Client service attack defense method and device based on active interference strategy

Abstract

The invention discloses a client service attack defense method and device based on an active interference strategy, and belongs to the technical field of network security, and the method comprises the steps: S1, arranging a bait file of active interference, configuring a fishing trap according to a scene, and carrying out the encryption storage of the bait file configured with the fishing trap; s2, loading the bait file in a negotiation cache mode; s3, the client encapsulates a fishing trap to carry out instrumentation fishing, and intercepts a network request to carry out client service attack detection; and S4, defending the detected client service attack. According to the method, the bait file is deployed, encrypted storage and loading are performed on the bait file configured with a fishing trap, and then defense is performed by using an instrumentation type attack detection mechanism of the client, so that the client service attack defense method based on an active interference strategy is formed, and the security of the client can be protected to the greatest extent.

Description

Technical Field

[0001] The invention relates to a client service attack defense method and device based on an active interference strategy, belonging to the technical field of network security. Background Art

[0002] Cyber ​​Security refers to the protection of the hardware, software and data of the network system from damage, change or leakage due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system and uninterrupted network services.

[0003] In recent years, attacks on Internet systems (mobile banking, online banking) have emerged one after another, and mobile banking has become a hard-hit area. In particular, the rise of malicious ROOMs and facial recognition technology has exacerbated the risks of mobile banking. For this reason, we have introduced a client environment perception mechanism based on client reinforcement, obfuscation, and business data confidentiality and integrity protection. By real-time perception of abnormal client operating environments, such as Android ROOT, IOS jailbreak, malicious ROM flashing, black industry attack frameworks and other unsafe environments, we can perceive hacker attacks, black and gray industry wool-pulling behaviors, financial phishing fraud and other threats in real time. We have completed the construction of perception capabilities from 0 to 1 and made up for the shortcomings of security protection capabilities.

[0004] However, the perception technology is derived from the attack technology that has occurred or has been made public, and there is a lag. Moreover, as the technology matures and new technologies continue to emerge, the perception means are at risk of being bypassed. Therefore, the present invention proposes a client service attack defense method and device based on an active interference strategy. Summary of the invention

[0005] In order to solve the above problems, the present invention proposes a client service attack defense method and device based on an active interference strategy, which adds active trapping on the basis of perception, and can further improve the security of the client.

[0006] The technical solution adopted by the present invention to solve the technical problem is: In a first aspect, an embodiment of the present invention provides a client service attack defense method based on an active interference strategy, comprising the following steps: Step S1, arranging a bait file for active interference, configuring a fishing trap according to a scenario, and encrypting and storing the bait file for configuring the fishing trap; Step S2, loading the bait file using a negotiated cache method; Step S3: The client encapsulates a phishing trap to perform plugging and throwing, and intercepts network requests to perform client service attack detection; Step S4: defend against the detected client service attack.

[0007] As a possible implementation of this embodiment, step S1 includes: Configuring fishing fields for bait files according to scenarios, wherein the bait files are managed by a gateway; The bait file is encrypted and stored, and pushed to the CDN (Content Delivery Network) for the client to pull.

[0008] As a possible implementation of this embodiment, step S2 includes: When the client starts, it pulls the CDN to configure the bait file, parses it and stores it in the cache; When the gateway service starts, the decoy file is loaded, stored in the cache, and a real-time refresh mechanism is provided.

[0009] As a possible implementation of this embodiment, step S4 includes: When the gateway is detected to be attacked, the attacker is added to the blacklist and an alarm is issued; If the attacker initiates a request again, the blacklist is hit, the request is blocked, and an abnormal prompt is returned; If an attacked request is detected, it will not be blocked.

[0010] As a possible implementation of this embodiment, the phishing trap includes a client function trap, and the step S3 includes: The client encapsulates the phishing trap plug-in and the surface layer, intercepts the H5 request to enter the service routing layer, and the routing layer identifies the real function and the phishing trap function according to the function trap dictionary library, and marks the real function in the context; The routing layer calls the real function and the phishing trap function respectively. Once the phishing trap function is called, it is attacked. The phishing trap function is placed in the client cache, and the phishing trap function records the attacked identifier; Check whether any function has been hijacked in the real function. If so, report it to the phishing server and put the identifier in the business data packet for reporting.

