. Summary of the invention

[0004] The present invention provides a data processing method, device, electronic equipment and storage medium to solve the problem of low efficiency of data processing.

[0005] In order to solve the above-mentioned technical problems, the present invention is achieved as follows:

[0006] In a first aspect, the present invention provides a data processing method, characterized in that the method comprises:

[0007] Creating a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation;

[0008] Inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library;

[0009] In response to a call operation on the application programming interface during the running of the application to be detected, running the target proxy class to obtain the target interaction data;

[0010] A security check of the application programming interface is performed according to the target interaction data to obtain a security check result.

[0011] In a second aspect, the present invention provides a data processing device, characterized in that the device comprises:

[0012] A creation module is used to create a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation;

[0013] An insertion module, used for inserting the target proxy class into the class to be detected corresponding to the application programming interface based on a bytecode enhancement library;

[0014] A running module, used for running the target proxy class in response to a call operation on the application programming interface during the running of the application to be detected, so as to obtain the target interaction data;

[0015] The detection module is used to perform a security detection on the application programming interface according to the target interaction data to obtain a security detection result.

[0016] In a third aspect, the present invention provides an electronic device comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect when executing the program.

[0017] In a fourth aspect, the present invention provides a readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute the method described in the first aspect above.

[0018] The data processing method provided by the embodiment of the present invention is to create a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface; based on the bytecode enhancement library, the target proxy class is inserted into the class to be detected corresponding to the application programming interface; in response to the calling operation of the application programming interface during the operation of the application to be detected, the target proxy class is run to obtain the interaction data corresponding to the calling operation, and the interaction data is tested to obtain the security test result. In this way, through the bytecode enhancement library, the target proxy class created for intercepting the calling operation of the API interface can be inserted into the class to be detected related to the API interface, so that the bytecode enhancement of the class to be detected can be achieved, and then during the operation of the application to be detected, without modifying the source code, the calling operation of the running API interface can be monitored through the inserted target proxy class, and then the interaction data corresponding to the API interface obtained by monitoring can be detected, thereby improving the data processing efficiency and reducing the labor cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1is a flow chart of steps of a data processing method provided by an embodiment of the present invention;

[0021] Figure 2 is a structural diagram of a data processing device provided by an embodiment of the present invention;

[0022] Figure 3 It is a structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Figure 1 is a flow chart of steps of a data processing method provided by an embodiment of the present invention, such as Figure 1 As shown, the method may include the following steps:

[0025] Step 101, create a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation.

[0026] Step 102: insert the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library.

[0027] Step 103: In response to a call operation on the application programming interface during the running of the application to be detected, run the target proxy class to obtain the target interaction data.

[0028] Step 104: Perform a security check on the application programming interface according to the target interaction data to obtain a security check result.

[0029] With respect to the above steps 101 to 104, the embodiment of the present invention can be applied to any client, server or virtual machine that has an API interface, and the embodiment of the present invention does not limit this. Among them, the above application to be detected can be the client of any application that has an API call requirement, and can be a video, audio, or social application, and the embodiment of the present invention does not limit this. It should be noted that the API interface that can be called by the application is often set on the server side of the application. Therefore, in the embodiment of the present invention, the above calling operation can be a calling operation of the client of the application to be detected to the API interface contained in the server side of the application to be detected.

[0030] Among them, the proxy class is equivalent to an interface, and the proxy class can be used to modify or replace the original class, so as to control the access to the original class and perform the required specified operations through the proxy class. The target proxy class in the embodiment of the present invention can be used to intercept the call operation of the application to be detected to the API interface, and obtain the target interaction data corresponding to the call operation. Optionally, the above-mentioned target proxy class can be created according to the object-oriented computer programming language (JAVA), in which the logic of intercepting the call operation of the API interface and the logic of obtaining the target interaction data can be defined.

[0031] Optionally, the operation of creating the target proxy class in the embodiment of the present invention may specifically include:

[0032] S1011. Encapsulate a preset interceptor class to obtain an interception interface; the interceptor class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation.

[0033] S1012: Create a proxy class, and insert the interception interface into the proxy class to obtain a target proxy class.

[0034] Among them, the class refers to the basis for object-oriented programming to implement information encapsulation, and the interceptor class (Interceptor) belongs to one of the classes, which is used to intercept user requests and can perform specific operations before or after the request is executed. Specifically, the interceptor class usually contains configuration parameters and defined methods. The above-mentioned interceptor class can be created in advance. The embodiment of the present invention can define the required intercepted operations in the interceptor class by setting the configuration parameters, that is, setting the interception attribute parameters in the interceptor class to the relevant attributes of the API interface. Furthermore, the embodiment of the present invention can create the above-mentioned interceptor class through the class creation instruction "public class".

