Attack detection method and device, electronic equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to an attack detection method and device, electronic equipment and a storage medium, which are used for improving the attack detection accuracy. The method comprises the following steps: in a current time period, analyzing a target request message which is sent by a target object and is used for accessing a target resource, and determining a resource set to which the target resource belongs; when it is determined that the target object does not access the resources in the resource set, obtaining the reference access authority of each reference object accessing the target resources in each historical time period; and respectively determining permission level relationships between the target access permission of the target object and the reference access permissions, and when the number of first level relationships in the permission level relationships is not less than a preset first number threshold, determining that the target request message is an attack message. By analyzing the historical access behavior and the access permission of the object, the attack behavior of the object can be identified more accurately.

Description

Background Art

[0002] Unauthorized access refers to the attempt or success of accessing systems, networks or data resources without authorization or permission. This access behavior may be carried out by internal personnel or external attackers, usually involving bypassing security mechanisms, exploiting vulnerabilities or abusing credentials. Unauthorized access may lead to the leakage of sensitive information, data tampering or system destruction, posing a serious threat to the security and privacy of the organization.

[0003] In the related art, when detecting unauthorized access attack behaviors, the number of times a visitor accesses resources in a short period of time is mainly counted, and when the number of accesses is higher than a preset threshold, the visitor's access behavior is determined as an attack behavior. However, based on the above method, when the attacker performs an attack behavior at a low frequency for a long time, the attack behavior cannot be detected.

[0004] Therefore, how to improve the accuracy of attack detection has become a problem that needs to be solved urgently. Summary of the invention

[0005] The embodiments of the present application provide an attack detection method, an apparatus, an electronic device, and a storage medium to improve the accuracy of attack detection.

[0006] An attack detection method provided in an embodiment of the present application includes:

[0007] In a current time period, a target request message for accessing a target resource sent by a target object is received, and the target request message is parsed to determine a resource set to which the target resource belongs;

[0008] When it is determined that the target object has not accessed a resource in the resource set based on each historical request message sent by the target object in each historical time period, obtaining reference access rights of each reference object that has accessed the target resource in each historical time period;

[0009] Determine the permission level relationship between the target access rights of the target object and each reference access right respectively, and when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, determine that the target request message is an attack message, wherein the first level relationship is a permission level relationship that conforms to the preset level relationship.

[0010] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access permission is higher than the target access permission, and the method further includes:

[0011] If there is no reference object that has accessed the target resource within each historical time period, or the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then obtaining a historical Internet Protocol IP address of each historical request message, wherein the second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission;

[0012] When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message, wherein the first condition is: the target IP address does not exist in each historical IP address, and the second condition is: the location of the target IP address does not exist in the respective locations of the historical IP addresses.

[0013] Optionally, the method further includes:

[0014] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within the first specified time period;

[0015] Based on the historical resources requested to be accessed by each of the historical request messages, each unknown request message is screened out from each of the access request messages, wherein the resources requested to be accessed by the unknown request message do not exist in each of the historical resources;

[0016] When the ratio of the number of the unknown request messages to the number of the access request messages is greater than a preset value, it is determined that the target request message is an attack message.

[0017] Optionally, the method further includes:

[0018] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within a second specified time period;

[0019] Parsing each access request message to determine a resource identifier of a resource to which each access request message requests access;

[0020] When the relationship between the similarities between the resource identifiers meets the preset relationship, the target request message is determined to be an attack message.

[0021] Optionally, when the relationship between the similarities between the resource identifiers meets a preset relationship, determining that the target request message is an attack message includes:

[0022] Sorting the resource identifiers in lexicographic order to obtain sorted resource identifiers;

[0023] For each sorted resource identifier, respectively calculate the similarity between every two adjacent resource identifiers to obtain each similarity;

[0024] If there are two adjacent similarities that are not less than a preset similarity threshold, the target request message is an attack message.

[0025] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access permission is higher than the target access permission, and the method further includes:

[0026] When the number of second level relationships in the permission level relationships is greater than a preset second number threshold, the target request message is determined to be a normal message, and the second level relationship is used to indicate that the corresponding reference access right is not higher than the target access right.

[0027] Optionally, before obtaining the reference access rights of the reference objects that have accessed the target resource in the historical time periods, the method further includes:

[0028] Based on historical request messages sent by objects other than the target object within each historical time period, obtaining a first object that has accessed the resource set;

[0029] When it is determined that there are second objects among the first objects whose corresponding access rights are not greater than the target access rights, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are filtered out from the first objects.

[0030] An attack detection device provided in an embodiment of the present application includes:

[0031] A receiving unit, configured to receive a target request message sent by a target object for accessing a target resource within a current time period, and parse the target request message to determine a resource set to which the target resource belongs;

[0032] an acquisition unit, configured to acquire, based on each historical request message sent by the target object in each historical time period, respective reference access rights of each reference object that has accessed the target resource in each historical time period when it is determined that the target object has not accessed a resource in the resource set;

[0033] The first determination unit is used to respectively determine the permission level relationships between the target access rights of the target object and each reference access right, and to determine that the target request message is an attack message when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, wherein the first level relationship is a permission level relationship that conforms to a preset level relationship.

