Rule-based method and device for detecting user browsing behavior security

Abstract

The invention discloses a rule-based method and device for detecting user browsing behavior security, and the method comprises the steps: a gateway verifies the identity information and authority information of a client according to a received client access request, and forwards the access request to a target resource after the verification is passed; the gateway intercepts a response returned from the target resource, and injects a Service Worker script into the response; after the client page is loaded, a Service Worker script is installed and operated, the Service Worker script monitors operation information of the client, and when dangerous operation is monitored, the operation information is sent to the gateway; and the gateway compares and analyzes the received operation information with a preset security policy, and processes the client according to an analysis result. The technical scheme of the invention aims to establish a security mechanism with quick response, provide a secure access environment for a user, and protect resources from unauthorized access and other security threats, so that the system can adapt to constantly changing threat environments.

Description

Technical Field

[0001] The present invention relates to the field of computer network technology, and in particular to a method and device for detecting the security of user browsing behavior based on rules. Background Art

[0002] Rule-based methods for detecting the security of user browsing behavior play an important role in the field of network security, with the main purpose of protecting users from various online threats. These methods usually involve monitoring and analyzing users' network activities and using predefined security rules to identify and respond to potential security threats. However, the existing technologies have some technical problems in practical applications:

[0003] Rule adaptability issues: rule-based systems may have difficulty adapting to new attack methods and the ever-changing threat environment. Due to the diversity and complexity of network threats, existing rule sets may not cover all new attack patterns, resulting in insufficient system recognition of new threats.

[0004] It is difficult to establish a rule set. Users' browsing behaviors vary greatly, so it is a challenge to create a set of rules that can adapt to all user behaviors. This means that the rule set needs to be flexible enough to adapt to different user behavior patterns, but not too complex to avoid affecting the efficiency and real-time performance of the system. Summary of the invention

[0005] The main purpose of the present invention is to provide a method and device for detecting the security of user browsing behavior based on rules, aiming to establish a responsive security mechanism to provide users with a secure access environment while protecting resources from unauthorized access and other security threats, so that the system can adapt to the ever-changing threat environment.

[0006] To achieve the above object, the present invention proposes a method for detecting the security of user browsing behavior based on rules, comprising:

[0007] The gateway verifies the identity information and permission information of the client according to the received client access request, and forwards the access request to the target resource after the verification is passed;

[0008] The gateway intercepts the response returned from the target resource and injects the Service Worker script into the response;

[0009] After the client page is loaded, the Service Worker script is installed and run. The Service Worker script monitors the client's operation information and sends the operation information to the gateway when a dangerous operation is detected.

[0010] The gateway compares and analyzes the received operation information with the preset security policy and processes the client based on the analysis results.

[0011] In one embodiment of the present invention, after the client page is loaded, after the step of installing and running the ServiceWorker script, the following further includes:

[0012] The Service Worker script establishes a heartbeat connection with the gateway to ensure continuous activation and updating of the Service Worker script.

[0013] In one embodiment of the present invention, the gateway verifies the identity information and permission information of the client based on the received client access request, and after the verification, forwards the access request to the target resource. The access request is a request issued by the client to the gateway through the zero trust model.

[0014] In one embodiment of the present invention, after the gateway compares and analyzes the received operation information with the preset security policy and processes the client according to the analysis result, the method further includes:

[0015] The gateway records the received operation information and the processing information made by the gateway as log data, and sends the log data to the log center.

[0016] In one embodiment of the present invention, it is characterized in that after the step of recording the received operation information and the processing information made by the gateway as log information and sending the log information to the log center, it also includes:

[0017] The log center displays the received log data and sends a notification to the management end.

[0018] The present invention also proposes a storage device for storing a computer program, wherein the computer program, when executed by a processor, executes the rule-based method for detecting the security of user browsing behavior as described in any one of the above items.

[0019] The technical solution of the present invention intercepts the response returned from the resource while forwarding the user request to the target resource, injects the Service Worker script into it, and uses the xpath technology to obtain the page components to identify and monitor the key elements in the user interface, such as buttons, links, forms, etc. Compared with the traditional API gateway, the gateway of the present application has significant advantages in functionality, ease of use and flexibility. It can help users more efficiently obtain components such as buttons and input boxes on web pages, thereby realizing operations on these components. This gateway is suitable for various complex page layouts and can meet the needs of different users.