[0011] As a possible implementation of this embodiment, the phishing trap may include a client service data trap, and step S3 includes: The client encapsulates the phishing trap and inserts it on the surface layer, intercepts H5 requests or the client's own requests, and embeds some fields that do not conform to normal business logic in the HTTP header and request body of the specified business request according to the business data trap dictionary library. Once it is detected that an attacker has tampered with the above fields, an alarm and blocking disposal will be issued.

[0012] As a possible implementation of this embodiment, the fields that do not conform to normal business logic include user number, session credentials, SMS receiving mobile phone number, and incorrect date format.

[0013] In a second aspect, an embodiment of the present invention provides a client service attack defense device based on an active interference strategy, comprising: A bait file configuration module, used to arrange bait files for active interference, configure fishing traps according to scenarios, and encrypt and store the bait files for configuring fishing traps; A bait file loading module, used to load the bait file in a negotiated cache manner; The trap plug-in fishing module is used to encapsulate phishing traps on the client side for plug-in fishing and intercept network requests for client business attack detection; The attack defense module is used to defend against detected client business attacks.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform any step of the above-mentioned client service attack defense method based on the active interference strategy.

[0015] In a fourth aspect, an embodiment of the present invention provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned client service attack defense methods based on the active interference strategy are executed.

[0016] The beneficial effects of the technical solution of the embodiment of the present invention are as follows: The technical solution of the embodiment of the present invention is a client service attack defense method based on an active interference strategy, comprising the following steps: step S1, arranging a bait file for active interference, configuring a fishing trap according to the scenario, and encrypting and storing the bait file for configuring the fishing trap; step S2, loading the bait file by using a negotiated cache method; step S3, the client encapsulates the fishing trap to perform plug-in fishing, intercepts the network request to perform client service attack detection; step S4, defends against the detected client service attack. The present invention deploys the bait file, encrypts and stores the bait file for configuring the fishing trap, loads it, and then uses the plug-in attack detection mechanism of the client to defend against it, thus forming a client service attack defense method with an active interference strategy, which can protect the security of the client to the greatest extent.

[0017] A client service attack defense device based on an active interference strategy according to the technical solution of an embodiment of the present invention has the same beneficial effects as a client service attack defense method based on an active interference strategy according to the technical solution of an embodiment of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 is a flow chart of a client service attack defense method based on an active interference strategy according to an exemplary embodiment; Figure 2 The diagram is a schematic diagram of the structure of a client service attack defense device based on an active interference strategy according to an exemplary embodiment. DETAILED DESCRIPTION

[0019] In order to more clearly illustrate the technical features of the solution of the present invention, the present invention is described in detail below through specific implementation methods and in conjunction with the accompanying drawings.

[0020] Example 1 like Figure 1 As shown, a client service attack defense method based on an active interference strategy provided by an embodiment of the present invention includes the following steps: Step S1, arrange the bait file of active interference, configure the fishing trap according to the scene, and encrypt and store the bait file of the configured fishing trap.

[0021] Specifically, step S1 includes: Configuring fishing fields for bait files according to scenarios, wherein the bait files are managed by a gateway; The bait file is encrypted and stored, and pushed to the CDN for the client to pull.

[0022] Step S2, loading the bait file using a negotiated cache method.

[0023] Specifically, step S2 includes: When the client starts, it pulls the CDN to configure the bait file, parses it and stores it in the cache; When the gateway service starts, the decoy file is loaded, stored in the cache, and a real-time refresh mechanism is provided.

[0024] Using the negotiation cache method to load bait files can improve the performance and efficiency of the system and avoid frequent file reading and parsing operations.