[0035] Furthermore, the embodiment of the present invention can also define a data acquisition method in the interceptor class, so that the interceptor class can obtain the target interaction data corresponding to the call operation after intercepting the call operation through the defined data acquisition method. Specifically, the above-mentioned data acquisition method can be a data acquisition program pre-written by relevant personnel. Furthermore, the embodiment of the present invention encapsulates the preset interceptor class, and inserts the encapsulated interception interface into the proxy class to obtain the target proxy class that can intercept the API interface call operation. By running the target proxy class, the interception logic of the interceptor class and the defined data acquisition method can be executed.

[0036] Among them, the above-mentioned class to be detected refers to the class related to the API interface call, which can be set according to actual needs. Different devices can set different classes to be detected. For example, taking the web application server (Tomcat) as an example, the above-mentioned class to be detected can be "org.apache.catalina.connector.CoyoteAdapter", which is used to forward Hypertext Transfer Protocol (HTTP) requests. It is necessary to call the API interface to implement HTTP request forwarding, so this class can be set as the class to be detected.

[0037] Optionally, the embodiment of the present invention can also set the parameter attributes of the interceptor class based on the parameter attributes of the class to be detected. The above-mentioned parameter attributes refer to the attributes of the parameters used in the methods contained in the class. The parameters may include network addresses, processed data, return parameters, etc. The parameters corresponding to different classes to be detected are also different. Therefore, the embodiment of the present invention can set the parameter attributes of the interceptor class according to the type of class to be detected that is actually required to be detected, so that the attributes of the parameters in the interceptor class are consistent with the parameter attributes of the class to be detected, thereby ensuring that the data reading program in the interceptor class can be executed normally before or after the class to be detected.

[0038] Among them, bytecode is a binary file that contains an execution program and consists of a sequence of code or data pairs. It is a portable machine language. The corresponding bytecode can be obtained by compiling the source program so that the device can understand and execute it. Among them, the above-mentioned bytecode enhancement library refers to a tool for modifying the bytecode, and the existing bytecode can be modified or dynamically generated by the bytecode enhancement library. Specifically, the bytecode enhancement library in the embodiment of the present invention can be any one of a lightweight bytecode manipulation framework (Abstract Syntax Tree for Manipulation, ASM), a JAVA bytecode manipulation library (JAVA programming ASSISTant, Javassist) or a bytecode generation library (Byte Buddy), which can be selected according to actual needs, and the embodiment of the present invention does not limit this.

[0039] Furthermore, the embodiment of the present invention can modify the bytecode corresponding to the class to be detected through the bytecode enhancement library, that is, insert the target proxy class into the bytecode corresponding to the class to be detected, so that the API call operation can be monitored and intercepted without modifying the source code of the application to be detected. Specifically, the embodiment of the present invention can traverse all classes of the application to be detected through the bytecode enhancement library, locate the class related to the API interface call, obtain the bytecode corresponding to the class to be detected, and then insert the target proxy class into the bytecode corresponding to the class to be detected.

[0040] Optionally, the operation of inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library may specifically include:

[0041] S1021. Load the bytecode to be detected corresponding to the class to be detected based on the bytecode enhancement library.

[0042] S1022: Insert the target proxy class into the starting position and / or the ending position of the bytecode to be detected.

[0043] Among them, the above-mentioned bytecode enhancement library can be ByteBuddy or ASM, which can be set according to actual needs, and the embodiment of the present invention does not limit this. Specifically, the bytecodes corresponding to all classes contained in the application to be detected can be obtained through the bytecode enhancement library. Furthermore, the class name of the class to be detected can be input into the bytecode enhancement library, so that the bytecode enhancement library identifies the bytecode to be detected corresponding to the class to be detected from the bytecodes corresponding to all classes. Alternatively, the embodiment of the present invention can also directly input the class to be detected into the bytecode enhancement library, so that the bytecode enhancement library directly loads the class to be detected as the bytecode to be detected.

[0044] Furthermore, the embodiment of the present invention can insert the created target proxy class into the starting position and / or the ending position of the bytecode to be detected. Specifically, the target proxy class can be inserted into the starting position or the ending position of the bytecode corresponding to the class to be detected according to actual needs. Exemplarily, taking the detection requirement of HTTP request detection as an example, the target proxy class can be inserted into the starting position, so that when the HTTP request is received, the target proxy class can first detect the relevant data of the HTTP request. Another exemplary example, taking the detection requirement of HTTP response detection as an example, the target proxy class can be inserted into the ending position, so that when the application to be detected completes the operation of the class to be detected and needs to return response data, the response data can be detected by the target proxy class.

[0045] Through the above steps, the bytecode of the class to be detected related to the API interface can be modified. Through bytecode modification, the application to be detected can obtain the target interaction data corresponding to the API interface by executing the target proxy class before or after executing the class to be detected, thereby realizing automatic acquisition of API interface data and ensuring data processing efficiency.

