Request detection method and device

Abstract

The invention provides a request detection method and device, and the method comprises the steps: receiving a request initiated by a requester for a preset operation function of an application program; determining request link data corresponding to the request; and detecting the request according to a detection strategy configured for the preset operation function and the request link data. According to the embodiment, the detection coverage rate in the request detection process can be improved, the possibility of missing detection and false detection problems is reduced, and the efficiency and accuracy of request detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a request detection method and device. Background Art

[0002] By detecting the requests initiated by the requester, the data security within the application can be effectively protected. However, existing technologies usually rely on manual detection of requests or automated detection tools. This detection method has a low coverage rate for potential risks and is prone to false detection and missed detection, which not only reduces the efficiency of request detection, but also affects the accuracy of request detection. Summary of the invention

[0003] In view of this, the embodiments of the present disclosure at least provide a request detection method, device, electronic device and storage medium, which can improve the detection coverage during the request detection process and reduce the possibility of missed detection and false detection problems, thereby improving the efficiency and accuracy of request detection.

[0004] In a first aspect, an embodiment of the present disclosure provides a request detection method, including:

[0005] Receiving a request initiated by a requester for a preset operation function of an application;

[0006] determining request link data corresponding to the request;

[0007] The request is detected according to the detection strategy configured for the preset operation function and the request link data.

[0008] Optionally, determining request link data corresponding to the request includes:

[0009] Based on the pre-injected bytecode, a tracking marker is added to the request when a request for a preset operation function is received;

[0010] Based on the trace flag, request link data corresponding to the request is determined.

[0011] Optionally, the request is detected according to the detection strategy configured for the preset operation function and the request link data, including:

[0012] Call the target interface to obtain the real identity of the requester who initiated the request;

[0013] Verify the consistency between the real identity and the identity information in the request link data. If the consistency verification passes, determine whether the response information includes the preset sensitive data based on the response information in the request link data.

[0014] In response to the response information including preset sensitive data, the request is detected according to the detection strategy configured for the preset operation function and the identity information and access information in the request link data.

[0015] Optionally, the method further comprises:

[0016] In response to the absence of sensitive data in the request link data, a detection result of the request is determined according to the consistency verification result.

[0017] Optionally, the method further comprises:

[0018] In response to an editing operation on the detection strategy, the detection strategy is updated; wherein the detection strategies configured for different preset operation functions are different.

[0019] Optionally, after the request is detected, the following steps are also included:

[0020] In response to the detection result of the request being failed, generating alarm information corresponding to the request, and returning the alarm information to the requester;

[0021] In response to the detection result of the request being passed, response information corresponding to the request in the request link data is returned to the requesting party.

[0022] In a second aspect, an embodiment of the present disclosure provides a request detection device, including:

[0023] A receiving module, used for receiving a request initiated by a requester for a preset operation function of an application program;

[0024] A determination module, used to determine request link data corresponding to the request;

[0025] The detection module is used to detect the request for link data according to the detection strategy configured for the preset operation function.

[0026] In a third aspect, an embodiment of the present disclosure further provides an electronic device, comprising: a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the computer device is running, the processor and the memory communicate through the bus, and when the machine-readable instructions are executed by the processor, the above-mentioned first aspect, or the steps in any optional implementation of the first aspect are performed.

[0027] In a fourth aspect, an embodiment of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned first aspect, or any optional implementation of the first aspect are executed.

[0028] In a fifth aspect, an embodiment of the present disclosure further provides a computer program product, including a computer program, which implements the method of any of the above embodiments when executed by a processor.