[0025] Step S3: The client encapsulates a phishing trap to perform plug-in fishing and intercepts network requests to perform client service attack detection.

[0026] The phishing trap is a client function trap. Specifically, step S3 includes: The client encapsulates the phishing trap plug-in and the surface layer, intercepts the H5 request to enter the service routing layer, and the routing layer identifies the real function and the phishing trap function according to the function trap dictionary library, and marks the real function in the context; The routing layer calls the real function and the phishing trap function respectively. Once the phishing trap function is called, it is attacked. The phishing trap function is placed in the client cache, and the phishing trap function records the attacked identifier; Check whether any function has been hijacked in the real function. If so, report it to the phishing server and put the identifier in the business data packet for reporting.

[0027] This plug-in attack detection method can effectively reduce the risk of system attacks.

[0028] Step S4: defend against the detected client service attack.

[0029] By timely defending against attack behaviors, the security of the system can be protected to the greatest extent. Specifically, step S4 includes: When the gateway is detected to be attacked, the attacker is added to the blacklist and an alarm is issued; If the attacker initiates a request again, the blacklist is hit, the request is blocked, and an abnormal prompt is returned; If an attacked request is detected, it will not be blocked.

[0030] This embodiment arranges active interference bait files to encrypt, store, load, encapsulate, insert, and defend the bait files that configure the phishing trap, thereby effectively preventing the client business from being attacked.

[0031] like Figure 2 As shown, an embodiment of the present invention provides a client service attack defense device based on an active interference strategy, comprising: A bait file configuration module, used to arrange bait files for active interference, configure fishing traps according to scenarios, and encrypt and store the bait files for configuring fishing traps; A bait file loading module, used to load the bait file in a negotiated cache manner; The trap plug-in fishing module is used to encapsulate phishing traps on the client side for plug-in fishing and intercept network requests for client business attack detection; The attack defense module is used to defend against detected client business attacks.

[0032] The technical solution of this embodiment can be applied to systems with high requirements for business application security, such as financial business mobile banking, online banking, and WeChat banking, and can also be used in payment application systems.

[0033] Taking the mobile banking system solution as an example, the specific implementation process of this embodiment is introduced below.

[0034] 1.1 Overall architecture implementation.

[0035] 1.1.1 Fishing configuration.

[0036] (1) The configuration file is managed by the gateway, and the fishing field is configured according to the scenario; (2) The configuration file is encrypted and stored, and pushed to the CDN for the client to pull.

[0037] 1.1.2 Configuration file negotiation and loading.

[0038] (1) When the client starts, it pulls the CDN configuration file, parses it and stores it in the cache; (2) When the gateway service starts, it loads the configuration, stores the cache, and provides a real-time refresh mechanism.

[0039] 1.1.3 Fishing trap stakes.

[0040] (1) The client encapsulates the phishing plug-in and the surface layer, intercepts the H5 request and enters the service routing layer. The routing layer identifies the real function and the phishing trap function according to the phishing trap dictionary library, and marks the real function in the context; (2) The routing layer calls the real function and the trap function respectively. Once the trap function is called, it is attacked. The attack flag is recorded in the trap function and placed in the client cache. (3) Check whether any function has been hijacked in the real function. If so, report it to the phishing server and put the identifier in the business data packet for reporting.

[0041] 1.1.4 Phishing inspection.

[0042] (1) When the gateway identifies that it is under attack, it adds the attacker to the blacklist and issues an alarm; (2) If the attacker initiates a request again, the blacklist is hit, the request is blocked, and an abnormal prompt is returned; (3) Do not block requests that are identified as being attacked.

[0043] 1.2 Fishing trap.

[0044] When assembling, encrypting, and sending user business data, the client no longer passes it through the function's input and output parameters, but first puts the received front-end incoming data into the context through the router and passes it through the upload document. The pseudo implementation is as follows: (1) Define the thread-level context.

[0045] (2) Define a router to receive the business data functions passed in by the front end and filter out the functions that really need to be executed according to the phishing trap dictionary library and mark them in the context. Finally, call the true and false functions respectively.