[0046] Furthermore, after the target proxy class is inserted into the class to be detected, when the application to be detected calls the API interface, the call operation can be intercepted by running the target proxy class, and the interaction data corresponding to the call operation can be obtained and detected to obtain the detection result.

[0047] Specifically, the above-mentioned target interaction data may include communication data, request data, authentication information and other data, and different call operations correspond to different target interaction data. Furthermore, for different target interaction data, the embodiments of the present invention may adopt different detection methods. For example, for communication data, since the communication data often carries sensitive data, the embodiments of the present invention may perform sensitive data detection on the communication data. For another example, for authentication information, it may be detected whether it has passed the authentication, etc. Specifically, different detection methods may be adopted according to the actual data processing requirements, and the embodiments of the present invention do not limit this.

[0048] Optionally, in the embodiment of the present invention, after the target proxy class is executed, if an abnormality is detected in the target interaction data, a deactivation request may be sent to suspend the interaction of the API interface.

[0049] Optionally, after the above step 102, the embodiment of the present invention may further include:

[0050] S111, starting the application to be detected, and during the startup process, loading the class to be detected after inserting the target proxy class based on the class loader.

[0051] The startup operation may be performed directly after executing step 102, or may be performed after receiving a startup instruction, which is not limited in the embodiment of the present invention. The class loader (BootstrapClassLoader) may be a JAVA class loader, which is used to load a class into a device such as a virtual machine.

[0052] By searching for class files based on the class loader and loading them into the memory, the program can run normally in the device, thereby ensuring that the class to be tested can run normally after the target proxy class is inserted during the running of the application to be tested, and ensuring the normal acquisition of the target interaction data.

[0053] In summary, the data processing method provided by the embodiment of the present invention creates a target proxy class; the target proxy class is used to intercept the calling operation of the application programming interface by the application to be detected; the target proxy class is inserted into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library; in response to the calling operation of the application programming interface during the operation of the application to be detected, the target proxy class is run to obtain the interaction data corresponding to the calling operation, and the interaction data is detected to obtain the security detection result. In this way, through the bytecode enhancement library, the target proxy class created for intercepting the calling operation of the API interface can be inserted into the class to be detected related to the API interface, so that the bytecode enhancement of the class to be detected can be realized, and then during the operation of the application to be detected, without modifying the source code, the calling operation of the running API interface can be monitored through the inserted target proxy class, and then the interaction data corresponding to the API interface obtained by monitoring can be detected, thereby improving the data processing efficiency and reducing the labor cost.

[0054] Optionally, in an embodiment of the present invention, the calling operation includes a communication operation, and the operation of performing a security check on the application programming interface according to the target interaction data to obtain a security check result may specifically include:

[0055] S21. Convert the communication data packet corresponding to the communication operation into identifiable data as target interaction data.

[0056] S22: input the target interaction data into a pre-trained keyword detection model to obtain key fields in the target interaction data.

[0057] S23. Detect the field value corresponding to the key field.

[0058] S24. When it is detected that the field value contains sensitive data, generate and output a security detection result including first prompt information, where the first prompt information indicates that sensitive data exists in the application programming interface.

[0059] Among them, sensitive data refers to data that may cause harm to individual users or society after being leaked. Sensitive data often needs to be desensitized, such as mobile phone numbers, passwords, ID numbers or bank card numbers, etc. Different industries need to pay attention to whether sensitive data will be leaked during the communication process. Among them, desensitization refers to the deformation of sensitive data through specified desensitization rules to achieve reliable protection of sensitive data. Furthermore, the embodiment of the present invention can analyze the desensitization status of the communication data generated by the API interface communication through the target proxy class when there is a need for sensitive data detection (for example: whether the mobile phone number / ID number / bank card number is transmitted in plain text), and determine whether the API interface receives or sends non-desensitized data, that is: sensitive data.

[0060] Specifically, the above communication operation refers to a data transmission operation, which can be a data transmission operation from an external device to the current device where the application to be detected is located, or a data transmission operation from the current device to an external device, and the embodiment of the present invention does not limit this. Correspondingly, in the case where the calling operation is a communication operation, the above class to be detected can be a class for responding to external data requests, or a class for receiving external data, which can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0061] Furthermore, when the calling operation is a communication operation, the communication data packet corresponding to the communication operation can be obtained through the target proxy class and converted into identifiable data. Specifically, since the communication operation often encapsulates the data to be transmitted into the form of a data packet based on the communication protocol, the embodiment of the present invention can convert the communication data into identifiable data for the convenience of detecting the communication data. Among them, the above-mentioned identifiable data can be a lightweight data exchange format (JavaScriptObject Notation, JSON) or an Extensible Markup Language (Extensible Markup Language, XML) format, which is not limited by the embodiment of the present invention. Specifically, the above-mentioned conversion operation can be implemented by a data format conversion instruction, or by calling a format conversion tool, which is not limited by the embodiment of the present invention.

