Network attack detection method and device and electronic equipment
Optimized network attack detection through hash query and detection term order matching, solving the problem of inefficiency in the existing technology, and achieving rapid detection and efficient processing of HTTP requests.
Patent Information
- Application Number
- CN202411357521.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-27
- Publication Date
- 2025-01-10
AI Technical Summary
In the prior art, network attack detection dependency rules matching leads to low efficiency, resulting in slow program operation speed and affects the ability to receive HTTP requests.
By querying the hash value of the access request in the cache hash value table, determining its cache status, and matching rules according to the matching order of the detection items, priority is given to matching detection items with high risk, reducing the number of matches in the rule base, and improving detection efficiency.
Simplify network attack detection, shorten detection time, improve detection efficiency, improve processing speed of HTTP requests, and avoid the increase in the number of matches caused by the final match of malicious feature detection terms.
Smart Images
Figure CN119299142A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network security technology, and more specifically, to a network attack detection method, device and electronic device. Background Art
[0002] With the continuous development of the Internet, especially the popularization of mobile Internet, people can now access the Internet anytime and anywhere. However, what comes with it is the increasingly serious Internet security problems caused by network attacks. A common way of network attacks is to send network requests carrying malicious commands / abnormal information to the target server to trick the target server into executing the corresponding malicious commands / processing abnormal information, thereby achieving the purpose of the attack. The relevant technology mainly completes attack detection through the principle of feature matching, mainly by traversing the rules to directly match the HTTP request content with the attack features. If the match is successful, it is considered that the request has an attack. This method is likely to cause the program to run slowly when the number of rules is large, and there are problems such as long attack detection time and affecting the ability to receive HTTP requests. Summary of the invention
[0003] In view of this, one of the technical problems solved by the embodiments of the present application is to provide a network attack detection method, device, and electronic device to solve the problem of low efficiency of network attack detection caused by direct reliance on rules for matching.
[0004] A first aspect of an embodiment of the present application discloses a network attack detection method, the method comprising:
[0005] determining a hash value of a pending access request;
[0006] The hash value is queried in a cache hash value table used to characterize attack-type access requests, and a cache status of the hash value is determined based on the query result;
[0007] If the cache status is not cached, determine the matching order for each detection item;
[0008] The detection data of the corresponding detection items in the access request are extracted in the matching order for rule matching, and the access request to be processed is processed accordingly according to the rule matching result.
[0009] Further, determining any rule hit by any access request within a recent predetermined time period includes:
[0010] If any to-be-matched rule is used to check the first detection item and the second detection item, determining first data for the first detection item and second data for the second detection item of any access request;
[0011] Matching the first data with any of the to-be-matched rules;
[0012] If the first data hits any of the to-be-matched rules, then determining the any of the to-be-matched rules as any of the rules hit by any of the access requests;
[0013] If the first data does not hit any of the rules to be matched, the second data is matched with the any of the rules to be matched, and when the second data hits any of the rules to be matched, the any of the rules to be matched is determined as any of the rules hit by the any of the access requests.
[0014] Furthermore, the matching order for different detection items is determined, including:
[0015] Determine the number of rule hits corresponding to each detection item based on a number of rules hit by a plurality of access requests in a recent predetermined time period;
[0016] According to the number of rule hits corresponding to each detection item, the risk probability of each detection item hitting the rule is determined;
[0017] Determine the matching order for different detection items in descending order of risk probability.
[0018] Further, the detection data of the corresponding detection items in the access request are extracted in the matching order to perform rule matching, and the access request to be processed is processed accordingly according to the rule matching result, including:
[0019] Based on two adjacent detection items, the detection data of the detection item that comes first in the access request is extracted and rule matching is performed;
[0020] If the detection data of the detection item that comes first in the order matches the rule, the access request is intercepted;
[0021] If the detection data of the detection item in the previous order does not hit the rule, the detection data of the detection item in the next order in the access request is extracted and the rule matching is performed, so as to perform corresponding processing on the access request to be processed according to the rule matching result.
[0022] Further, based on two adjacent detection items, the detection data of the detection item that comes first in the access request is extracted and rule matching is performed, including:
[0023] Matching the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request;
[0024] Determine whether the rule is hit based on the keyword matching results corresponding to the detection items that come first in order.