[0046] (3) Real function.

[0047] (3.1) Obtain the hijacking flag of the client function and determine whether it has been hijacked. If it has been hijacked, report the user information to the server and put the flag in the business message header for secondary verification by the server. If it has not been hijacked, do nothing. (3.2) Assemble the service request message, which includes HTTP header, service header and service body; (3.3) Encrypt and send the request message. The business data exchanged during the process is stored in the context.

[0048] (4) Trap function.

[0049] The trap function records that the current function is called, and puts the called identifier into the client cache for the real function to call.

[0050] 1.3 Fishing dictionary library configuration.

[0051] The configuration file is in JSON format, and the trap field configuration content is written in Java as follows: { "Trap configuration file version number": "Used to be compatible with different client versions", "Client Function Trap": { / / Real function list, the design supports configuring multiple { "Effective channel": "Distinguish different clients that access", "Client version": "The received client version, this version and above are effective, multiple values ​​can be configured", / / Request header fishing field "List of trap functions corresponding to real functions": [ “Trap Function 1”: { Function parameters: { "Parameter 1": "Value 1, can be empty, if empty it is considered as the actual value passed in by the caller", "Parameter 2": "Value 2, if it is empty, it is considered the actual value passed in by the caller", }, “Function output parameter”: { "Parameter 1": "Value 1, can be empty, if empty, no return", "Parameter 2": "Value 2, can be empty, if empty, no return", } }, “Trap Function 2”: { Function parameters: { "Parameter 1": "Value 1, can be empty, if empty it is considered as the actual value passed in by the caller", "Parameter 2": "Value 2, if it is empty, it is considered the actual value passed in by the caller", }, “Function output parameter”: { "Parameter 1": "Value 1, can be empty, if empty, no return", "Parameter 2": "Value 2, can be empty, if empty, no return", } }, ..... ] } }.

[0052] 1.4 The configuration file is encrypted using the national encryption algorithm.

[0053] 1.5 Interactive response strategy.

[0054] (1) The phishing trap dictionary library is encrypted and pushed to the CDN. When the client starts, it pulls and parses the configuration file, extracts the [Client Function Trap] content, stores it in the cache, and calls it on demand when a business request is sent.

[0055] (2) After the client receives the business parameters input by the user, it obtains the real function and trap function according to the current [Client Function Trap] and calls them respectively.

[0056] (3) After receiving the client request, the gateway checks whether there is an attack. If so, it records the current user information (such as login account, device information, etc.) and notifies the operation and maintenance personnel through SMS and other means, and responds to the request normally without blocking the handling, to prevent attackers from easily guessing and triggering the trap.

[0057] (4) If the user who triggered the trap initiates a request again, it will be blocked.

[0058] 1.6 Testing and optimization.

[0059] (1) Internal testing: Conduct internal attack testing before deployment to verify the luring effect of the phishing trap function. If problems are found, adjust the design in a timely manner to avoid affecting normal users or having no actual effective effect on attackers.

[0060] (2) Continuous optimization: Based on the actual attack data and feedback in the cloud center, the trap dictionary library is continuously optimized and adjusted to improve the trapping efficiency and intelligence value of the trap function.

[0061] This embodiment embeds some sensitive and confusing trap functions in the client to confuse attackers and induce them to hijack the trap functions to tamper with the function input and output. Active trapping is added on the basis of perception, and the synergy of perception and phishing traps is used to capture black factory attackers to the greatest extent, further improving the security of the client.

[0062] The client function trap mechanism of this embodiment is as follows: the client pre-makes trap functions for some key functions (such as request message assembly and encryption function), and calls the real function and the trap function at the same time, which increases the difficulty for attackers to hijack the function. When the attacker hijacks the trap function, the attacker's attack behavior is recorded and sent to the server, which then issues an alarm, blocks the function, and takes other actions.