[0062] Among them, the above-mentioned key fields refer to data fields that may correspond to sensitive data, and the data fields may include request parameters (Request Param), request data (Request Post Data) and response data (Response Data), etc. The above-mentioned keyword detection model can be pre-trained, which is used to detect key fields in the data. Furthermore, since there are many different data desensitization methods, and different data desensitization methods correspond to different data fields or data formats, some data desensitization methods may have data in non-standard formats. In order to ensure accurate identification of sensitive data, the embodiment of the present invention can pre-train a keyword detection model and use the keyword detection model to identify key fields.

[0063] Specifically, the embodiments of the present invention can obtain a large amount of sample sensitive data and input the sample sensitive data into the initial detection model. Among them, the sample sensitive data may include desensitized or non-desensitized data, and the desensitized data may include data obtained by using a variety of different desensitization methods. Furthermore, based on the detection results of the initial detection model and the similarity of the pre-marked reference results, the model parameters of the initial detection model can be adjusted, and the sample sensitive data can be input into the model again, until the number of model parameter adjustments reaches a preset number threshold or the loss value of the model reaches a preset loss value, the current model is determined as a keyword detection model.

[0064] Furthermore, the embodiment of the present invention can input the identifiable data into the keyword detection model, and obtain the key fields in the identifiable data by reading the output data of the model. For example, the key fields can be fields such as "contact information", "telephone", "mobile phone number", "email address" or "Internet Protocol Address (IP address)".

[0065] Furthermore, after obtaining the key field, the field value corresponding to the key field can be detected. Specifically, the above-mentioned field value detection method may include regular matching, natural language processing (NLP), etc. Specifically, the field value can be converted into a regular expression, and the regular expression can be matched with the reference regular expression. When the match is consistent, it can be determined that the field value contains sensitive data. Correspondingly, when the match is inconsistent, it is determined that the field value does not contain sensitive data. Among them, the above-mentioned reference regular expression refers to the standard regular expression corresponding to sensitive data. For example, the reference regular expression corresponding to the mobile phone number is "^1[3-9] \\\\d{9}$", where "^" indicates the beginning of the string, "1" indicates the first digit at the beginning of the number, and "[3-9]" indicates the range of the second digit at the beginning of the number. "\d{9}" indicates 9 numeric characters, and "$" indicates the end of the string. Optionally, sensitive data in the field value can also be detected based on the NLP model. The NLP model can identify sensitive data based on the context of the field value.

[0066] Furthermore, when it is detected that the field value contains sensitive data, a first prompt message indicating that sensitive data exists in the API interface can be output, thereby facilitating relevant personnel to protect the sensitive data in a timely manner.

[0067] Optionally, after identifying sensitive data, an embodiment of the present invention can also construct a blacklist and a whitelist based on the sensitive data, and external devices corresponding to communication operations with sensitive data can be added to the blacklist, and external devices corresponding to communication operations without sensitive data can be added to the whitelist, thereby realizing dynamic configuration of the blacklist and the whitelist.

[0068] In this way, through keyword detection model and field value detection, sensitive data corresponding to communication operations can be identified, the integrity of data desensitization can be tested, and the security of communication data can be improved.

[0069] Optionally, in an embodiment of the present invention, the calling operation includes a data request operation; the operation of performing a security check on the application programming interface according to the target interaction data to obtain a security check result may specifically include:

[0070] S31. Determine the request data and / or source address corresponding to the data request operation as target interaction data.

[0071] S32. When the amount of the requested data is not less than a preset threshold value, or the source address is a pre-marked abnormal address, generate and output a security detection result including a second prompt information, wherein the second prompt information indicates that an abnormal data request exists in the application programming interface.

[0072] The above-mentioned data request operation refers to the operation of the application to be detected requesting data from the API interface, which is usually the case when an external device initiates a data acquisition request to the application to be detected, and the application to be detected calls the API interface to respond to the data acquisition request. Accordingly, in the case where the calling operation is a data request operation, the above-mentioned class to be detected can be a class used to perform a request response operation.

[0073] Further, in the case where the call operation is a data request operation, the embodiment of the present invention can obtain the request data and / or source address corresponding to the data request operation as the target interaction data by executing the target proxy class. Among them, the request data refers to the data information to be obtained carried in the data request, which can be the identifier of the data, and the above-mentioned source address refers to the IP address that sends the data request. The above-mentioned request data and source address can be directly obtained from the data request corresponding to the data request operation.

[0074] Furthermore, since applications often store a large amount of user information, some external threats may attack applications through API interfaces and steal a large amount of user information. To avoid this, the embodiment of the present invention can detect the data volume and source address of the request data corresponding to the API interface.