[0020] The present invention can intercept dangerous operation behaviors in real time, the Service Worker script can report user behaviors in real time, and the gateway can process the reported information in real time and take corresponding safety measures.

[0021] The present invention can dynamically adjust security policies. IAM (Identity and Access Management) can adjust security policies according to user operation logs and send them to the gateway. The policy engine processes the reported information according to the sent security policies. The policy engine can analyze xpath information, determine whether the user's operation meets expectations, and execute corresponding security measures according to the policy. Based on the judgment of the policy engine, the gateway may take actions including intercepting access, logging off, disabling accounts, etc., and record related events as logs.

[0022] Compared with traditional API gateways, the XPath-based gateway can control user operations more finely. It can analyze the user's operation path and target elements to achieve permission control and security policy enforcement for specific page components. Because it can understand and analyze the user's operation intention, the gateway can implement more advanced security policies, such as preventing SQL injection, cross-site scripting attacks (XSS), etc. Through contextual analysis of user input, malicious behavior can be more accurately identified and intercepted. The gateway is able to collect and analyze user behavior patterns, which helps to identify abnormal behavior or potential security threats, so that preventive measures can be taken in advance. By analyzing user operations, the gateway can help optimize the user experience. For example, it can identify common problems encountered by users during operation and automatically provide solutions or warnings. Traditional API gateways may cause false positives because they cannot distinguish between normal operations and malicious operations. This gateway can reduce such false positives and improve the accuracy and efficiency of the system by understanding user behavior more deeply. This gateway can customize security policies according to different application scenarios and needs, and has good flexibility and scalability. It can easily adapt to a variety of different web applications and user operation modes. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0024] Figure 1 The present invention is a schematic flow chart of the steps of a method for detecting the security of user browsing behavior based on rules.

[0025] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0027] Reference Figure 1 The present invention proposes a method for detecting the security of user browsing behavior based on rules, comprising:

[0028] S100, the gateway verifies the identity information and permission information of the client according to the received client access request, and forwards the access request to the target resource after the verification is passed;

[0029] S200, the gateway intercepts the response returned from the target resource and injects the Service Worker script into the response;

[0030] S300, after the client page is loaded, the Service Worker script is installed and run, and the Service Worker script monitors the operation information of the client and sends the operation information to the gateway when a dangerous operation is detected;

[0031] S400, the gateway compares and analyzes the received operation information with the preset security policy, and processes the client according to the analysis result.

[0032] As you can understand, as an access control point, the gateway first authenticates the user and checks permissions to ensure that only authorized users can access resources. This process may involve username and password verification, multi-factor authentication, or other security mechanisms. After verification, the gateway forwards the user's access request to the target resource. This step ensures that only user requests that pass the gateway are sent to the backend service.

[0033] When the response comes back, the gateway injects the Service Worker script into the response. Service Worker is a script that runs in the background of the browser. It can intercept and process network requests, cache resources, and push notifications. By injecting Service Worker, the gateway can embed a monitoring mechanism in the user interface.

[0034] After the user page is loaded, the Service Worker starts running and monitoring the user's behavior. When the user performs certain dangerous operations (such as copying sensitive information, opening the console, etc.), the Service Worker captures these behaviors and reports them to the gateway.

[0035] After receiving the user behavior information reported by the Service Worker, the gateway will process it according to the preset security policy. This may include real-time interception of suspicious requests, logout, account disabling and other operations to protect resources from unauthorized access.

[0036] In one embodiment of the present invention, after the client page is loaded, after the step S300 of installing and running the Service Worker script, the following steps are further included:

[0037] S310, the Service Worker script establishes a heartbeat connection with the gateway to ensure continuous activation and updating of the Service Worker script.

[0038] Understandably, the so-called heartbeat connection is to send a custom structure (heartbeat packet or heartbeat frame) at regular intervals to let the gateway know that the Service Worker script is "online" to ensure the validity of the connection. The Service Worker script sends a fixed message to the gateway at regular intervals, and the gateway replies with a fixed message after receiving it. If the gateway does not receive the message sent by the script within the specified time, the script is considered disconnected. The Service Worker establishes a heartbeat connection with the gateway to ensure its continuous activation and update. This connection mechanism helps maintain real-time communication between the Service Worker and the gateway, so as to respond to and process user behavior in a timely manner.