[0034] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the device further includes a second determining unit, configured to:

[0035] If there is no reference object that has accessed the target resource within each historical time period, or the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then obtaining a historical Internet Protocol IP address of each historical request message, wherein the second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission;

[0036] When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message, wherein the first condition is: the target IP address does not exist in each historical IP address, and the second condition is: the location of the target IP address does not exist in the respective locations of the historical IP addresses.

[0037] Optionally, the second determining unit is further used for:

[0038] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within the first specified time period;

[0039] Based on the historical resources requested to be accessed by each of the historical request messages, each unknown request message is screened out from each of the access request messages, wherein the resources requested to be accessed by the unknown request message do not exist in each of the historical resources;

[0040] When the ratio of the number of the unknown request messages to the number of the access request messages is greater than a preset value, it is determined that the target request message is an attack message.

[0041] Optionally, the second determining unit is further used for:

[0042] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within a second specified time period;

[0043] Parsing each access request message to determine a resource identifier of a resource to which each access request message requests access;

[0044] When the relationship between the similarities between the resource identifiers meets the preset relationship, the target request message is determined to be an attack message.

[0045] Optionally, the second determining unit is specifically configured to:

[0046] Sorting the resource identifiers in lexicographic order to obtain sorted resource identifiers;

[0047] For each sorted resource identifier, respectively calculate the similarity between every two adjacent resource identifiers to obtain each similarity;

[0048] If there are two adjacent similarities that are not less than a preset similarity threshold, the target request message is an attack message.

[0049] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the device further includes a third determining unit, configured to:

[0050] When the number of second level relationships in the permission level relationships is greater than a preset second number threshold, the target request message is determined to be a normal message, and the second level relationship is used to indicate that the corresponding reference access right is not higher than the target access right.

[0051] Optionally, the device further comprises a screening unit, for:

[0052] Based on historical request messages sent by objects other than the target object within each historical time period, obtaining a first object that has accessed the resource set;

[0053] When it is determined that there are second objects among the first objects whose corresponding access rights are not greater than the target access rights, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are filtered out from the first objects.

[0054] An electronic device provided in an embodiment of the present application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the above-mentioned attack detection methods.

[0055] An embodiment of the present application provides a computer-readable storage medium, which includes a computer program. When the computer program is executed on an electronic device, the computer program is used to enable the electronic device to execute the steps of any one of the above-mentioned attack detection methods.

[0056] An embodiment of the present application provides a computer program product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; when a processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, so that the electronic device performs the steps of any one of the above-mentioned attack detection methods.

[0057] The beneficial effects of this application are as follows:

[0058] The embodiment of the present application provides an attack detection method, device, electronic device and storage medium. In the current time period, the resource set to which the target resource requested by the target object belongs is first determined. When the target object has not accessed the resources in the determined resource set, the target request message is determined to be an attack message by comparing the target access rights of the target object with the permission level relationship between the reference access rights of each reference object that has accessed the target resource. Based on the above method, by analyzing the historical access behavior of the target object and combining the access rights of the target object, multi-dimensional information is integrated, and the context and business logic of the target object's access behavior can be understood more accurately, thereby accurately identifying the attack behavior, which can effectively enhance the accuracy of attack detection.

[0059] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0061] Figure 1A A schematic diagram of an attack detection method in the related art;

[0062] Figure 1BAn optional schematic diagram of an application scenario in an embodiment of the present application;

[0063] Figure 2 A schematic diagram of a request resource tree in an embodiment of the present application;

[0064] Figure 3 This is a flowchart of an attack detection method in an embodiment of the present application;

[0065] Figure 4 This is an overall flow chart of an attack detection method in an embodiment of the present application;

[0066] Figure 5 A schematic diagram of the structure of an attack detection device in an embodiment of the present application;

[0067] Figure 6 A schematic diagram of a hardware structure of an electronic device to which an embodiment of the present application is applied;

[0068] Figure 7 A schematic diagram of the hardware structure of another electronic device to which the embodiments of the present application are applied. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0070] The following is an introduction to some concepts involved in the embodiments of the present application.

[0071] User and Entity Behavior Analytics (UEBA): is a technology that detects abnormal activities and potential threats by analyzing the behavior patterns of users and entities (such as sites and applications). The UEBA system uses big data analysis and artificial intelligence (AI) technology to establish a baseline behavior model, and continuously monitors and compares the differences between current behavior and the baseline to identify potential security threats. Unlike traditional rule-based methods, UEBA pays more attention to behavioral analysis and contextual understanding, and can detect more complex and covert attacks. The attack detection method in the embodiment of the present application applies UEBA technology to improve the accuracy of attack detection.

[0072] Unauthorized access: refers to the attempt or success of accessing systems, networks or data resources without authorization or permission. This access behavior may be carried out by internal personnel or external attackers, usually involving bypassing security mechanisms, exploiting vulnerabilities or misusing credentials. Unauthorized access may lead to the leakage of sensitive information, data tampering or system destruction, posing a serious threat to the security and privacy of the organization.

[0073] Long-tail attack: It is a low-frequency but continuous attack mode, in which the attacker performs attack operations at a low frequency over a long period of time to avoid triggering the frequent detection mechanism of traditional security systems. This type of attack is usually scattered and hidden, and it is difficult to detect through short-term statistical analysis. The goal of long-tail attacks may be to gradually obtain system permissions, collect sensitive information, or implant persistent threats in the system, posing a great challenge to security protection. The attack detection method in the embodiment of the present application can effectively identify long-tail attacks by analyzing user historical behavior.