[0029] Any of the above aspects or any implementation methods of any of the aspects, by determining the request link data corresponding to the request, and detecting the request based on the complete request link data; thereby, each operation performed by the request within the application and the execution information corresponding to each operation can be captured, so that the coverage of the execution information associated with the request can be improved, and the problem of insufficient detection coverage due to the omission of a certain link can be avoided; in addition, the disclosed embodiment detects the request based on the request link data, and can use the real execution information generated within the application to determine whether the request is unauthorized, thereby solving the problem of false positives and false negatives caused by the inability to obtain real execution information during the request detection process; thereby improving the efficiency and accuracy of request detection. In addition, while detecting the request link data, the detection strategy pre-configured for the preset operation function is also used, thereby configuring the corresponding detection strategy for the preset operation function in different business systems or applications, and using the corresponding detection strategy to detect the complete link data of the request, it can solve the problem of low detection accuracy in the prior art due to the difficulty in deeply understanding the business logic due to the shallow analysis of the code and interface. Furthermore, when performing request detection, the prior art often only detects whether the request is unauthorized based on the received request and the returned response, and cannot know the operation performed by the request inside the application. In the present invention, request detection is performed based on the complete request link data associated with the request, thereby being able to perceive the execution of the addition, deletion, modification and query of the data inside the application, refining the granularity of detection and improving the efficiency and accuracy of request detection. In addition, although the efficiency of request detection can be improved through automated detection tools in the prior art, manual review and verification of the detection results are still required, which undoubtedly increases labor costs and increases the possibility of introducing human errors; the request detection method provided in the embodiment of the present disclosure not only improves the efficiency and accuracy of request detection, but also solves the problems of high costs and possible introduction of human errors caused by reliance on manual review.

[0030] The effects of the above-mentioned request detection device, electronic device and storage medium can be found in the description of the above-mentioned request detection method, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following is a brief introduction to the drawings required for use in the embodiments. The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can also be obtained based on these drawings without creative work.

[0032] Figure 1 A flowchart of a request detection method provided by an embodiment of the present disclosure is shown;

[0033] Figure 2 A schematic diagram of a process flow of a request detection method provided by an embodiment of the present disclosure is shown;

[0034] Figure 3 A schematic diagram of a request detection device provided by an embodiment of the present disclosure is shown;

[0035] Figure 4 An exemplary system architecture is shown in which embodiments of the present disclosure may be applied;

[0036] Figure 5 A schematic diagram of the structure of a computer system of a terminal device or a server used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical scheme and advantages of the embodiments of the present disclosure clearer, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure provided in the drawings is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present disclosure.

[0038] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0039] To facilitate understanding of this embodiment, a request detection method disclosed in the embodiment of the present disclosure is first introduced in detail. The execution subject of the request detection method provided in the embodiment of the present disclosure is generally a computer device with certain computing capabilities, and the computer device includes, for example: a terminal device or a server or other processing device, and the terminal device can be a user equipment (User Equipment, UE), a mobile device, a user terminal, a terminal, a cellular phone, a cordless phone, a personal digital assistant (Personal Digital Assistant, PDA), a handheld device, a computing device, a vehicle-mounted device, a wearable device, etc. In some possible implementations, the request detection method can be implemented by a processor calling a computer-readable instruction stored in a memory.

[0040] See also Figure 1 FIG. 1 is a flowchart of a request detection method provided by an embodiment of the present disclosure, and the method includes S101 to S103, wherein:

[0041] S101: receiving a request initiated by a requesting party for a preset operation function of an application.

[0042] In the embodiments of the present disclosure, the preset operation function may be a function related to data security within an application or business system, and the request initiated for the preset operation function may be a request that requires key detection. Specifically, the preset operation function may be determined based on different functions of the application, different application scenarios, or the business system to which it belongs; for example, for an application whose application scenario is an e-commerce website, the preset operation function may be set to a call function related to user login or user order submission; or for an application for data processing, the preset operation function may be set to a function that performs operations such as query, insert, and delete on the database. It should be noted that the above example of setting different preset operation functions for different application levels is only a possible implementation method of the embodiments of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, any preset operation function may be set according to any setting rules, and the embodiments of the present disclosure do not make specific limitations on this.