[0075] Among them, the above-mentioned preset quantity threshold can be set according to the actual needs of the application to be detected, and can be set to 10, 100, 200, etc., and the embodiment of the present invention is not limited to this. The above-mentioned pre-marked abnormal address can be an IP address in the blacklist or an IP address that does not belong to the whitelist. Among them, the source address of historical threat intelligence can be integrated in the blacklist, so that the IP addresses related to known abnormal access can be obtained through the blacklist. Specifically, when the source address belongs to an IP address in the blacklist, or the source address does not belong to an IP address in the whitelist, it can be determined that the source address belongs to a pre-marked abnormal address.

[0076] Specifically, when the amount of requested data is not less than a preset threshold, the data request may be a large-scale data download, outbound or transfer, and there is a risk of sensitive data leakage. At the same time, when the source address belongs to a pre-marked abnormal address, the data request may come from an unknown access source or a threatening IP. At this time, the embodiment of the present invention can generate and output a security detection result containing a second prompt information, which is used to prompt the API interface that there is an abnormal data request and realize automatic early warning. Among them, the above-mentioned security detection results can be output in the form of email, SMS notification or pop-up window, which can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0077] Optionally, the embodiment of the present invention can also promptly upload the detected abnormal data request to the API related log for storage. Optionally, when the abnormal data request is detected, the embodiment of the present invention can also integrate the IP address corresponding to the abnormal data request and add it to the blacklist or the list of known attackers to achieve the integration of threat addresses, so as to facilitate the subsequent better discovery of potential threats. Furthermore, the embodiment of the present invention can also monitor the external connection of the API interface, and when the API interface actively connects to an external device, obtain the connected IP address, and compare the IP address with the integrated threat address. If the IP address belongs to a threat address, a warning message can be generated and output, so that relevant personnel can take countermeasures in time according to the warning message.

[0078] In this way, the embodiment of the present invention can avoid data leakage to the data request end with risks to a certain extent through the target proxy class, thereby improving the security of the API interface.

[0079] Optionally, in an embodiment of the present invention, the calling operation includes an access operation, and the operation of performing a security check on the application programming interface according to the target interaction data to obtain a security check result may specifically include:

[0080] S41. Determine authentication information corresponding to the access operation as target interaction data, wherein the authentication information includes authentication status and / or authentication mode.

[0081] S42. When the authentication information does not exist, or the authentication status in the authentication information is invalid, or the authentication method does not meet the preset requirements, generate a security detection result including a third prompt information, wherein the third prompt information indicates that there is abnormal access to the application programming interface.

[0082] The access operation may include data read access, data write access, etc. Accordingly, when the call operation is an access operation, the class to be detected may be a class for receiving data or a class for responding to a data read request.

[0083] Furthermore, in order to ensure the security of access operations, applications often authenticate access requests. In some cases, unauthenticated access or low-security access may occur due to authentication failure or low security of the authentication method. To avoid this problem, an embodiment of the present invention can use a target proxy class to obtain authentication information corresponding to the access operation.

[0084] Specifically, the authentication information corresponding to the access operation can be retrieved from the access log of the API interface. The access log is used to store the access time, visitor IP, accessed API path, authentication status, access method and other information corresponding to each access operation. The embodiment of the present invention can retrieve the authentication status and authentication method from the access log to detect the security of the access operation. Among them, the above authentication status is used to indicate whether the authentication is completed, which is often in the form of a status code. The above authentication method may include token authentication, password authentication, etc.

[0085] Specifically, when the authentication information corresponding to the access operation cannot be obtained, that is, when the authentication information corresponding to the access operation in the access log is empty, it indicates that there is no authentication information for the access operation, and the access operation may be an unauthenticated access. Accordingly, when the authentication status is an invalid state, for example, when the authentication status code is 401 or 403, it indicates that the authentication method is invalid or access is denied due to other reasons, and the access operation has not completed the authentication. Accordingly, the above-mentioned preset requirement may be that the security level of the authentication method is not lower than the specified level. For example, when the authentication method is password authentication, a weak password check can be performed on the password to determine its security level. When the password is too short or the password is easy to crack, it is determined that it is a weak password with a low security level and does not meet the preset requirements.

[0086] Furthermore, in the above situation, the embodiment of the present invention can generate and output a security detection result including a third prompt information, which is used to characterize the existence of abnormal access to the API interface. In this way, the embodiment of the present invention provides a unified monitoring platform for the authentication security of access operations. When abnormal access is monitored, an early warning notification can be sent to relevant personnel through the third authentication information, so that the relevant personnel can promptly adopt certain response measures, such as blocking the latest access of the corresponding source IP or suspending the corresponding API service, etc. The embodiment of the present invention does not limit this.