[0074] The following is a brief introduction to the design concept of this application:

[0075] Unauthorized access refers to the attempt or success of accessing systems, networks or data resources without authorization or permission. This access behavior may be carried out by internal personnel or external attackers, usually involving bypassing security mechanisms, exploiting vulnerabilities or abusing credentials. Unauthorized access may lead to the leakage of sensitive information, data tampering or system destruction, posing a serious threat to the security and privacy of the organization.

[0076] In related technologies, such as Figure 1A As shown in the figure, when detecting unauthorized access attack behaviors, the user access logs are analyzed in real time and preprocessed, and then static rule matching and simple frequent item statistics are used to output an alarm when the matching result or statistical result reaches the threshold. These methods have significant limitations in dealing with complex and new attacks. Attackers often bypass the detection of security devices through slowly changing request paths, account impersonation / theft, etc., and it is difficult to trigger the alarm threshold based on a single rule judgment or frequent item analysis. For example, by counting the number of times a visitor accesses a resource in a short period of time, and when the number of accesses is higher than the preset threshold, the visitor's access behavior is judged as an attack behavior. However, based on the above method for detection, when the attacker performs an attack behavior at a low frequency for a long time, the attack behavior cannot be detected.

[0077] Therefore, how to improve the accuracy of attack detection has become a problem that needs to be solved urgently.

[0078] In view of this, the embodiments of the present application provide an attack detection method, device, electronic device and storage medium. In the current time period, the resource set to which the target resource requested by the target object belongs is first determined. When the target object has not accessed the resources in the determined resource set, the target access rights of the target object are compared with the permission level relationship between the reference access rights of each reference object that has accessed the target resource, so as to determine whether the target request message is an attack message. Based on the above method, by analyzing the historical access behavior of the target object and combining the access rights of the target object, multi-dimensional information is integrated, and the context and business logic of the target object's access behavior can be understood more accurately, thereby accurately identifying the attack behavior, which can effectively enhance the accuracy of attack detection.

[0079] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application may be combined with each other if there is no conflict.

[0080] like Figure 1B As shown, it is a schematic diagram of an application scenario of an embodiment of the present application. The application scenario diagram includes two terminal devices 110 and a server 120.

[0081] In the embodiments of the present application, the terminal device includes but is not limited to mobile phones, tablet computers, laptop computers, desktop computers, e-book readers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals and other devices; the terminal device may be installed with a client related to attack detection, which may be software (such as a browser, security protection software, etc.), or a web page, a small program, etc. The server is a background server corresponding to the software or web page, small program, etc., or a server specifically used for attack detection, which is not specifically limited in the present application. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0082] It should be noted that the attack detection method in the embodiment of the present application can be executed by an electronic device, which can be a server or a terminal device, that is, the method can be executed by the server or the terminal device alone, or can be executed by the server and the terminal device together.

[0083] In an optional implementation, the terminal device and the server may communicate via a communication network.

[0084] In an optional implementation, the communication network is a wired network or a wireless network.

[0085] It should be noted that Figure 1B The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0086] The following describes the attack detection method provided by the exemplary embodiment of the present application in combination with the application scenario described above and with reference to the accompanying drawings. It should be noted that the above application scenario is only shown to facilitate understanding of the spirit and principles of the present application, and the implementation of the present application is not limited in this respect.

[0087] Each time the server receives and processes a user's request message, it generates a corresponding user access log. The user access log contains relevant information of the request message. Before executing the attack detection method in the embodiment of the present application, it is necessary to periodically batch process the user access log:

[0088] Step 1: Data preprocessing

[0089] 1) Extraction of key fields: Initial / regular batch analysis of historical user access logs, filtering and not analyzing logs with status codes that do not begin with "4" or "5" and that have been historically determined to be unauthorized access attacks, standardizing Uniform Resource Locator (URL), request method, request parameters, response status code, user identifier (ID), role, login IP, current batch time (segment_time) and other information;

[0090] 2) Data grouping: Group data according to role ID and user ID, and analyze the resources accessible to different roles and users, submitted parameters, and response message information.

[0091] After data preprocessing, we can obtain Figure 2 The data in the table, where each row represents information extracted from the corresponding user access log.

[0092] Step 2: Generate a request resource tree for each user

[0093] 1) Create a root node: Figure 2 As shown, the request resource tree of user 1 and user 2 is first created, the root node " / " is created, the path is split according to the separator (slash / ), each path segment is extracted, and the number of occurrences of each path segment at the same position is counted;

[0094] 2) Mark dynamic path parameters: For path segments that appear frequently and have different contents, mark them as dynamic path parameters. Use regular expressions to replace the dynamic parts in the path with placeholders. For example, {number} means replacing numeric parameter values ​​with placeholders, and {string} means replacing character parameter values ​​with placeholders.

[0095] 3) Build tree nodes level by level: The request method is the second-level node. Figure 2 In the middle is "GET", from the third layer node ( Figure 2 Starting from "api" in the example, the split path is constructed or searched for tree nodes level by level. Each path part represents a node, and a new node is created if the node does not exist.

[0096] 4) Record the key-value pair parameters of the request: Record the request parameters of each requested resource in the target node to form the req_map variable. For the Restful interface path parameter, the layer number is used as the variable name. For example, the fifth layer is named leaf5. For the request parameter, the key value is used to name the value. The value is the value that has appeared in all historical logs. The request is sorted in order of time. Finally, all request parameters are converted to json format and the time information of the current batch is recorded. For details, see Figure 2 in the req_map column.