[0043] In a specific implementation, the execution subject of the embodiment of the present disclosure can monitor all requests initiated by the requesting party to the application. When it is detected that the request needs to call a preset operation function, the request can be used as a request that needs to be detected in the present invention. Alternatively, the application can also check the operation function that needs to be called or the event that needs to be accessed when receiving the request. When the check finds that the operation function that needs to be called or the event that needs to be accessed is a preset operation function or a preset event, the request can be forwarded to the execution subject of the embodiment of the present disclosure to check the request. It should be noted that the above-mentioned method for the execution subject of the embodiment of the present disclosure to obtain the request initiated by the preset operation function of the application is only used as an example of a possible implementation method of the embodiment of the present disclosure, and does not constitute an improper limitation of the present invention.

[0044] S102: Determine request link data corresponding to the request.

[0045] In this step, after obtaining the request initiated by the preset operation function of the application, the request link data corresponding to the request can be determined. The request link data here refers to the detailed information of all steps and operations that the application goes through from receiving the request to getting a response according to the request in the process of processing a request. This data may include the transmission process of the request between various components and layers, the execution status of various operations, and related context information.

[0046] In an embodiment of the present disclosure, determining request link data corresponding to a request includes: based on pre-injected bytecodes, adding a tracking mark in the request when a request initiated for a preset operation function is received; based on the tracking mark, determining the request link data corresponding to the request.

[0047] In a specific implementation, additional code can be injected into the preset operation function through bytecode injection technologies such as ASM (a Java bytecode manipulation framework that allows developers to generate, modify and analyze Java bytecodes at runtime), Java Agent (a Java program that can be loaded when the virtual machine is started or at runtime, and uses the instrumentation API to operate the loaded classes to monitor, analyze or modify the behavior of Java applications), so as to obtain the request link data corresponding to the request.

[0048] Figure 2 A flowchart of a request detection method provided by an embodiment of the present disclosure is shown as follows: Figure 2As shown, in a specific implementation, when a request initiated for a preset operation function is received, a tracking tag can be added to the request based on the pre-injected bytecode. In order to distinguish different requests and different request link data corresponding to different requests, the tracking tag here can be a unique string or identifier to track the entire request life cycle. Then, the generated tracking tag will be added to the metadata of the request, such as the request header; thus, the tracking tag can be passed along with the request in the application. When the request is passed in the application, the tracking tag will also be passed along, whether it is a call between services, a database query, or a third-party interface request, the tracking tag can be attached and passed on. In this way, the complete link of the request can be obtained, which may include API (Application Programming Interface), URL (Uniform Resource Locator), request header, request body, response information, SQL (Structured Query Language) execution statement, etc. Then the data with the same tracking tag can be associated to finally form the complete request link data corresponding to the request.

[0049] Therefore, based on the pre-injected bytecode, a tracking mark is added to the request when it is received. The bytecode can be used to read and pass the tracking mark, and the relevant information during the execution process is recorded. In this way, the complete request link data corresponding to the request is obtained, and the request can be detected based on the request link data in subsequent steps, thereby improving the efficiency and accuracy of request detection.

[0050] In another feasible implementation, the request link data corresponding to the request can also be determined by adding interceptors or middleware to each layer and component of the application; the interceptor or middleware will record relevant information when the request enters and leaves each component in the application; wherein the relevant information may include the data entering the component, the method executed in the component, and the response obtained through the component, etc. By connecting these relevant information in series, the complete request link data corresponding to the request can be obtained. Or the request link data can also be manually collected and associated by adding log records. Specifically, the log format inside the application can be unified first to ensure that the log information is consistent and relatable, and then detailed request information can be recorded, including the start and end time of the request, the URL of the request, the HTTP (Hypertext Transfer Protocol) method, the request header, the request body, the response status and the response body, etc., and the complete request link data corresponding to the request can be obtained. It should be noted that the above method for determining the request link data corresponding to the request is only a possible implementation method in the embodiment of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, the method for determining the request link data can be set according to actual needs and circumstances, and the embodiment of the present disclosure does not specifically limit this.

[0051] S103: Detect the request according to the detection strategy configured for the preset operation function and the request link data.