[0025] Further, determining the result of the rule hit judgment according to the keyword matching result corresponding to the detection item that comes first in order also includes:
[0026] If the keyword matching result corresponding to the detection item in the previous order is successful, the detection data of the detection item in the previous order in the access request is matched with the regular expression corresponding to the detection item in the previous order;
[0027] Determine whether the rule is matched based on the regular expression matching result.
[0028] Further, matching the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request includes:
[0029] Scanning the detection data of the detection items in the previous order according to the pre-configured decoding configuration file, the decoding configuration file includes decoding functions and decoding function configurations corresponding to multiple encoding formats, and the decoding function configuration includes a characteristic string, a terminator, and an identification of whether the characteristic string is case-sensitive;
[0030] If the scanned detection data includes a characteristic character string of a predetermined coding format, a decoding function for the predetermined coding format is called to perform decoding, and decoding is stopped when the end character of the predetermined coding format is scanned;
[0031] If the characteristic character string of the predetermined coding format is not scanned, a decoding function corresponding to the coding format pointed to by the scanned characteristic character string is called to perform decoding.
[0032] Further, extracting detection data of corresponding detection items in the access request according to the matching order to perform rule matching, and performing corresponding processing on the access request to be processed according to the rule matching result, further comprising:
[0033] If the rule matching result is a hit rule, the cache hash value table is updated according to the hash value of the access request to be processed.
[0034] A second aspect of an embodiment of the present application discloses a network attack detection device, the device comprising:
[0035] A check value determination module, used to determine a hash value of a pending access request;
[0036] A check value query module, used to query the hash value in a cache hash value table used to characterize attack-type access requests, and determine the cache status of the hash value based on the query result;
[0037] A detection item determination module, used for determining a matching order for each detection item if the cache status is not cached;
[0038] The detection item matching module is used to extract the detection data of the corresponding detection items in the access request according to the matching order to perform rule matching, and to perform corresponding processing on the access request to be processed according to the rule matching result.
[0039] The third aspect of the embodiment of the present application discloses an electronic device that includes a memory, a processor, and a computer program stored in memory and can be run on a processor, and the steps of implementing the above-mentioned method when the processor executes the computer program.
[0040] The fourth aspect of the embodiment of the present application discloses a computer readable storage medium, which stores a computer program and implements the above-mentioned steps when the computer program is executed by a processor.
[0041] The present application has the following advantages: by converting an access request into a hash value and querying it in a cached hash value table, it is determined whether the request is malicious, which simplifies the means of network attack detection, shortens the detection time and improves the detection efficiency, and preliminarily solves the problem of slow network attack speed; thereafter, under the condition that the hash value detection fails, the corresponding detection data is extracted according to the matching order of different detection items for rule matching, and the detection items with malicious characteristics and a high risk of hitting the rules can be matched first, avoiding the problem of increasing the number of matches with the rule base and reducing the recognition efficiency due to the detection items with malicious characteristics being matched last, thereby improving the matching efficiency and the processing speed of HTTP requests. BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Figure 1 A flowchart of a network attack detection method according to an embodiment of the present application;
[0043] Figure 2 A schematic diagram of a rule adopted by a network attack detection method provided in one embodiment of the present application;
[0044] Figure 3 This is a structural diagram of a network attack detection device according to an embodiment of the present application. DETAILED DESCRIPTION
[0045] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.
[0046] In order to illustrate the technical solution of the present application, a specific embodiment is provided below for illustration.
[0047] The present application embodiment discloses a network attack detection method, such as Figure 1 As shown, the method includes: step S101 to step S104.
[0048] Step S101: Determine the hash value of the access request to be processed.
[0049] In an embodiment of the present application, when an access request (i.e., an HTTP request based on the Hypertext Transfer Protocol) sent by a client (such as a browser) to a server is obtained, the present application does not directly parse the request and match it with the rules, but instead performs a hash operation to convert the HTTP request into a quantified hash value, thereby providing a quantified value for judging whether the access request is malicious in the subsequent rapid identification.