[0063] This embodiment uses the phishing trap solution to capture some black factory attackers who bypass passive perception and tamper with trap data, thereby reducing the losses of users and banks.

[0064] Example 2 like Figure 1 As shown, a client service attack defense method based on an active interference strategy provided by an embodiment of the present invention includes the following steps: Step S1, arrange the bait file of active interference, configure the fishing trap according to the scene, and encrypt and store the bait file of the configured fishing trap.

[0065] Specifically, step S1 includes: Configuring fishing fields for bait files according to scenarios, wherein the bait files are managed by a gateway; The bait file is encrypted and stored, and pushed to the CDN for the client to pull.

[0066] Step S2, loading the bait file using a negotiated cache method.

[0067] Specifically, step S2 includes: When the client starts, it pulls the CDN to configure the bait file, parses it and stores it in the cache; When the gateway service starts, the decoy file is loaded, stored in the cache, and a real-time refresh mechanism is provided.

[0068] Using the negotiation cache method to load bait files can improve the performance and efficiency of the system and avoid frequent file reading and parsing operations.

[0069] Step S3: The client encapsulates a phishing trap to perform plug-in fishing and intercepts network requests to perform client service attack detection.

[0070] The phishing trap is a client service data trap. Specifically, step S3 includes: The client encapsulates the phishing trap and inserts the surface layer, intercepts H5 requests or client requests, and embeds some fields that do not conform to normal business logic in the HTTP header and request body of the specified business request according to the business data trap dictionary library. Once the attacker tampers with the above fields, an alarm and blocking will be issued. The fields that do not conform to normal business logic include user number, session credentials, SMS receiving mobile phone number, and incorrect date format.

[0071] This plug-in attack detection method can effectively reduce the risk of system attacks.

[0072] Step S4: defend against the detected client service attack.

[0073] By timely defending against attack behaviors, the security of the system can be protected to the greatest extent. Specifically, step S4 includes: When the gateway is detected to be attacked, the attacker is added to the blacklist and an alarm is issued; If the attacker initiates a request again, the blacklist is hit, the request is blocked, and an abnormal prompt is returned; If an attacked request is detected, it will not be blocked.

[0074] This embodiment arranges active interference bait files to encrypt, store, load, encapsulate, insert, and defend the bait files that configure the phishing trap, thereby effectively preventing the client business from being attacked.

[0075] like Figure 2 As shown, an embodiment of the present invention provides a client service attack defense device based on an active interference strategy, comprising: A bait file configuration module, used to arrange bait files for active interference, configure fishing traps according to scenarios, and encrypt and store the bait files for configuring fishing traps; A bait file loading module, used to load the bait file in a negotiated cache manner; The trap plug-in fishing module is used to encapsulate phishing traps on the client side for plug-in fishing and intercept network requests for client business attack detection; The attack defense module is used to defend against detected client business attacks.

[0076] The technical solution of this embodiment can be applied to systems with high requirements for business application security, such as financial business mobile banking, online banking, and WeChat banking, and can also be used in payment application systems.

[0077] Taking the mobile banking system solution as an example, the specific implementation process of this embodiment is introduced below.

[0078] 2.1 Overall architecture implementation.

[0079] 2.1.1 Fishing configuration.

[0080] (1) The configuration file is managed by the gateway, and the fishing field is configured according to the scenario; (2) The configuration file is encrypted and stored, and pushed to the CDN for the client to pull.

[0081] 2.1.2 Configuration file negotiation and loading.

[0082] (1) When the client starts, it pulls the CDN configuration file, parses it and stores it in the cache; (2) When the gateway service starts, it loads the configuration, stores the cache, and provides a real-time refresh mechanism.

[0083] 2.1.3 Fishing trap stakes.

[0084] The client encapsulates phishing plug-ins and the surface layer, intercepts H5 or the client's own requests, and inserts some fields that do not conform to normal business logic into the HTTP header and request body of the specified business request according to the trap dictionary library, such as user number, session credentials, SMS receiving mobile phone number, wrong date format, etc. Once the attacker tampers with the above fields, the server can detect it in real time and take measures such as alarm and blocking.