[0052] In this step, if Figure 2 As shown, after obtaining the complete request link data corresponding to the request, it can be reported to a module or device for offline analysis to detect the request based on the detection strategy and request link data pre-configured for the preset operation function.

[0053] In the embodiments of the present disclosure, the request can be detected according to the preset detection strategy and the request link data, and the detection here can be an unauthorized vulnerability detection. Unauthorized vulnerabilities can be divided into multiple forms such as vertical unauthorized access, horizontal unauthorized access and unauthorized access without access rights; among them, vertical unauthorized access refers to low-authorized users trying to access resources higher than their authority level, such as non-administrator users trying to access administrator data or interfaces, etc.; horizontal unauthorized access refers to low-authorized users trying to access resources with the same authority level but belonging to other users, such as user A trying to access user B's account information in an application; unauthorized access refers to users who do not have access rights to the current database trying to access any data in the database. The request detection method provided by the embodiments of the present disclosure can detect the above-mentioned unauthorized access vulnerabilities at the same time. The specific method is described in detail below and will not be repeated here.

[0054] In the embodiments of the present disclosure, the detection strategies configured for different preset operation functions in the same application may be different; the detection strategies configured for the same preset operation function in different applications may also be different. In specific implementations, corresponding detection strategies may be configured for preset operation functions according to actual detection standards and requirements, and the embodiments of the present disclosure do not specifically limit this.

[0055] In the embodiments of the present disclosure, the detection strategy may be some preset unauthorized behaviors. When it is detected that there are data that hit these unauthorized behaviors in the request link data, the request corresponding to the request link data may be determined as failing the detection. Exemplarily, the detection strategy may include which sensitive data and several sensitive data can be queried by the same access identity SQL, which data tables and several data tables can be queried by the same access identity information, how many times the same access identity information can access different data in the same table, the list library table is accessed by identity information not in the list, users in the access identity list are not allowed to access any library table data, which data can be accessed without identity information, etc. It should be noted that the parameters such as "which" and "several" described in the above examples can be configured according to actual needs; in addition, the above examples for the detection strategy are only used as a possible implementation method in the embodiments of the present disclosure, and do not constitute an improper limitation on the present invention. In actual applications, any detection strategy can be set according to needs, subject to the ability to achieve its functions, and the embodiments of the present disclosure do not make specific limitations on this.

[0056] In the disclosed embodiment, the method further includes: in response to an editing operation on the detection policy, updating the detection policy. In a specific implementation, if there is a need to update the detection policy, the detection policy can be updated directly by editing the description in the detection policy or modifying the parameters therein, without redefining or developing a new detection policy, thereby improving the efficiency and flexibility of requesting detection.

[0057] In another possible implementation, an effective period may be set for the detection strategy, and when the effective period expires, the detection strategy may be automatically updated; for example, the detection strategy may be regularly checked and updated monthly or quarterly to ensure the effectiveness and timeliness of the detection strategy.

[0058] In an embodiment of the present disclosure, a request is detected according to a detection strategy configured for a preset operation function and request link data, including: calling a target interface to obtain the real identity of the requester who initiates the request; verifying the consistency between the real identity and the identity information in the request link data, and if the consistency verification passes, judging whether the response information includes preset sensitive data according to the response information in the request link data; in response to the response information including preset sensitive data, detecting the request according to the detection strategy configured for the preset operation function and the identity information and access information in the request link data.

[0059] In a specific implementation, the request can be first subjected to identity consistency verification. Specifically, the identity information can be extracted from the request header in the request link data as the identity information used when the request accesses the application. Then the target interface can be called to obtain the real identity corresponding to the requester who initiated the request, and the consistency verification of the request is completed by verifying the similarity between the identity information extracted from the request link data and the acquired real identity. If the verification finds that the identity information of the request is inconsistent with the real identity, it indicates that the request has the possibility of identity fraud. At this time, the request can be regarded as an abnormal request, and its detection result is determined to be unsuccessful, without subsequent processing, and there is no need to return the response information corresponding to the request to the requester. Alternatively, an alarm message corresponding to the reason why the request detection fails can also be generated, and the alarm message is returned to the requester. If the verification finds that the identity information of the request is consistent with the real identity, it indicates that the identity consistency verification of the request passes, and subsequent detection steps can be performed on it. It should be noted that, in the case of passing the identity consistency verification, whether to perform subsequent detection on the request and which subsequent detection items are performed on it are not specifically limited in the embodiment of the present disclosure, and can be based on actual needs in actual applications.