[0050] Specifically, the MD5 or SHA-1 algorithm can be used to process HTTP requests. When applied, the same hash algorithm can be used to create a hash value for the entire HTTP request, or the hash value created for the HTTP request header can be used as the final hash value, or the hash value created for the HTTP request body can be used as the final hash value; or different hash algorithms can be used to create hash values for the request header and request body respectively, and the result of splicing the hash values of the request header and request body can be used as the hash value of the HTTP request. For example, the hash value obtained by processing the request body using the SHA-256 hash function is used as the hash value of the HTTP request.
[0051] Step S102: querying the hash value in a cache hash value table used to characterize attack-type access requests, and determining the cache status of the hash value according to the query result.
[0052] In an embodiment of the present application, the cached hash value includes a predetermined number of hash values, and the records of these hash values are used to indicate that there have been recent access requests with the same attack characteristics requesting data from the server. In this way, in the case of network attack detection, there is no need to perform the operation of parsing the request and then using the rules for matching, so that the purpose of quickly identifying whether the HTTP request is malicious can be achieved, thereby improving the efficiency of attack detection.
[0053] In the embodiment of the present application, the cache status of the hash value is used to characterize whether the access request is a malicious request. Specifically, if the hash value of the access request is recorded in the cache hash value table, it indicates that the access request is a request recently sent by the client to the server for malicious access. Due to the limitation of the cache space size, if the hash value of the access request is not recorded in the cache hash value table, it only indicates that it is impossible to quickly identify whether the access request is malicious through the hash value, and further identification operations need to be performed.
[0054] In specific applications, malicious access requests within a certain period of time (such as the last minute) may be converted into hash values, and the converted hash values may be cached.
[0055] Step S103: if the cache status is not cached, determining the matching order for different detection items;
[0056] Specifically, the detection items may include a request header, a request body, and may further include various fields in the request header, such as a user agent UA, a local data cookie, a uniform resource locator URL, and the like.
[0057] In the embodiment of the present application, the matching order of different detection items is used to characterize the possibility of hitting the rule. The detection items with a higher order have a higher possibility of hitting the rule, while the detection items with a lower order have a lower possibility of hitting the rule.
[0058] Step S104: extracting detection data of corresponding detection items in the access request in a matching order to perform rule matching, and performing corresponding processing on the access request to be processed according to the rule matching result.
[0059] Specifically, if the detection data corresponding to the first detection item hits the rule, the rule matching can be stopped. Otherwise, the detection data corresponding to the later detection items will be matched with the rule in the matching order. For example, assuming that the detection items only include URL, UA and Cookie, and the matching order is URL>UA>Cookie, first extract the URL information of the current HTTP request to be processed for rule matching. If the match is successful, it indicates that this HTTP request is a malicious request and can be intercepted. If the match fails, the UA information of the HTTP request will be matched with the rule. If the match fails, the Cookie information of the HTTP request will continue to be matched with the rule. At this time, if the Cookie information fails to match, it indicates that the HTTP request does not have attack characteristics, and it will be provided with services, otherwise it will be intercepted.
[0060] The embodiment of the present application determines whether the request is malicious by converting the access request into a hash value and querying it in the cached hash value table, thereby simplifying the network attack detection means, shortening the detection time and improving the detection efficiency, and preliminarily solving the problem of slow network attack speed; then, under the condition that the hash value detection fails, the corresponding detection data is extracted according to the matching order of different detection items for rule matching, so that the detection items with malicious characteristics and high risk of hitting the rules can be matched first, avoiding the problem of increasing the number of matches with the rule base and reducing the recognition efficiency due to the detection items with malicious characteristics being matched last, thereby improving the matching efficiency and the processing speed of HTTP requests.
[0061] In some embodiments, step S103 further includes:
[0062] Step S1031: determining the number of rule hits corresponding to each detection item based on a number of rules hit by a plurality of access requests in a recent predetermined time period;
[0063] Step S1032: determining the risk probability of each detection item hitting the rule according to the number of rule hits corresponding to each detection item;
[0064] Step S1033: Determine the matching order for different detection items in descending order of risk probability.