[0039] In one embodiment of the present invention, the gateway verifies the identity information and permission information of the client based on the received client access request, and after the verification, forwards the access request to the target resource in step S100. The access request is a request issued by the client to the gateway through the zero trust model.

[0040] Understandably, the zero trust model is a security conceptual model that assumes that the internal network is no more trusted than the external network, and therefore requires strict authentication and authorization of all users attempting to access resources, no matter where they are located, thereby increasing the security of access.

[0041] In an embodiment of the present invention, after the gateway compares and analyzes the received operation information with the preset security policy and processes the client according to the analysis result in step S400, the following steps are further included:

[0042] S410, the gateway records the received operation information and the processing information made by the gateway as log data, and sends the log data to a log center.

[0043] As you can understand, the log center is responsible for receiving and storing log data from the gateway. These data include user access records, security policy execution status, abnormal behavior reports, etc. They are important bases for security monitoring and incident response.

[0044] In one embodiment of the present invention, after the step (S410) of the gateway recording the received operation information and the processing information made by the gateway as log information and sending the log information to the log center, the method further includes:

[0045] S420, the log center displays the received log data and sends a notification to the management end.

[0046] Understandably, the Log Center provides a display interface that allows administrators to view and analyze log data. Through advanced search, filtering, and visualization tools, administrators can quickly identify suspicious or abnormal activity patterns for in-depth investigation and analysis. And the Log Center can automatically detect suspicious or malicious activities and notify administrators. This real-time notification mechanism helps administrators respond quickly to potential security threats and take appropriate measures to protect system security.

[0047] The technical solution of the present invention intercepts the response returned from the resource while forwarding the user request to the target resource, injects the Service Worker script into it, and uses the xpath technology to obtain the page components to identify and monitor the key elements in the user interface, such as buttons, links, forms, etc. Compared with the traditional API gateway, the gateway of the present application has significant advantages in functionality, ease of use and flexibility. It can help users more efficiently obtain components such as buttons and input boxes on web pages, thereby realizing operations on these components. This gateway is suitable for various complex page layouts and can meet the needs of different users.

[0048] The present invention can intercept dangerous operation behaviors in real time, the Service Worker script can report user behaviors in real time, and the gateway can process the reported information in real time and take corresponding safety measures.

[0049] The present invention can dynamically adjust security policies. IAM (Identity and Access Management) can adjust security policies according to user operation logs and send them to the gateway. The policy engine processes the reported information according to the sent security policies. The policy engine can analyze xpath information, determine whether the user's operation meets expectations, and execute corresponding security measures according to the policy. Based on the judgment of the policy engine, the gateway may take actions including intercepting access, logging off, disabling accounts, etc., and record related events as logs.

[0050] Compared with traditional API gateways, the XPath-based gateway can control user operations more finely. It can analyze the user's operation path and target elements to achieve permission control and security policy enforcement for specific page components. Because it can understand and analyze the user's operation intention, the gateway can implement more advanced security policies, such as preventing SQL injection, cross-site scripting attacks (XSS), etc. Through contextual analysis of user input, malicious behavior can be more accurately identified and intercepted. The gateway is able to collect and analyze user behavior patterns, which helps to identify abnormal behavior or potential security threats, so that preventive measures can be taken in advance. By analyzing user operations, the gateway can help optimize the user experience. For example, it can identify common problems encountered by users during operation and automatically provide solutions or warnings. Traditional API gateways may cause false positives because they cannot distinguish between normal operations and malicious operations. This gateway can reduce such false positives and improve the accuracy and efficiency of the system by understanding user behavior more deeply. This gateway can customize security policies according to different application scenarios and needs, and has good flexibility and scalability. It can easily adapt to a variety of different web applications and user operation modes.

[0051] Various objects such as various messages / information / equipment / network elements / systems / devices / actions / operations / processes / concepts that may appear in this application are named. It can be understood that these specific names do not constitute a limitation on the relevant objects. The names assigned may change with factors such as scenarios, contexts or usage habits. The understanding of the technical meaning of the technical terms in this application should be mainly determined from the functions and technical effects embodied / executed in the technical scheme.