[0085] 2.1.4 Phishing inspection.

[0086] (1) When the gateway identifies that it is under attack, it adds the attacker to the blacklist and issues an alarm; (2) If the attacker initiates a request again, the blacklist will be hit, the request will be blocked and an abnormal prompt will be returned; (3) Do not block requests that are identified as being attacked.

[0087] 2.2 Fishing trap.

[0088] The design of the phishing trap field must be so realistic that the attacker cannot tell which is the phishing trap field. To this end, the phishing trap field must meet the following conditions: a. "Occurrence range": add phishing trap fields to HTTP header, service header and service body; b. "Authenticity": field naming meets actual business needs and has business meaning; c. "Scenario-based": fields are named according to transaction scenarios, and different fields are different for different scenarios; d. "Randomization": field values ​​can be changed and cannot be fixed, otherwise it will be easy to guess.

[0089] 2.2.1 Public header part.

[0090] The HTTP header adds public, easy-to-guess and easy-to-crack trap fields that are irrelevant to the business, such as session credentials, user ID, client IP, device fingerprint, etc., to lure black market attackers to tamper with it.

[0091] 2.2.2 Business scenario section.

[0092] (1) It consists of three parts: HTTP header, business header, and business body. They can be plugged in according to the business interface, achieving the purpose of dynamic change and scenario-based, thereby increasing the cost of attack.

[0093] (2) Each part of the plug-in field is configured according to the trap dictionary library. The trap dictionary library is based on API interfaces, such as the password login interface: (2.1) Password login interface name; (2.2) Add [SMS verification code receiving mobile phone number] to the business body, and the value is the login mobile phone number; (2.3) Add [Is the device bound] to the business body, with a value of N, indicating that the device is not bound; (2.4) Add [Start Date] in the business body, and the value is in a special date format; (2.5) The interface plug-in method for other services such as registration, transfer, recharge, etc. is the same as the password login interface.

[0094] 2.3 Fishing dictionary library configuration.

[0095] The configuration file is in JSON format, and the trap field configuration content is written in Java as follows: { "Trap configuration file version number": "The configuration file can add non-attribute fields. These fields may need to rely on the client to parse, so the version number is added to identify which client version the configuration file is effective for. For example, v1.0.0.0, the following configuration is effective for the v1.0.0.0 version client." “Client Business Data Trap”: { / / Interface list, multiple interfaces can be configured { / / Interface name, the client adds a trap field based on the interface name, and the gateway checks the trap based on the interface name "Interface Name 1": "API Name 1 for External Services", "Effective channel": "Distinguish different clients that access", "Client Version": "Used to specify that the interface configuration information is effective in the specified version and above, and multiple values ​​can be configured". / / Request header fishing field HTTP Header Section: { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, "Business Header": { { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, "Business body": { { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, }, { "Interface Name 2": "API Name 2 for External Services", "Effective channel": "Distinguish different clients that access", "Client Version": "Used to specify that the interface configuration information is effective in the specified version and above, multiple values ​​can be configured", "HTTP Header Part": { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, "Business Header": { { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, "Business body": { { Trap Field 1: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } “Fishing Field 2”: { "Trap field value source mapping field": "Get the value of the mapping field or the processed mapping field value", / / If the mapping field is not set, the default value is used. Multiple default values ​​can be configured, and one of them is randomly selected each time. "Default value": ["Default value 1","Default value 2","Default value"...] } }, }, / / Other interface configurations, the configuration format is consistent with [Interface Name 1] and [Interface Name 2], and can be configured according to actual business needs. Multiple interface information can be configured. ...... } }, / / Other trap configurations, such as client function phishing trap configuration, shared trap configuration files, reduced files and front-end and back-end parsing file logic, }.

[0096] 2.4 The configuration file is encrypted using the national encryption algorithm, and the key is the key agreed upon by the front-end and back-end.