[0065] In specific applications, the most recent period can be determined by retrieving the rule hit log records. For example, if there are 10,000 requests hitting the rule in the last minute, the hit-related information corresponding to different detection items can be obtained by analyzing the rules hit by these 10,000 requests, the rules hit by each request, and the specific detection items of the hit rule. For example, there are 10,000 requests in the last minute, some of which hit the rule by URL, and some of which hit the rule by UA. The fields of different request hit rules are different.
[0066] In the embodiment of the present application, the least recently used algorithm LRU is used to analyze the fields of the access requests that hit the rules in the recent period of time, so as to obtain the number of detection items that hit the rules recently, and then calculate the probability according to the number of times. When applied, other cache elimination algorithms can also be used, such as the least frequently used page replacement algorithm LFU, the adaptive cache replacement algorithm ARC, the first-in-first-out algorithm FI FO, etc. When applied specifically, the risk probability of different detection items hitting the rules can be determined based on the ratio of the number of times different detection items hit the rules to the total number of requests hitting the rules. When applied, all detection items can be sorted in order from high to low according to the risk probability, or the risk probability of each detection item can be compared with a pre-set probability threshold, and the detection items whose risk probability is not lower than the probability threshold are sorted.
[0067] In specific applications, the matching order can be updated according to the pre-configured update strategy, for example, according to time (such as updating once an hour), according to the number of requests (such as the number of requests exceeds a threshold), etc.
[0068] Further, determining any rule hit by any access request within a recent predetermined time period includes:
[0069] If any to-be-matched rule is used to check the first detection item and the second detection item, determining first data for the first detection item and second data for the second detection item of any access request;
[0070] Matching the first data with any of the to-be-matched rules;
[0071] If the first data hits any of the to-be-matched rules, then determining the any of the to-be-matched rules as any of the rules hit by any of the access requests;
[0072] If the first data does not hit any of the rules to be matched, the second data is matched with the any of the rules to be matched, and when the second data hits any of the rules to be matched, the any of the rules to be matched is determined as any of the rules hit by the any of the access requests.
[0073] The embodiment of the present application achieves the role of regularized hierarchical management of detection items by matching different detection items in the same rule in sequence. This can not only omit the filtering of subsequent detection items when the previous detection item fails the detection, thereby improving the detection efficiency, but also achieve the purpose of using multiple detection items for filtering to improve the strictness of network attack detection.
[0074] The following is an example of a specific rule for verifying multiple detection items. Figure 2 The rule shown includes two sub-rule segmants, and the detection items for verifying the corresponding requests are the request header and the request content body, respectively. Each sub-rule includes keyword matching and regular expression matching. When filtering the access request, the header data and body data of the access request are first extracted. When filtering, the rule engine first executes the first sub-rule segmant of the rule, that is, matches the header data with the keyword of the first sub-rule segmant. If the match is successful, the regular expression is used for secondary matching. If the match is successful, the second sub-rule segmant of the rule is first executed, that is, matches the body data with the keyword of the rule. If the match is successful, the regular expression is used for secondary matching. If the match is successful, it is determined that the access request hits this rule. In this embodiment, the rule defines two sub-rule segmants. In actual application, the number of sub-rule segmants defined by the same rule can be determined as needed, such as the detection item matched by the sub-rule segmant can be defined as URL.
[0075] In some embodiments, step S104 further includes:
[0076] Step S1041: based on two adjacent detection items, extract the detection data of the detection item that comes first in the access request and perform rule matching;
[0077] Step S1042: if the detection data of the detection item in the previous order matches the rule, interception processing is performed on the access request;
[0078] Step S1043: if the detection data of the detection item in the previous order does not match the rule, the detection data of the detection item in the subsequent order in the access request is extracted and rule matching is performed to process the access request to be processed accordingly according to the rule matching result.
[0079] This embodiment matches the corresponding detection content in the order of the detection items. Compared with the method of using all the requested data for rule matching in the related art, it not only reduces the amount of data used for rule matching at a single time, but also reduces the number of times the rules are matched and improves the matching efficiency by giving priority to matching the fields with malicious characteristics that have occurred frequently recently.
[0080] In some embodiments, step S1041 further includes:
[0081] Matching the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request;
[0082] Determine whether the rule is hit based on the keyword matching results corresponding to the detection items that come first in order.