[0052] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0053] In the embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0054] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0055] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0056] It should also be understood that in various embodiments of the present application, the first, second, etc. are only used to indicate that multiple objects are different. For example, the first time window and the second time window are only used to indicate different time windows. They should not have any impact on the time window itself, and the first, second, etc. mentioned above should not impose any limitations on the embodiments of the present application.

[0057] It should also be understood that in the various embodiments of the present application, unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other, and the technical features in different embodiments can be combined to form new embodiments according to their internal logical relationships.

[0058] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a computer-readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned computer-readable storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0059] The present application also provides a computer program product, which includes instructions. When the instructions are executed, the network switch and the network system perform operations of the network switch and the network system corresponding to the above method.

[0060] The present application also provides a network system, the system comprising:

[0061] one or more memories for storing instructions; and

[0062] One or more processors are used to call and run the instructions from the memory to execute the method as described above.

[0063] The present application also provides a chip system, which includes a processor for implementing the functions involved in the above content, such as generating, receiving, sending, or processing the data and / or information involved in the above method.

[0064] The chip system may be composed of chips, or may include chips and other discrete devices.

[0065] The processor mentioned in any of the above places can be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for executing programs for controlling the above-mentioned feedback information transmission method.

[0066] In a possible design, the chip system also includes a memory, which is used to store necessary program instructions and data. The processor and the memory can be decoupled and respectively set on different devices, connected by wire or wireless means to support the chip system to implement various functions in the above embodiments. Alternatively, the processor and the memory can also be coupled on the same device.

[0067] Optionally, the computer instructions are stored in a memory.

[0068] Optionally, the memory is a storage unit within the chip, such as a register, a cache, etc. The memory can also be a storage unit within the terminal located outside the chip, such as a ROM or other types of static storage devices that can store static information and instructions, RAM, etc.

[0069] It can be understood that the memory in the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories.

[0070] The nonvolatile memory may be a ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), or a flash memory.

[0071] The volatile memory may be a RAM, which is used as an external cache. There are many different types of RAM, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory.

[0072] The embodiments of this specific implementation method are all preferred embodiments of the present application, and are not intended to limit the protection scope of the present application. Therefore, all equivalent changes made based on the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A rule-based method for detecting the security of user browsing behavior. It is characterized in that include: The gateway verifies the identity information and permission information of the client according to the received client access request, and forwards the access request to the target resource after the verification is passed; The gateway intercepts the response returned from the target resource and injects the Service Worker script into the response; After the client page is loaded, the Service Worker script is installed and run. The Service Worker script monitors the client's operation information and sends the operation information to the gateway when a dangerous operation is detected. The gateway compares and analyzes the received operation information with the preset security policy and processes the client based on the analysis results.

2. The method for detecting the security of user browsing behavior based on rules according to claim 1, It is characterized in that After the client page is loaded, after the step of installing and running the Service Worker script, the following steps are also included: The Service Worker script establishes a heartbeat connection with the gateway to ensure continuous activation and updating of the Service Worker script.

3. The method for detecting the security of user browsing behavior based on rules according to claim 1, It is characterized in that The gateway verifies the identity information and permission information of the client based on the received client access request, and forwards the access request to the target resource after the verification is passed. The access request is a request issued by the client to the gateway through the zero trust model.

4. The method for detecting the security of user browsing behavior based on rules according to claim 1, It is characterized in that After the gateway compares and analyzes the received operation information with the preset security policy and processes the client according to the analysis result, the following steps are also included: The gateway records the received operation information and the processing information made by the gateway as log data, and sends the log data to the log center.

5. The method for detecting the security of user browsing behavior based on rules according to claim 4, It is characterized in that After the gateway records the received operation information and the processing information made by the gateway as log information and sends the log information to the log center, the method further includes: The log center displays the received log data and sends a notification to the management end.

6. A storage device, It is characterized in that Used to store a computer program, which, when executed by a processor, executes the rule-based method for detecting the security of user browsing behavior as described in any one of claims 1 to 5.

Images