[0097] 2.5 Interactive response strategy.

[0098] (1) The phishing trap dictionary library is encrypted and pushed to the CDN. When the client starts, it pulls and parses the configuration file, extracts the [Client Business Data Trap] content and stores it in the cache, and then inserts it on demand when sending a business request.

[0099] (2) After the client receives the business parameters entered by the user, it queries the [Client Business Data Trap] according to the interface name of the current request, and inserts the trap field according to the dictionary library if necessary.

[0100] (3) After receiving the client request, the gateway checks whether the trap field has been tampered with according to the dictionary library. If it has been tampered with, it records the current user information (such as login account, device information, etc.) and notifies the operation and maintenance personnel through SMS and other means, and responds to the request normally without blocking the disposal, to prevent attackers from easily guessing the triggering trap.

[0101] (4) If the user who triggered the trap initiates a request again, it will be blocked.

[0102] 2.6 Testing and optimization.

[0103] (1) Internal testing: Conduct internal attack testing before deployment to verify the entrapment effect of the phishing trap field. If problems are found, adjust the design in a timely manner to avoid affecting normal users or having no actual effective effect on attackers.

[0104] (2) Continuous optimization: Based on the actual attack data and feedback in the cloud center, the trap dictionary library is continuously optimized and adjusted to improve the trapping efficiency and intelligence value of the trap field.

[0105] This embodiment embeds traps in the client and business data to confuse attackers and induce them to tamper with them. It adds active trapping on the basis of perception to further improve security. The present invention attracts potential attackers through carefully designed request message field traps, collects their attack behaviors and related data, provides early warning and intelligence support for security defense, and combines passive perception and active trapping to maximize client security.

[0106] The client business data trap mechanism of this embodiment is as follows: when the client receives the user's business request data, it embeds some fields that do not conform to normal business logic in the HTTP header and request body of the specified business request according to the trap dictionary library, such as user number, session credentials, SMS receiving mobile phone number, wrong date format, etc. Once an attacker tampers with the above fields, the server can detect it in real time and take measures such as alarm and blocking.

[0107] The present invention can capture some black factory attackers who bypass passive perception and tamper with trap data through the phishing trap solution, thereby reducing the losses of users and banks.

[0108] Example 3 An embodiment of the present invention provides an electronic device, including a processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor. When the electronic device is running, the processor communicates with the memory through the bus, and the processor executes the machine-readable instructions to perform any step of the above-mentioned client service attack defense method based on the active interference strategy.

[0109] Specifically, the above-mentioned memory and processor can be general-purpose memory and processor, which are not specifically limited here. When the processor runs the computer program stored in the memory, the above-mentioned client service attack defense method based on the active interference strategy can be executed.

[0110] Those skilled in the art will appreciate that the structure of the computer device does not constitute a limitation on the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently.

[0111] In some embodiments, the computer device may also include a touch screen that can be used to display a graphical user interface (e.g., a startup interface of an application) and receive user operations on the graphical user interface (e.g., startup operations on an application). The specific touch screen may include a display panel and a touch panel. The display panel may be configured in the form of LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. The touch panel may collect the user's contact or non-contact operations on or near it, and generate pre-set operation instructions, for example, the user uses any suitable object such as a finger, a stylus, or an accessory on or near the touch panel. In addition, the touch panel may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and posture, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into information that the processor can process, and then sends it to the processor, and can receive and execute commands from the processor. In addition, the touch panel can be implemented by various types such as resistive, capacitive, infrared and surface acoustic wave, and any technology developed in the future can also be used to implement the touch panel. Further, the touch panel can cover the display panel, and the user can operate on or near the touch panel covered on the display panel according to the graphical user interface displayed on the display panel. After the touch panel detects the operation on or near it, it is transmitted to the processor to determine the user input, and then the processor provides corresponding visual output on the display panel in response to the user input. In addition, the touch panel and the display panel can be implemented as two independent components or integrated.