[0097] Step 3: Record the correspondence between users and IP addresses

[0098] Record the user ID's historical IP, IP location, login time and other information. If the historical IP is an intranet IP, it needs to be traced back to the accessed public IP and the data is stored in the database.

[0099] After the above processing, it is possible to determine whether the target object and other objects have accessed the target resource and the resource set to which the target resource belongs by querying the request resource tree of each user.

[0100] See also Figure 3 As shown, it is an implementation flow chart of an attack detection method provided in an embodiment of the present application. Taking the execution subject as a server as an example, the specific implementation process of the method includes the following steps S31-S34:

[0101] S31: the server receives a target request message sent by the target object for accessing a target resource within the current time period, and parses the target request message to determine the resource set to which the target resource belongs;

[0102] Specifically, the target object sends a target request message to the server to request access to the target resource. The target request message contains the URL of the target resource, which is used to characterize the resource set to which the target resource belongs. In the following, the resource set to which the target resource belongs is resource set 1 as an example for explanation. The length of each time period can be set according to demand, for example, each time period is 1 week, 1 day, 1 hour, etc.

[0103] After determining the resource collection to which the target resource belongs, first determine whether any object has accessed resource collection 1 in previous historical time periods. Optionally, if the target object has not accessed resource collection 1, and other objects have accessed resource collection 1, perform the following steps:

[0104] Based on historical request messages sent by objects other than the target object within each historical time period, the first object that has accessed the resource set is obtained; when it is determined that there are second objects in each first object whose corresponding access rights are not greater than the target access rights, and the number of second objects is greater than a preset number threshold, the reference objects that have accessed the target resources are filtered out from each first object.

[0105] Specifically, objects other than the target object can be called other objects. By analyzing the historical request messages of other objects, the first object that has accessed resource set 1 is screened out from other objects. At this time, it is necessary to compare the access rights of the first object and the target access rights of the target object. If the access rights of the first object are equal to or lower than the target access rights, that is, there is a second object, and the number of second objects is greater than the preset number threshold, then a reference object is screened out from each first object for further judgment.

[0106] Taking the preset quantity threshold of 1 as an example, assuming that the access rights from low to high are: level 1, level 2, level 3, level 4, level 5, the target access right is level 3, the access right of object 1 is level 1, the access right of object 2 is level 4, the access right of object 3 is level 3, the access right of object 4 is level 2, and the access right of object 5 is level 4, then the second objects are: object 1, object 3 and object 4, and the number of second objects is 3, which is greater than 1. Further combined with the resources accessed by each first object, it is screened out that the reference objects that have accessed the target resource are object 1, object 2 and object 3.

[0107] If the access rights of the first objects are higher than the target access rights of the target object, the target request message may be directly determined as an attack message.

[0108] S32: when the server determines that the target object has not accessed resources in the resource set based on each historical request message sent by the target object in each historical time period, it obtains the reference access rights of each reference object that has accessed the target resource in each historical time period;

[0109] Specifically, when the target object has not accessed the resources in the resource set, it is necessary to make a judgment in combination with the access rights of the reference object that has accessed the target resource.

[0110] S33: The server determines the permission level relationships between the target access rights of the target object and each reference access right respectively, and determines that the target request message is an attack message when the number of first level relationships in each permission level relationship is not less than a preset first number threshold;

[0111] The first level relationship is a permission level relationship that conforms to a preset level relationship. For example, the preset level relationship is used to indicate that the corresponding reference access right is higher than the target access right, or the preset level relationship is used to indicate that the corresponding reference access right is not higher than the target access right. In the embodiment of the present application, the preset level relationship is mainly used to indicate that the corresponding reference access right is higher than the target access right.

[0112] For example, the target access right is level 2, the reference access right 1 is level 3, the reference access right 2 is level 2, the reference access right 3 is level 1, the reference access right 4 is level 4, and the reference access right 5 is level 5. Taking the first quantity threshold as 3 as an example, the number of first-level relationships is 3, and the target request message is determined to be an attack message.

[0113] If all reference access rights are higher than the target access right, the target request message can be directly determined as an attack message. Under this rule, the first quantity threshold can be set according to the number of reference objects, and the first quantity threshold is equal to the number of reference objects.

[0114] In an embodiment of the present application, within the current time period, the resource set to which the target resource requested by the target object belongs is first determined. When the target object has not accessed the resources in the determined resource set, the target access rights of the target object are compared with the permission level relationship between the reference access rights of each reference object that has accessed the target resource to determine whether the target request message is an attack message. Based on the above method, by analyzing the historical access behavior of the target object, combined with the access rights of the target object, and integrating multi-dimensional information, the context and business logic of the target object's access behavior can be more accurately understood, thereby accurately identifying attack behaviors and effectively enhancing the accuracy of attack detection.

[0115] Optionally, when the number of second level relationships in each permission level relationship is greater than a preset second number threshold, it is determined that the target request message is a normal message.

[0116] Among them, the second-level relationship is used to characterize that the corresponding reference access rights are not higher than the target access rights. Taking the second quantity threshold as 1 as an example, when the number of second-level relationships is greater than 1, the target request message can be judged as a normal message, and the target resource can be subsequently returned to the target object for access.