[0060] In a possible implementation, if the identity consistency check passes, it can be determined whether the request has accessed sensitive data in the application. Specifically, it can be determined whether the response information in the request link data corresponding to the request includes sensitive data. When determining whether the response information includes sensitive data, the determination can be made based on preset sensitive fields. For example, it can be identified whether the response information in the request link data includes name, age, identity document data, recognizable personal image, etc.; when it is identified that these sensitive fields or specific data under these sensitive fields exist in the response information, it can be regarded as including sensitive data in the response information. It should be noted that the various sensitive fields described above are only used to illustrate the scheme of the embodiment of the present disclosure, and do not constitute an improper limitation on the present invention. In addition, the above method for determining whether sensitive data exists is also only used as an example of a possible implementation in the embodiment of the present disclosure. In actual applications, any judgment method that meets the requirements can be set according to actual conditions and requirements. The embodiment of the present disclosure does not make specific limitations on this, and its function can be realized.

[0061] In an embodiment of the present disclosure, in response to the absence of sensitive data in the request link data, a detection result of the request is determined according to a consistency verification result.

[0062] In a specific implementation, if the response information does not include sensitive data, the consistency check result can be used as the result of the request detection, that is, the detection result of the request is regarded as passed; alternatively, additional detection can be performed on the request information, SQL execution statements and other information in the request link data corresponding to the request, and the final detection result of the request can be determined based on the detection results of these additional tests.

[0063] If the response information includes sensitive data, the request can be detected based on the identity information and access information in the request link data. Specifically, the request can be detected based on the identity information and access information in the request link data, and what kind of access identity can access what kind of data as specified in the detection policy. For example, suppose the detection policy stipulates that user A can only access sensitive data in database table 1 and database table 2 with an intermediate access level; and the request link data corresponding to the request initiated by user A indicates that user A has accessed sensitive data in database table 3 with an advanced permission level. At this time, the request initiated by user A triggers vertical overreach, and the result of its request detection can be regarded as failed. Similarly, when the request link data corresponding to the request initiated by user A indicates that user A has accessed sensitive data in database table 4 with an intermediate permission level corresponding to user B, the request initiated by user A triggers horizontal overreach, and the result of its request detection can be regarded as failed. Alternatively, suppose user C does not have permission to access any data in the current database, but through the request link data corresponding to the request initiated by the client, it is found that he attempts to access data in the current database. At this time, regardless of whether the data he accesses is sensitive data, the detection result of the request can be judged as not passed, that is, the request triggers an unauthorized access. It should be noted that the above-mentioned unauthorized behavior that can be detected is only used as an example of possible implementation methods in the embodiments of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, request link data and detection strategies can be used to detect any authorization behavior for applications or business systems. The embodiments of the present disclosure are not specifically limited, and their functions shall be realized.

[0064] In another possible implementation, in addition to detecting whether the response information in the request link data includes sensitive data, the request information, SQL execution statement and other information in the request link data corresponding to the request may also be detected. When all items that need to be detected are judged to have passed, the detection result of the request may be considered to have passed. If one of the detection results fails, or there are detection items that have not passed in certain detection items that must be passed, the detection result of the request may be considered to have failed. It should be noted that the embodiments of the present disclosure do not specifically limit the specific detection items and the rules for determining whether the detection has passed. In actual applications, it can be based on actual needs and be based on the ability to achieve its functions.