[0087] Optionally, in an embodiment of the present invention, the application to be detected has multiple callable application programming interfaces. Before creating the target proxy class, the embodiment of the present invention may further include:

[0088] S51. Perform a call test on each of the application programming interfaces to obtain a test result of each of the application programming interfaces; the test result is used to characterize the exposure degree of the application programming interface.

[0089] S52: Determine an application programming interface whose exposure level is not less than a preset level as a target interface.

[0090] The above-mentioned operation of loading the bytecode to be detected corresponding to the class to be detected based on the bytecode enhancement library may specifically include:

[0091] S53: The class to be detected corresponding to the target interface is used as the target detection class, and the bytecode corresponding to the target detection class is loaded based on the bytecode enhancement library as the bytecode to be detected.

[0092] The existence of multiple callable API interfaces in the application to be detected means that the server of the application to be detected is provided with multiple API interfaces. In this case, different API interfaces are often used to perform different data interaction operations, and accordingly, they face different security risks. In order to avoid unnecessary bytecode enhancement operations, the embodiment of the present invention can detect the exposure degree of each API interface.

[0093] Specifically, the embodiment of the present invention can call and test each API interface through a dialing test tool. The dialing test tool can detect whether the Transmission Control Protocol (TCP) port corresponding to each API interface is open, and detect whether the uniform resource locator (URL) of each API interface can respond normally, and detect whether the data structure returned by each API interface contains sensitive data. The exposure degree of the API interface can be obtained through the above detection. Among them, the above-mentioned dialing test tool can be a network scanning and sniffing tool (NetworkMapper, Nmap), a communication request sending plug-in (Postman) or a command line tool (curl), etc., which can be set according to actual needs, and the embodiment of the present invention does not limit this.

[0094] Specifically, the dialing tool can be deployed in an external Internet environment to simulate access from external devices. After deployment, a connection request can be sent to the TCP port of the API interface through the dialing tool. If the connection is successful, it is determined that the API interface can be connected normally. In addition, an access request can be sent to the URL of the API interface through the dialing tool. If the API interface returns an HTTP status code, it is determined that the external network device can obtain a valid response from the API interface. In addition, a data acquisition request GET can be sent to the API interface through the dialing tool. If the API interface returns the expected data structure, it is further detected whether the returned data contains sensitive data.

[0095] Furthermore, when the API interface can be connected normally and can obtain a valid response or contains sensitive data, it indicates that the API interface is completely open to external network devices and its exposure is high. Correspondingly, when the API interface can be connected normally but identity authentication is required to obtain data, it indicates that the API interface can only be accessed within the expected business scope and its exposure is medium. Correspondingly, when the API interface cannot establish a connection or is explicitly denied access (cannot obtain a valid response or cannot return the expected data structure), it indicates that the API interface is not open to external network devices and its exposure is low.

[0096] Among them, the above-mentioned preset degree level can be a lower exposure level. Of course, other preset degree levels can also be set according to actual security protection requirements, and the embodiment of the present invention does not limit this. Specifically, if the exposure level of the API interface is not lower than the preset degree level, it indicates that its security risk is high and the risk of data leakage is high, and it needs to be monitored intensively. Therefore, the embodiment of the present invention can determine it as the target interface. Accordingly, the above-mentioned operation of inserting the target proxy class can only insert the target proxy class for the class to be detected corresponding to the target interface. Therefore, in the embodiment of the present invention, the bytecode of the target detection class corresponding to the target interface can be loaded based on bytecode enhancement as the bytecode to be detected. Accordingly, the target proxy class can be inserted into the starting position and / or the end position of the bytecode to be detected.

[0097] Optionally, the embodiment of the present invention can also scan and parse the bytecode of the application to be detected through the bytecode enhancement library to obtain the interface information of all API interfaces, and the interface information can include the method name, parameters and return value corresponding to the API interface. Furthermore, the obtained interface information can be compared with the API interface list provided by the user, so as to facilitate timely updating of the API interface list and monitoring of the API interface information.

[0098] In this way, the embodiment of the present invention can avoid unnecessary bytecode enhancement steps to a certain extent and improve data processing efficiency by calling and testing multiple API interfaces and only creating target proxy classes for API interfaces with exposure levels not lower than a preset level.

[0099] Figure 2 is a structural diagram of a data processing device provided by an embodiment of the present invention, such as Figure 2 As shown, the device 20 may include:

[0100] The creation module 201 is used to create a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface and obtain the target interaction data corresponding to the calling operation;

[0101] Insertion module 202, used for inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library;

[0102] The running module 203 is used to run the target proxy class in response to the calling operation of the application programming interface during the running of the application to be detected, so as to obtain the target interaction data;

[0103] The detection module 204 is used to perform a security detection on the application programming interface according to the target interaction data to obtain a security detection result.