[0117] Optionally, if there is no reference object that has accessed the target resource within each historical time period, or the number of second-level relationships in each authority level relationship is equal to a preset second quantity threshold, then the historical IP address of each historical request message is obtained; when the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message.

[0118] Among them, the second level relationship is used to characterize that the corresponding reference access rights are not higher than the target access rights. The first condition is that the target IP address does not exist in the historical IP addresses, and the second condition is that the location of the target IP address does not exist in the respective locations of each historical IP address.

[0119] In this method, the second quantity threshold can be 1, that is, when only one reference object has a reference access right that is not greater than the target access right, a judgment is further made based on the target IP address and location of the target request message sent by the target object to determine whether the login behavior of the target object is abnormal. When the target IP address and location have never appeared in the target object's previous visits, the target request message is judged as an attack message.

[0120] When the target IP address meets the first condition and the location of the target IP address meets the second condition, it is determined that the target request message is a normal message.

[0121] Optionally, if the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, the behavior pattern of the target object is further compared and judged in the following three ways:

[0122] Method 1:

[0123] Obtain each access request message sent by the target object within the first specified time period; based on the historical resources requested to be accessed by each historical request message, filter out each unknown request message from each access request message, wherein there are no resources in each historical resource that are requested to be accessed by the unknown request message; when the ratio of the number of unknown request messages to the number of access request messages is greater than a preset value, determine that the target request message is an attack message.

[0124] Specifically, the number M of access request messages sent by the target object within the first specified time period, the number N1 of unknown request messages, the number N2 of candidate request messages, the resource set to which the resource requested to be accessed by the candidate request message does not exist in the resource set to which each historical resource belongs, and the preset value is set to a. When the ratio of NI to M is greater than a, or the ratio of N2 to M is greater than a, the target request message is determined to be an attack message. The size of a can be set according to demand.

[0125] Through the above method, the proportion of resources or resource sets that have not been requested to be accessed before the target object is counted to determine whether the access is normal.

[0126] Method 2:

[0127] S41: Acquire each access request message sent by the target object within a second specified time period;

[0128] S42: parsing each access request message to determine the resource identifier of the resource to be accessed by each access request message;

[0129] S43: When the relationship between the similarities between the resource identifiers meets the preset relationship, determining that the target request message is an attack message.

[0130] Specifically, the relationship between the resources requested to be accessed by the target object is analyzed to determine whether the access is normal. The similarity between resource identifiers can be calculated based on a variety of methods, such as edit distance, cosine similarity, etc., which are not specifically limited here.

[0131] Optionally, step S43 may be implemented as follows:

[0132] Sort each resource identifier in lexicographic order to obtain each sorted resource identifier; for each sorted resource identifier, respectively calculate the similarity between every two adjacent resource identifiers to obtain each similarity; if there are two adjacent similarities that are not less than a preset similarity threshold, the target request message is an attack message.

[0133] Specifically, the edit distance is used to calculate the similarity between two resource identifiers, and the similarity threshold is the number of edits. In this application, 1 is taken as an example for illustration. The similarity is not less than the preset similarity threshold, indicating that the number of edits is less than or equal to 1. For example, the sorted resource identifiers [131, 1311, 13111, 131111], the similarity threshold is 1, the edit distance between 131 and 1311 is 1, the edit distance between 1311 and 13111 is 1, the edit distance between 13111 and 131111 is 1, and the adjacent edit distance is equal to 1, and the target request message is determined to be an attack message.

[0134] In the specific implementation, first, extract the value (resource identifier) ​​of all request parameters in turn. Assume that for a certain json key, the extracted value represents all parameters requested by the key variable in the recent period as a string list params, and sort params in lexicographic order.

[0135] Initialize an empty list chains to store all continuous change chains. Initialize a list current_chain to store the current continuous change string, with the starting element being params[0]. Start traversing the string list from params[1]. If the edit distance between the current string and the previous string is less than or equal to the threshold 1 (indicating that the difference between the two strings is allowed to be at most 1 edit operation), then add the current string to current_chain. Otherwise, add current_chain to chains and reinitialize current_chain to the current string. After the traversal is completed, add the last current_chain to chains, traverse all chains, and if the length of any chain is greater than or equal to 3, it is determined to be unauthorized access.

[0136] For example, there is the following sequence of requests:

[0137] / GRT / api / username / aba

[0138] / GRT / api / username / abaaa

[0139] / GRT / api / username / abc

[0140] / GRT / api / username / abd

[0141] / GRT / api / username / abaa

[0142] / GRT / api / username / abb

[0143] Extract each resource identifier and sort them in lexicographical order: ["aba", "abaa", "abaaa", "abb", "abc", "abd"]. Use the sliding window method to traverse the sorted resource identifiers and calculate the edit distance of each pair of adjacent resource identifiers. If the edit distance is less than or equal to 1, it is considered that the pair of resource identifiers is continuously changing, and the pair of resource identifiers is connected to the current chain. The two continuously changing chains obtained in the above manner are ["aba", "abaa", "abaaa"] and ["abb", "abc", "abd"]. Traverse the generated chains. If any chain contains at least three identifiers, the target request message is judged as an attack message, that is, unauthorized access.