[0083] Specifically, the keywords hit by the detection data of the same detection item can be summarized using the AC algorithm as the keywords corresponding to the detection items in the previous order if all the keywords described in the keyword are matched.
[0084] In some embodiments, step S1041 further includes:
[0085] If the keyword matching result corresponding to the detection item in the previous order is successful, the detection data of the detection item in the previous order in the access request is matched with the regular expression corresponding to the detection item in the previous order;
[0086] Determine whether the rule is matched based on the regular expression matching result.
[0087] The embodiment of the present application provides a method of using regular expressions for matching again after a successful keyword match, thereby achieving a dual verification effect of using keywords and regular expressions at the same time, thereby avoiding the problem of missed detection due to insufficient keywords.
[0088] In some embodiments, step S1041 matches the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first, including:
[0089] Scanning the detection data of the detection items in the previous order according to the pre-configured decoding configuration file, the decoding configuration file includes decoding functions and decoding function configurations corresponding to multiple encoding formats, and the decoding function configuration includes a characteristic string, a terminator, and an identification of whether the characteristic string is case-sensitive;
[0090] If the scanned detection data includes a characteristic character string of a predetermined coding format, a decoding function for the predetermined coding format is called to perform decoding, and decoding is stopped when the end character of the predetermined coding format is scanned;
[0091] If the characteristic character string of the predetermined coding format is not scanned, a decoding function corresponding to the coding format pointed to by the scanned characteristic character string is called to perform decoding.
[0092] Specifically, the decoding configuration file may include decoding functions of Unicode encoding, BASE64 encoding, BASE58 encoding, percentage encoding, etc. When applied, the decoding functions of different encoding formats can be customized, or a decoding function provided by a third party can be called through a preset interface.
[0093] Specifically, the predetermined encoding format generally refers to BASE64 encoding or BASE58 encoding. The corresponding character string to be decoded is identified by the characteristic character string of the two encodings and their terminators, and the terminator is used to control the stop position of the decoding function of the two encodings. This method of correctly calling the decoding function by identifying the characteristic character string helps to avoid the occurrence of decoding errors.
[0094] In some embodiments, step S104 further includes:
[0095] If the rule matching result is a hit rule, the cache hash value table is updated according to the hash value of the access request to be processed.
[0096] In specific applications, the cache elimination algorithm (cache elimination algorithm LRU) can be used to delete the least recently used hash value in the cache hash value table and the hash value of the pending access request. In this way, the hash value of the pending access request recorded in the cache hash value table can be directly used in the first step next time to filter the same request, thereby improving the efficiency of identifying malicious requests.
[0097] The present application embodiment discloses a network attack detection device, such as Figure 3 As shown, the device 20 includes a check value determination module 201 , a check value query module 202 , a detection item determination module 203 , and a detection item matching module 204 .
[0098] A check value determination module 201, used to determine a hash value of a pending access request;
[0099] A check value query module 202, used to query the hash value in a cache hash value table used to characterize attack-type access requests, and determine the cache status of the hash value according to the query result;
[0100] The detection item determination module 203 is used to determine the matching order for each detection item if the cache status is not cached;
[0101] The detection item matching module 204 is used to extract the detection data of the corresponding detection items in the access request according to the matching order to perform rule matching, and perform corresponding processing on the access request to be processed according to the rule matching result.
[0102] The embodiment of the present application determines whether the request is malicious by converting the access request into a hash value and querying it in the cached hash value table, thereby simplifying the network attack detection means, shortening the detection time and improving the detection efficiency, and preliminarily solving the problem of slow network attack speed; then, under the condition that the hash value detection fails, the corresponding detection data is extracted according to the matching order of different detection items for rule matching, so that the detection items with malicious characteristics and high risk of hitting the rules can be matched first, avoiding the problem of increasing the number of matches with the rule base and reducing the recognition efficiency due to the detection items with malicious characteristics being matched last, thereby improving the matching efficiency and the processing speed of HTTP requests.