[0104] Optionally, the insertion module 202 includes:

[0105] A loading submodule, used for loading the bytecode to be detected corresponding to the class to be detected based on the bytecode enhancement library;

[0106] The inserting submodule is used to insert the target proxy class into the starting position and / or the ending position of the bytecode to be detected.

[0107] Optionally, the device 20 further includes:

[0108] The startup module is used to start the application to be detected and load the class to be detected after inserting the target proxy class based on the class loader during the startup process.

[0109] Optionally, the creation module 201 includes:

[0110] The encapsulation submodule is used to encapsulate the preset interceptor class to obtain an interception interface; the interceptor class is used to intercept the calling operation of the application to be detected on the application programming interface and obtain the target interaction data corresponding to the calling operation;

[0111] A submodule is created to create a proxy class, and the interception interface is inserted into the proxy class to obtain a target proxy class.

[0112] Optionally, the calling operation includes a communication operation, and the detection module 204 includes:

[0113] A conversion submodule, used to convert the communication data packet corresponding to the communication operation into identifiable data as target interaction data;

[0114] An input submodule, used for inputting the target interaction data into a pre-trained keyword detection model to obtain key fields in the target interaction data;

[0115] A field detection submodule, used to detect the field value corresponding to the key field;

[0116] The first output submodule is used to generate and output a security detection result including first prompt information when it is detected that the field value contains sensitive data, wherein the first prompt information indicates that sensitive data exists in the application programming interface.

[0117] Optionally, the calling operation includes a data request operation; the detection module 204 includes:

[0118] A first determination submodule, configured to determine the request data and / or source address corresponding to the data request operation as target interaction data;

[0119] The second output submodule is used to output a second prompt message when the amount of the requested data is not less than a preset quantity threshold, or when the source address belongs to a pre-marked abnormal address, wherein the second prompt message is used to indicate that there is an abnormal data request in the application programming interface.

[0120] Optionally, the calling operation includes an access operation, and the detection module 204 includes:

[0121] A second determination submodule, configured to determine authentication information corresponding to the access operation as target interaction data, wherein the authentication information includes an authentication state and / or an authentication mode;

[0122] The third output submodule is used to generate a security detection result including third prompt information when the authentication information does not exist, or the authentication status in the authentication information is invalid, or the authentication method does not meet the preset requirements, and the third prompt information indicates that there is abnormal access to the application programming interface.

[0123] Optionally, the application to be detected has a plurality of callable application programming interfaces, and the device 20 further includes:

[0124] A test module, used to perform a call test on each of the application programming interfaces to obtain a test result of each of the application programming interfaces; the test result is used to characterize the exposure degree of the application programming interface;

[0125] A determination module, configured to determine an application programming interface whose exposure level is not less than a preset level as a target interface;

[0126] The loading submodule is specifically used to: use the class to be detected corresponding to the target interface as the target detection class, and load the bytecode corresponding to the target detection class based on the bytecode enhancement library as the bytecode to be detected.

[0127] In summary, the data processing device provided by the embodiment of the present invention creates a target proxy class; the target proxy class is used to intercept the calling operation of the application programming interface by the application to be detected; the target proxy class is inserted into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library; in response to the calling operation of the application programming interface during the operation of the application to be detected, the target proxy class is run to obtain the interaction data corresponding to the calling operation, and the interaction data is detected to obtain the security detection result. In this way, through the bytecode enhancement library, the target proxy class created for intercepting the calling operation of the API interface can be inserted into the class to be detected related to the API interface, so that the bytecode enhancement of the class to be detected can be realized, and then during the operation of the application to be detected, without modifying the source code, the calling operation of the running API interface can be monitored through the inserted target proxy class, and then the interaction data corresponding to the API interface obtained by monitoring can be detected, thereby improving the data processing efficiency and reducing the labor cost.

[0128] The present invention also provides an electronic device, see Figure 3 , including: a processor 301, a memory 302, and a computer program 3021 stored in the memory and executable on the processor, wherein the processor implements the data processing method of the aforementioned embodiment when executing the program.

[0129] The present invention also provides a readable storage medium, when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute the data processing method of the aforementioned embodiment.

[0130] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0131] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the present invention is not directed to any specific programming language either. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the description of the above specific languages ​​is for disclosing the best mode of the present invention.

[0132] In the description provided herein, a large number of specific details are described. However, it is understood that embodiments of the present invention can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0133] Similarly, it should be understood that in order to streamline the present invention and aid in understanding one or more of the various inventive aspects, in the above description of exemplary embodiments of the present invention, the various features of the present invention are sometimes grouped together into a single embodiment, figure, or description thereof. However, this disclosed method should not be interpreted as reflecting the following intention: that the claimed invention requires more features than the features explicitly recited in each claim. More specifically, as reflected in the claims below, inventive aspects lie in less than all the features of the individual embodiments disclosed above. Therefore, the claims that follow the specific embodiment are hereby expressly incorporated into the specific embodiment, with each claim itself serving as a separate embodiment of the present invention.