[0144] Method 3:

[0145] The most recent X request messages sent by the received target object are obtained, and it is found that among the Q request messages, the number of request messages whose resource set to which the requested resource belongs is a resource set of historical resources is Y. If the ratio of X to Y is less than a preset ratio, it is determined that the target request message is an attack message.

[0146] By analyzing the relationship between the user's historical behavior and the requested resources, this application can better understand the context and business logic of the user's operation. For example, abnormal user login behavior, comparison of the user's own behavior patterns, comparison of behavior patterns between users, etc., can more accurately identify complex attack behaviors. However, traditional unauthorized detection methods, static rules and frequency statistics methods cannot fully understand the context and business logic of user behavior, and it is difficult to deal with complex, multi-step attacks.

[0147] Based on the above method, the historical behavior logs marked as attack messages are filtered, and normal logs are continued to be used to improve the request resource tree in the next time period.

[0148] Take the common new attack method: legal but abnormal request sequence as an example. Assume that there is a user A in the system. By analyzing the historical access logs and preprocessing the data, the request resource tree of user A is obtained. User A sent the following request messages within a period of time:

[0149] 1.10188user GET / api / data / 131 113.65.33.126X city

[0150] 2.10188user GET / api / data / 131111 113.65.33.126X city

[0151] 3.10188user GET / api / data / 1311 113.65.33.126X city

[0152] 4.10188user GET / api / data / 13111 113.65.33.126X city

[0153] (1) The request will be converted to / api / data / {number} in the preprocessing stage and will first be searched in the user request resource tree;

[0154] (2) The first requested resource node exists and the user has accessed the resource. The parameters can be found in req_map and it is considered a normal request. That is, this request message is a normal message.

[0155] (3) The second requested resource node / api / data / {number} exists and the user has accessed the resource, but the parameter cannot be found in req_map. The decision model turns to pattern comparison between users. Assuming that other users have not accessed the resource / api / data / {number} and the dynamic path parameter is 131111, it is directly judged as pending;

[0156] (4) The user logs in with a common IP address and a common location. In the comparison of user behavior patterns, the current / api / data / {number} in the request resource tree does not meet the frequent item statistics condition.

[0157] (5) At this time, if the edit distance between two adjacent strings is less than or equal to the set threshold of 1, they are considered to be continuously changing and are linked to the current chain. If the length of any chain is greater than or equal to 3, it is determined to be unauthorized access, that is, this request message is an attack message;

[0158] (6) Continue to determine whether the parameters of the most recently requested resource meet the edit distance threshold. At this time, the continuous change chain contains 0 strings, and the sorted result is ['131', '131111'], with an edit distance of 3. The user's most recent request / api / data / {number} completely overlaps with the historical request resource, so it is determined to be a normal request. At this time, the request is released and put into the analysis queue;

[0159] (7) The judgment process for the third request is the same as 3), but other users have not accessed the resource / api / data / {number} with a dynamic path parameter of 1311, so the result is determined to be pending;

[0160] (8) The third request extracts the dynamic path request parameters. The sorted result is ['131', '1311', '131111']. The edit distance between '131' and '1311' is 1, so they are linked to the same chain. The edit distance between '1311' and '131111' is 3, so they cannot be linked to the same chain. The current chain ends and a new chain begins. The generated continuous changing string chain is: [['131', '1311'], ['131111']]. At this time, the longest chain ['131', '1311'] has only two strings, which does not reach the threshold and is therefore determined to be a normal request. The request is then released and continues to be placed in the analysis queue.

[0161] (9) The judgment process for the fourth request is the same as 3), but other users have not accessed the resource / api / data / {number} with a dynamic path parameter of 131111, so it is directly judged as pending;

[0162] (10) At this time, for / api / data / {number}, the result of sorting the parameters of the dynamic path is ['131', '1311', '13111', '131111']. The edit distance between '131' and '1311' is 1, so they are linked to the same chain. The edit distance between '1311' and '13111' is 1, and they are also linked to the same chain. The edit distance between '13111' and '131111' is 1, and they continue to be linked to the same chain. The generated continuous change string chain is: [['131', '1311', '13111', '131111']]. Traverse all the generated continuous change chains. If any continuous change chain contains at least three strings, it is judged as unauthorized access. At this time, the length of the continuous change chain [['131', '1311', '13111', '131111']] is 4 (greater than or equal to 3), so it is judged as unauthorized access and an alarm is output.

[0163] like Figure 4 FIG. 1 is a schematic diagram of an overall process of an attack detection method in an embodiment of the present application, comprising the following steps:

[0164] S401: receiving a target request message and determining the resource set to which the target resource belongs;

[0165] S402: Has the user accessed this resource collection? If yes, execute S403; if no, execute S410;

[0166] S403: Has the target object accessed this resource set? If yes, execute S404; if no, execute S405;

[0167] S404: Has the target object accessed the target resource? If yes, execute S414; if no, execute S405;

[0168] S405: Have other users accessed the target resource? If yes, execute S406; if no, execute S410;

[0169] S406: Determine a first number of access permissions of other objects that have accessed the resource set that is not greater than the target access permission;

[0170] S407: Is the first number greater than or equal to 1? If it is greater than 1, execute S408; if it is equal to 1, execute S410; if it is less than 1, execute S415;

[0171] S408: Determine a second number of reference access rights of the reference object that has accessed the target resource that is not higher than the target access right;

[0172] S409: Is the second number greater than or equal to 1? If it is greater than 1, execute S414; if it is equal to 1, execute S410; if it is less than 1, execute S415;

[0173] S410: Whether the target IP address meets the first condition and the location of the target IP address meets the second condition, if yes, execute S415, if not, execute S411;

[0174] S411: Whether the ratio of the resource set or resources requested by the target object in the first specified time period that have not been accessed is greater than a preset value, if so, execute S412, if not, execute S415;

[0175] S412: If the relationship between the similarities of the resources requested by the target object within the second specified time period meets the preset relationship, execute S415 if yes, and execute S413 if no;

[0176] S413: Whether the overlap of the resource sets requested in the target object's most recent N requests is greater than a preset ratio, if so, execute S414, if not, execute S415;

[0177] S414: normal message;

[0178] S415: Attack message.