[0112] Corresponding to the method for starting the above-mentioned application, an embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is run by a processor, the steps of any of the above-mentioned client service attack defense methods based on the active interference strategy are executed.

[0113] The application startup device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The device provided in the embodiment of the present application, its implementation principle and the technical effect produced are the same as those in the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0114] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0115] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0116] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0117] In addition, each functional module in the embodiments provided in the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0118] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0119] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0120] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A client service attack defense method based on active interference strategy, characterized in that: The steps include: Step S1, arranging a bait file for active interference, configuring a fishing trap according to a scenario, and encrypting and storing the bait file for configuring the fishing trap; Step S2, loading the bait file using a negotiated cache method; Step S3: The client encapsulates a phishing trap to perform plugging and throwing, and intercepts network requests to perform client service attack detection; Step S4: defend against the detected client service attack.

2. The client service attack defense method based on active interference strategy according to claim 1 is characterized in that: The step S1 comprises: Configuring fishing fields for bait files according to scenarios, wherein the bait files are managed by a gateway; The bait file is encrypted and stored, and pushed to the CDN for the client to pull.

3. The client service attack defense method based on active interference strategy according to claim 1 is characterized in that: The step S2 comprises: When the client starts, it pulls the CDN to configure the bait file, parses it and stores it in the cache; When the gateway service starts, the decoy file is loaded, stored in the cache, and a real-time refresh mechanism is provided.

4. The client service attack defense method based on active interference strategy according to claim 1 is characterized in that: The step S4 comprises: When the gateway is detected to be attacked, the attacker is added to the blacklist and an alarm is issued; If the attacker initiates a request again, the blacklist is hit, the request is blocked, and an abnormal prompt is returned; If an attacked request is detected, it will not be blocked.

5. The client service attack defense method based on active interference strategy according to any one of claims 1 to 4, characterized in that: The phishing trap includes a client function trap, and the step S3 includes: The client encapsulates the phishing trap plug-in and the surface layer, intercepts the H5 request to enter the service routing layer, and the routing layer identifies the real function and the phishing trap function according to the function trap dictionary library, and marks the real function in the context; The routing layer calls the real function and the phishing trap function respectively. Once the phishing trap function is called, it is attacked. The phishing trap function is placed in the client cache, and the phishing trap function records the attacked identifier; Check whether any function has been hijacked in the real function. If so, report it to the phishing server and put the identifier in the business data packet for reporting.

6. The client service attack defense method based on active interference strategy according to any one of claims 1 to 4, characterized in that: The phishing trap includes a client service data trap, and the step S3 includes: The client encapsulates the phishing trap and inserts it on the surface layer, intercepts H5 requests or the client's own requests, and embeds some fields that do not conform to normal business logic in the HTTP header and request body of the specified business request according to the business data trap dictionary library. Once it is detected that an attacker has tampered with the above fields, an alarm and blocking disposal will be issued.

7. The client service attack defense method based on active interference strategy according to claim 6 is characterized in that: The fields that do not conform to normal business logic include user number, session credentials, SMS receiving mobile phone number, and incorrect date format.

8. A client service attack defense device based on active interference strategy, characterized in that: include: A bait file configuration module, used to arrange bait files for active interference, configure fishing traps according to scenarios, and encrypt and store the bait files for configuring fishing traps; A bait file loading module, used to load the bait file in a negotiated cache manner; The trap plug-in fishing module is used to encapsulate phishing traps on the client side for plug-in fishing and intercept network requests for client business attack detection; The attack defense module is used to defend against detected client business attacks.

9. An electronic device, characterized in that: It includes a processor, a memory and a bus, the memory stores machine-readable instructions executable by the processor, when the electronic device is running, the processor and the memory communicate through the bus, and the processor executes the machine-readable instructions to perform the steps of the client service attack defense method based on the active interference strategy as described in any one of claims 1-7.

10. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, executes the steps of the client service attack defense method based on an active interference strategy as described in any one of claims 1 to 7.

Images