[0065] It should be noted that the embodiments of the present disclosure do not specifically limit the detection order of the above-mentioned identity consistency verification, sensitive data judgment, and SQL execution statement analysis. The execution order described above is only a feasible implementation method in the embodiments of the present disclosure, and does not constitute an improper limitation on the present invention. In actual applications, the detection order and detection items can be adjusted according to actual needs. The embodiments of the present disclosure do not specifically limit this, and the functions can be realized.

[0066] In an embodiment of the present disclosure, in response to the detection result of the request being failed, an alarm message corresponding to the request is generated and the alarm message is returned to the requesting party; in response to the detection result of the request being passed, response information corresponding to the request in the request link data is returned to the requesting party.

[0067] In a specific implementation, if the detection result of the request is a failure, a corresponding alarm message can be generated according to the failed detection items and specific reasons, and then the alarm message can be returned to the requester. If the detection result of the request is a pass, the response information in the request link data can be returned to the requester as the response information corresponding to the request initiated by the requester. Thus, the disclosed embodiment can realize timely detection and real-time detection of requests, and can timely discover and respond to unauthorized behaviors that occur in real time. When the detection fails, the real response data will not be returned to the requester, and the real response data will only be returned to the requester when the detection passes; it solves the problem in the prior art that the request can only be detected after the application or business system has been attacked, thereby ensuring the security of the application or business system and reducing the possibility of the application or business system being attacked.

[0068] In addition, a request detection report may be generated, which may include the items to be detected and the detection results of each item. When an alarm message or a response message is returned to the requesting party, the detection report may also be returned to the requesting party.

[0069] In another possible implementation, in order to minimize the load of the execution subject of the embodiment of the present disclosure and ensure the performance of the business system, when the detection result of the request fails, it can also be sent to the module or device associated with the execution subject of the embodiment of the present disclosure so that it can perform subsequent processing on these abnormal requests. It should be noted that the embodiment of the present disclosure does not specifically limit the subsequent processing method for requests that fail the detection, and it can be set according to needs in actual applications.

[0070] According to a second aspect of the embodiment of the present disclosure, Figure 3 As shown, a request detection device 300 is provided, comprising:

[0071] The receiving module 301 is used to receive a request initiated by a requester for a preset operation function of an application program;

[0072] A determination module 302, configured to determine request link data corresponding to the request;

[0073] The detection module 303 is used to detect the request for link data according to the detection strategy configured for the preset operation function.

[0074] Optionally, the determination module 302 is specifically configured to:

[0075] Based on the pre-injected bytecode, a tracking marker is added to the request when a request for a preset operation function is received;

[0076] Based on the trace flag, request link data corresponding to the request is determined.

[0077] Optionally, the detection module 303 is specifically used for:

[0078] Call the target interface to obtain the real identity of the requester who initiated the request;

[0079] Verify the consistency between the real identity and the identity information in the request link data. If the consistency verification passes, determine whether the response information includes the preset sensitive data based on the response information in the request link data.

[0080] In response to the response information including preset sensitive data, the request is detected according to the detection strategy configured for the preset operation function and the identity information and access information in the request link data.

[0081] Optionally, the detection module 303 is further configured to:

[0082] In response to the absence of sensitive data in the request link data, a detection result of the request is determined according to the consistency verification result.

[0083] Optionally, the determination module 302 is further configured to:

[0084] In response to an editing operation on the detection strategy, the detection strategy is updated; wherein the detection strategies configured for different preset operation functions are different.

[0085] Optionally, the detection module 303 is further configured to:

[0086] In response to the detection result of the request being failed, generating alarm information corresponding to the request, and returning the alarm information to the requester;

[0087] In response to the detection result of the request being passed, response information corresponding to the request in the request link data is returned to the requesting party.

[0088] According to the third aspect of an embodiment of the present disclosure, an electronic device requesting detection is provided, comprising: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by one or more processors, the one or more processors implement the method provided by the first aspect of the embodiment of the present invention.

[0089] According to a fourth aspect of an embodiment of the present disclosure, a computer-readable medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method provided by the first aspect of the embodiment of the present disclosure is implemented.