[0103] Further, the detection item determination module 203 is used to:
[0104] A times counting submodule, for determining the times of rule hits corresponding to each detection item based on a number of rules hit by a plurality of access requests in a recent predetermined time period;
[0105] The probability determination submodule is used to determine the risk probability of each detection item hitting the rule according to the number of rule hits corresponding to each detection item;
[0106] The order determination submodule is used to determine the matching order for different detection items in order of risk probability from high to low.
[0107] Furthermore, the times counting submodule determines any rule hit by any access request within the most recent predetermined time period, including:
[0108] a sub-rule determination unit, configured to determine first data for the first detection item and second data for the second detection item of any access request if any to-be-matched rule is used to verify the first detection item and the second detection item;
[0109] A sub-rule matching unit, used for matching the first data with any rule to be matched;
[0110] A first determining unit, configured to determine the any rule to be matched as any rule hit by the any access request if the first data hits the any rule to be matched;
[0111] The second determination unit is used to match the second data with any of the rules to be matched if the first data does not hit any of the rules to be matched, and when the second data hits any of the rules to be matched, determine the any of the rules to be matched as any of the rules hit by any of the access requests.
[0112] Furthermore, the detection item matching module is used to:
[0113] A first matching submodule, for extracting detection data of a detection item that comes first in the access request based on two adjacent detection items and performing rule matching;
[0114] An interception processing submodule, used to perform interception processing on the access request if the detection data of the detection item in the previous order hits the rule;
[0115] The second matching submodule is used to extract the detection data of the detection item in the access request and perform rule matching if the detection data of the detection item in the previous order does not hit the rule, so as to perform corresponding processing on the access request to be processed according to the rule matching result.
[0116] Furthermore, the first matching submodule includes:
[0117] A keyword matching unit, used to match the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request;
[0118] The first judgment unit is used to determine whether the rule is hit according to the keyword matching result corresponding to the detection item in the previous order.
[0119] Furthermore, the first matching submodule further includes:
[0120] A regular expression matching unit, configured to match the detection data of the detection item that is in the previous order in the access request with the regular expression corresponding to the detection item that is in the previous order if the keyword matching result corresponding to the detection item that is in the previous order is matched successfully;
[0121] The second judgment unit is used to determine whether the rule is hit according to the regular expression matching result.
[0122] Furthermore, the first matching submodule includes:
[0123] The encoding scanning unit is used to scan the detection data of the detection items in the previous order according to the pre-configured decoding configuration file, the decoding configuration file includes the decoding functions and decoding function configurations corresponding to the multiple encoding formats, and the decoding function configuration includes the characteristic string, the terminator and the identification of whether the characteristic string is case-sensitive;
[0124] A first encoding unit, configured to call a decoding function for the predetermined encoding format to perform decoding if the scanned detection data includes a characteristic character string of the predetermined encoding format, and stop decoding when the end character of the predetermined encoding format is scanned;
[0125] The second encoding unit is used to call a decoding function corresponding to the encoding format pointed to by the scanned characteristic character string for decoding if the characteristic character string of the predetermined encoding format is not scanned.
[0126] Furthermore, the detection item matching module also includes:
[0127] The cache hash value update submodule is used to update the cache hash value table according to the hash value of the access request to be processed if the rule matching result is a hit rule.
[0128] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, devices (equipment) or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may adopt a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0129] The present application is described with reference to flowcharts of methods, apparatuses (devices) and computer program products according to embodiments of the present application. It should be understood that each process in the flowchart can be implemented by computer program instructions.
[0130] These computer program instructions may be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device that implements the process Figure 1 A function specified in a process or multiple processes.
[0131] These computer program instructions may also be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce the instructions for implementing the process Figure 1 A device that specifies functions in a process or multiple processes.
[0132] Another embodiment of the present application relates to a non-volatile storage medium for storing a computer-readable program, wherein the computer-readable program is used for a computer to execute part or all of the above method embodiments.
[0133] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by specifying the relevant hardware through a program, and the program is stored in a storage medium, including several instructions for a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.
[0134] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A network attack detection method, characterized in that: The method comprises: determining a hash value of a pending access request; Querying the hash value in a cache hash value table used to characterize attack-type access requests, and determining a cache status of the hash value based on the query result; If the cache state is not cached, determining a matching order for each detection item; The detection data of the corresponding detection items in the access request are extracted according to the matching order to perform rule matching, and the to-be-processed access request is processed accordingly according to the rule matching result.