[0134] Those skilled in the art will appreciate that the modules in the devices in the embodiments may be adaptively changed and arranged in one or more devices different from the embodiments. The modules or units or components in the embodiments may be combined into one module or unit or component, and in addition they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this manner may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature providing the same, equivalent or similar purpose.

[0135] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components in the sorting device according to the present invention. The present invention may also be implemented as a device or apparatus program for executing part or all of the methods described herein. Such a program for implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0136] It should be noted that the above embodiments illustrate the present invention rather than limit it, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets shall not be construed as a limitation on the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising a number of different elements and by means of a suitably programmed computer. In a unit claim enumerating a number of devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc., does not indicate any order. These words may be interpreted as names.

[0137] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0138] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

[0139] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data processing method, characterized in that: The method comprises: Creating a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation; Inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library; In response to a call operation on the application programming interface during the running of the application to be detected, running the target proxy class to obtain the target interaction data; A security check of the application programming interface is performed according to the target interaction data to obtain a security check result.

2. The method according to claim 1, characterized in that The step of creating a target proxy class includes: Encapsulating a preset interceptor class to obtain an interception interface; the interceptor class is used to intercept the calling operation of the application to be detected on the application programming interface and obtain the target interaction data corresponding to the calling operation; A proxy class is created, and the interception interface is inserted into the proxy class to obtain a target proxy class.

3. The method according to claim 1, characterized in that The step of inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library includes: Loading the bytecode to be detected corresponding to the class to be detected based on the bytecode enhancement library; The target proxy class is inserted into the starting position and / or the ending position of the bytecode to be detected.

4. The method according to claim 1, characterized in that: After inserting the target proxy class into the class to be detected corresponding to the application programming interface based on the bytecode enhancement library, the method further includes: The application program to be detected is started, and during the startup process, the class to be detected is loaded after the target proxy class is inserted based on the class loader.

5. The method according to any one of claims 1 to 4, characterized in that: The calling operation includes a communication operation, and the performing of a security check on the application programming interface according to the target interaction data to obtain a security check result includes: Converting the communication data packet corresponding to the communication operation into identifiable data as target interaction data; Inputting the target interaction data into a pre-trained keyword detection model to obtain key fields in the target interaction data; Detecting the field value corresponding to the key field; When it is detected that the field value contains sensitive data, a security detection result including first prompt information is generated and output, where the first prompt information indicates that sensitive data exists in the application programming interface.

6. The method according to any one of claims 1 to 4, characterized in that: The calling operation includes a data request operation; the security detection of the application programming interface is performed according to the target interaction data to obtain a security detection result, including: Determining the request data and / or source address corresponding to the data request operation as target interaction data; When the amount of the requested data is not less than a preset quantity threshold, or the source address belongs to a pre-marked abnormal address, a security detection result including second prompt information is generated and output, and the second prompt information indicates that there is an abnormal data request in the application programming interface.

7. The method according to any one of claims 1 to 4, characterized in that: The calling operation includes an access operation, and the security detection of the application programming interface is performed according to the target interaction data to obtain a security detection result, including: Determine authentication information corresponding to the access operation as target interaction data, the authentication information including authentication status and / or authentication mode; When the authentication information does not exist, or the authentication status in the authentication information is invalid, or the authentication method does not meet the preset requirements, a security detection result including a third prompt information is generated, and the third prompt information indicates that there is abnormal access to the application programming interface.

8. The method according to claim 3, characterized in that The application to be detected has multiple callable application programming interfaces. Before creating the target proxy class, the method further includes: Performing a call test on each of the application programming interfaces to obtain a test result of each of the application programming interfaces; the test result represents the exposure degree of the application programming interface; Determine an application programming interface whose exposure level is not less than a preset level as a target interface; The step of loading the bytecode to be detected corresponding to the class to be detected based on the bytecode enhancement library includes: The class to be detected corresponding to the target interface is used as the target detection class, and the bytecode corresponding to the target detection class is loaded based on the bytecode enhancement library as the bytecode to be detected.

9. A data processing device, characterized in that: The device comprises: A creation module is used to create a target proxy class; the target proxy class is used to intercept the calling operation of the application to be detected on the application programming interface, and obtain the target interaction data corresponding to the calling operation; An insertion module, used for inserting the target proxy class into the class to be detected corresponding to the application programming interface based on a bytecode enhancement library; A running module, used for running the target proxy class in response to a call operation on the application programming interface during the running of the application to be detected, so as to obtain the target interaction data; The detection module is used to perform a security detection on the application programming interface according to the target interaction data to obtain a security detection result.

10. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 8 when executing the program.

11. A readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the method according to any one of claims 1 to 8.

Images