[0090] According to a fifth aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, and the computer program implements the method of any of the above embodiments when executed by a processor.

[0091] Figure 4 An exemplary system architecture 400 is shown to which the request detection method or request detection apparatus implemented by the present disclosure can be applied.

[0092] like Figure 4 As shown, system architecture 400 may include terminal devices 401, 402, 403, network 404 and server 405. Network 404 is used to provide a medium for communication links between terminal devices 401, 402, 403 and server 405. Network 404 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0093] Users can use terminal devices 401, 402, 403 to interact with server 405 through network 404 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 401, 402, 403, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0094] The terminal devices 401 , 402 , and 403 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0095] The server 405 may be a server that provides various services, such as a background management server (only as an example) that provides support for shopping websites browsed by users using the terminal devices 401, 402, and 403. The background management server may process the received request detection request and feed back the processing result (only as an example) to the terminal device.

[0096] It should be noted that the request detection method provided in the embodiment of the present invention is generally executed by the server 405, and accordingly, the request detection device is generally set in the server 405. The request detection method provided in the embodiment of the present invention can also be executed by the terminal devices 401, 402, 403, and accordingly, the request detection device can be set in the terminal devices 401, 402, 403.

[0097] It should be understood that Figure 4 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0098] Reference below Figure 5 , which shows a schematic diagram of the structure of a computer system 500 of a terminal device suitable for implementing an embodiment of the present invention. Figure 5 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0099] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0100] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0101] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-mentioned functions defined in the system of the present invention are executed.

[0102] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0103] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0104] The modules involved in the embodiments of the present invention may be implemented in software or hardware. The modules described may also be set in a processor. For example, a processor includes a receiving module, a determining module, and a detecting module, wherein the names of these modules do not constitute a limitation on the modules themselves in certain cases. For example, the receiving module may also be described as a "receiving request module initiated by the requesting party for the preset operation function of the application program".

[0105] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device implements the following method: receiving a request initiated by a requester for a preset operation function of an application; determining request link data corresponding to the request; and detecting the request according to the detection strategy configured for the preset operation function and the request link data.

[0106] Finally, it should be noted that the above embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure is described in detail with reference to the above embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above embodiments within the technical scope disclosed in the present disclosure, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A request detection method, characterized in that: include: Receiving a request initiated by a requester for a preset operation function of an application; determining request link data corresponding to the request; The request is detected according to the detection strategy configured for the preset operation function and the request link data.

2. The method according to claim 1, characterized in that: Determining request link data corresponding to the request, including: Based on the pre-injected bytecode, when receiving a request initiated for a preset operation function, a tracking tag is added to the request; Based on the tracking flag, request link data corresponding to the request is determined.

3. The method according to claim 1, characterized in that Detecting the request according to the detection strategy configured for the preset operation function and the request link data, including: Calling the target interface to obtain the real identity of the requester who initiated the request; Verify the consistency between the real identity and the identity information in the request link data, and if the consistency verification passes, determine whether the response information includes preset sensitive data according to the response information in the request link data; In response to the response information including preset sensitive data, the request is detected according to the detection strategy configured for the preset operation function and the identity information and access information in the request link data.

4. The method according to claim 3, characterized in that The method further comprises: In response to the absence of sensitive data in the request link data, determining a detection result of the request according to the consistency verification result.

5. The method according to claim 1, characterized in that The method further comprises: In response to an editing operation on the detection strategy, the detection strategy is updated; wherein the detection strategies configured for different preset operation functions are different.

6. The method according to claim 1, characterized in that After detecting the request, the method further includes: In response to the detection result of the request being failed, generating alarm information corresponding to the request, and returning the alarm information to the requester; In response to a detection result of the request being passed, response information corresponding to the request in the request link data is returned to the requesting party.

7. A request detection device, characterized in that: include: A receiving module, used for receiving a request initiated by a requester for a preset operation function of an application program; A determination module, used to determine the request link data corresponding to the request; A detection module is used to detect the request according to the detection strategy configured for the preset operation function and the request link data.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 6.

Images