[0179] The unique multi-dimensional unauthorized decision tree model in the embodiment of the present application integrates multi-dimensional information, including user behavior sequence analysis, similarity calculation of requested resources, etc., to make unauthorized access judgments from different angles. This multi-dimensional analysis improves the breadth and depth of detection. However, the traditional unauthorized detection method, based on high-frequency access statistical rules, can play a certain role in detecting high-frequency access in the short term, but for long-term, low-frequency and scattered attacks (such as slow attacks), this method has insufficient recognition ability.

[0180] The attack detection method in the embodiment of the present application can be generally divided into the following steps:

[0181] Step 1: Initial / regular batch analysis of historical user access logs, grouping them according to system roles and users, and generating a user request resource tree for each user;

[0182] Step 2: For path segments that appear frequently and have different contents, mark them as dynamic path parameters, use regular expressions to replace the dynamic parts in the path with placeholders, and mark the historical request parameters on the leaf nodes of the tree. At this time, the unique user request resource tree has been initialized;

[0183] Step 3: Initial / regular batch analysis of historical user access logs, sorting out the relationship between user IDs and their historical login IP addresses and IP locations, and storing the results in the database;

[0184] Step 4: After initialization is completed, the user access log is analyzed in real time, and the user request resource tree and user historical login information are loaded into the program memory. A unique unauthorized access decision tree model is constructed based on abnormal user login behavior, comparison of behavior patterns between users, and comparison of user behavior patterns. When the decision tree alarm conditions are met, an unauthorized access alarm is generated in real time.

[0185] Step 5: Cache normal logs, read the cached data in the next batch and filter out the false positive results of manual audit (optional), and continue to repeat steps 1) to 3) to improve the user request resource tree and strengthen the unauthorized access decision model.

[0186] The dynamic behavior analysis of the request resource tree unique to the embodiment of the present application, by constructing a request resource tree, analyzes the mapping relationship between the user and his historical login IP, and accurately identifies the attacker's identity from multiple angles such as abnormal user login behavior and comparison of user behavior patterns. This method can more flexibly respond to dynamically changing attack paths, improving the accuracy and real-time performance of detection. However, traditional unauthorized detection methods are often unable to cover new attack methods with traditional static rules. For example, dynamically changing attack paths such as using legal but abnormal request sequences and low-privilege accounts to access high-privilege resources horizontally are difficult for static rules to detect.

[0187] Based on the same inventive concept, the embodiment of the present application also provides an attack detection device. Figure 5 As shown, it is a schematic diagram of the structure of the attack detection device 500, which may include:

[0188] The receiving unit 501 is used to receive a target request message sent by a target object for accessing a target resource within a current time period, and parse the target request message to determine the resource set to which the target resource belongs;

[0189] An acquisition unit 502 is configured to acquire reference access rights of respective reference objects that have accessed the target resource in each historical time period when it is determined that the target object has not accessed a resource in the resource set based on each historical request message sent by the target object in each historical time period;

[0190] The first determination unit 503 is used to respectively determine the permission level relationships between the target access rights of the target object and each reference access right, and to determine that the target request message is an attack message when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, wherein the first level relationship is a permission level relationship that conforms to a preset level relationship.

[0191] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the apparatus further includes a second determining unit 504, configured to:

[0192] If there is no reference object that has accessed the target resource in each historical time period, or the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then obtaining the historical Internet Protocol IP address of each historical request message, and the second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission;

[0193] When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message, wherein the first condition is: the target IP address does not exist in each historical IP address, and the second condition is: the location of the target IP address does not exist in the respective locations of each historical IP address.

[0194] Optionally, the second determining unit 504 is further configured to:

[0195] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within the first specified time period;

[0196] Based on the historical resources requested to be accessed by each historical request message, each unknown request message is screened out from each access request message, wherein the resources requested to be accessed by the unknown request message do not exist in each historical resource;

[0197] When the ratio of the number of unknown request messages to the number of access request messages is greater than a preset value, the target request message is determined to be an attack message.

[0198] Optionally, the second determining unit 504 is further configured to:

[0199] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within the second specified time period;

[0200] Parsing each access request message to determine the resource identifier of the resource that each access request message requests to access;

[0201] When the relationship between the similarities between the resource identifiers meets the preset relationship, the target request message is determined to be an attack message.

[0202] Optionally, the second determining unit 504 is specifically configured to:

[0203] Sort each resource identifier in lexicographic order to obtain sorted resource identifiers;

[0204] For each sorted resource identifier, respectively calculate the similarity between every two adjacent resource identifiers to obtain each similarity;

[0205] If there are two adjacent similarities that are not less than the preset similarity threshold, the target request message is an attack message.