2. The method according to claim 1, characterized in that The determining of the matching order for different detection items includes: Determine the number of rule hits corresponding to each detection item based on a number of rules hit by a plurality of access requests in a recent predetermined time period; According to the number of rule hits corresponding to each detection item, the risk probability of each detection item hitting the rule is determined; Determine the matching order for different detection items in descending order of risk probability.
3. The method according to claim 2, characterized in that Determine any rule hit by any of the access requests within a recent predetermined time period, including: If any to-be-matched rule is used to check the first detection item and the second detection item, determining first data for the first detection item and second data for the second detection item of any of the access requests; Matching the first data with any one of the to-be-matched rules; If the first data hits any of the to-be-matched rules, then determining the any of the to-be-matched rules as any of the rules hit by any of the access requests; If the first data does not hit any of the rules to be matched, the second data is matched with the any of the rules to be matched, and when the second data hits any of the rules to be matched, the any of the rules to be matched is determined as any of the rules hit by any of the access requests.
4. The method according to claim 1, characterized in that: The extracting the detection data of the corresponding detection items in the access request according to the matching order to perform rule matching, and performing corresponding processing on the to-be-processed access request according to the rule matching result, includes: Based on two adjacent detection items, extract the detection data of the detection item that comes first in the access request and perform rule matching; If the detection data of the detection item that comes first in sequence hits the rule, interception processing is performed on the access request; If the detection data of the detection item in the previous order does not hit the rule, the detection data of the detection item in the subsequent order in the access request is extracted and rule matching is performed to process the access request to be processed accordingly according to the rule matching result.
5. The method according to claim 4, characterized in that The extracting detection data of the detection item that comes first in the access request based on two adjacent detection items and performing rule matching includes: Matching the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request; Whether the rule is hit is determined based on the keyword matching result corresponding to the detection item that comes first in order.
6. The method according to claim 5, characterized in that The determining whether the rule is hit according to the keyword matching result corresponding to the detection item that comes first in order further includes: If the keyword matching result corresponding to the detection item in the previous order is successful, then matching the detection data of the detection item in the previous order in the access request with the regular expression corresponding to the detection item in the previous order; Determine whether the rule is matched based on the regular expression matching result.
7. The method according to claim 5, characterized in that The matching of the detection data of the detection item that comes first in the access request with the keyword corresponding to the detection item that comes first in the access request includes: Scanning the detection data of the detection items in the previous order according to the pre-configured decoding configuration file, wherein the decoding configuration file includes decoding functions and decoding function configurations corresponding to the plurality of encoding formats, wherein the decoding function configuration includes a characteristic string, a terminator, and an identification of whether the characteristic string is case-sensitive; If the scanned detection data includes a characteristic character string of a predetermined coding format, a decoding function for the predetermined coding format is called to perform decoding, and decoding is stopped when an end character of the predetermined coding format is scanned; If the characteristic character string of the predetermined coding format is not scanned, a decoding function corresponding to the coding format pointed to by the scanned characteristic character string is called to perform decoding.
8. The method according to claim 1, characterized in that The extracting the detection data of the corresponding detection items in the access request according to the matching order to perform rule matching, and performing corresponding processing on the to-be-processed access request according to the rule matching result, further includes: If the rule matching result is a hit rule, the cache hash value table is updated according to the hash value of the access request to be processed.
9. A network attack detection device, characterized in that: include: A check value determination module, used to determine a hash value of a pending access request; A check value query module, used to query the hash value in a cache hash value table used to characterize attack-type access requests, and determine the cache status of the hash value according to the query result; A detection item determination module, configured to determine a matching order for each detection item if the cache state is not cached; The detection item matching module is used to extract the detection data of the corresponding detection items in the access request according to the matching order to perform rule matching, and perform corresponding processing on the access request to be processed according to the rule matching result.
10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer-readable instructions, and the processor is used to execute the computer-readable instructions, wherein the network attack detection method according to any one of claims 1 to 8 is executed when the computer-readable instructions are executed.