[0206] Optionally, the preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the apparatus further includes a third determining unit 505, which is used to:

[0207] When the number of second level relationships in each permission level relationship is greater than a preset second number threshold, the target request message is determined to be a normal message, and the second level relationship is used to indicate that the corresponding reference access right is not higher than the target access right.

[0208] Optionally, the device further comprises a screening unit 506, which is used to:

[0209] Based on historical request messages sent by objects other than the target object in each historical time period, obtaining the first object that has accessed the resource set;

[0210] When it is determined that there are second objects in each first object whose corresponding access rights are not greater than the target access rights, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are screened out from each first object.

[0211] For the convenience of description, the above parts are divided into modules (or units) according to their functions and described separately. Of course, when implementing this application, the functions of each module (or unit) can be implemented in the same or multiple software or hardware.

[0212] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0213] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0214] Based on the same inventive concept as the above method embodiment, an electronic device is also provided in the embodiment of the present application. In one embodiment, the electronic device may be a server, such as Figure 1B In this embodiment, the structure of the electronic device can be as follows: Figure 6 As shown, it includes a memory 601 , a communication module 603 and one or more processors 602 .

[0215] The memory 601 is used to store computer programs executed by the processor 602. The memory 601 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0216] The memory 601 may be a volatile memory, such as a random-access memory (RAM); the memory 601 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 601 may be any other medium that can be used to carry or store a desired computer program in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 601 may be a combination of the above memories.

[0217] The processor 602 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 602 is configured to implement the above attack detection method when calling the computer program stored in the memory 601 .

[0218] The communication module 603 is used to communicate with terminal devices and other servers.

[0219] The specific connection medium between the memory 601, the communication module 603 and the processor 602 is not limited in the embodiment of the present application. Figure 6 In the embodiment, the memory 601 and the processor 602 are connected via a bus 604. The bus 604 is connected to the processor 602 via a bus 604. Figure 6 The connections between the other components are only for illustration and are not intended to be limiting. The bus 604 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Figure 6 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or one type of bus.

[0220] The memory 601 stores a computer storage medium, and the computer storage medium stores computer executable instructions, and the computer executable instructions are used to implement the attack detection method of the embodiment of the present application. The processor 602 is used to execute the above-mentioned attack detection method, such as Figure 3 shown.

[0221] In another embodiment, the electronic device may also be other electronic devices, such as Figure 1B In this embodiment, the structure of the electronic device can be as follows: Figure 7 As shown, it includes: a communication component 710, a memory 720, a display unit 730, a camera 740, a sensor 750, an audio circuit 760, a Bluetooth module 770, a processor 780 and other components.

[0222] The communication component 710 is used to communicate with the server. In some embodiments, a wireless fidelity (WiFi) module may be included. The WiFi module belongs to a short-range wireless transmission technology. The electronic device can help the user to send and receive information through the WiFi module.

[0223] The memory 720 can be used to store software programs and data. The processor 780 executes various functions and data processing of the terminal device by running the software programs or data stored in the memory 720. The memory 720 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. The memory 720 stores an operating system that enables the terminal device to run. In the present application, the memory 720 can store an operating system and various application programs, and can also store a computer program for executing the attack detection method of the embodiment of the present application.

[0224] The display unit 730 can also be used to display information input by the user or information provided to the user and a graphical user interface (GUI) of various menus of the terminal device. Specifically, the display unit 730 may include a display screen 732 disposed on the front of the terminal device. The display screen 732 may be configured in the form of a liquid crystal display, a light emitting diode, etc. The display unit 730 may be used to display the attack detection user interface in the embodiment of the present application, etc.

[0225] The display unit 730 can also be used to receive input digital or character information and generate signal input related to the user settings and function control of the terminal device. Specifically, the display unit 730 may include a touch screen 731 arranged on the front of the terminal device, which can collect the user's touch operations on or near it, such as clicking a button, dragging a scroll box, etc. Among them, the touch screen 731 can be covered on the display screen 732, or the touch screen 731 can be integrated with the display screen 732 to realize the input and output functions of the terminal device. After integration, it can be referred to as a touch display screen. In this application, the display unit 730 can display the application and the corresponding operation steps. The camera 740 can be used to capture static images, and the user can post comments on the images taken by the camera 740 through the application. The camera 740 can be one or more. The object generates an optical image through the lens and projects it onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal oxide semiconductor (CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the processor 780 to convert it into a digital image signal.

[0226] The terminal device may further include at least one sensor 750, such as an acceleration sensor 751, a distance sensor 752, a fingerprint sensor 753, and a temperature sensor 754. The terminal device may also be configured with other sensors such as a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, a light sensor, and a motion sensor.

[0227] The audio circuit 760, the speaker 761, and the microphone 762 can provide an audio interface between the user and the terminal device. The audio circuit 760 can transmit the electrical signal converted from the received audio data to the speaker 761, which is converted into a sound signal for output. The terminal device can also be equipped with a volume button for adjusting the volume of the sound signal. On the other hand, the microphone 762 converts the collected sound signal into an electrical signal, which is received by the audio circuit 760 and converted into audio data, and then the audio data is output to the communication component 710 to be sent to, for example, another terminal device, or the audio data is output to the memory 720 for further processing.

[0228] The Bluetooth module 770 is used to exchange information with other Bluetooth devices having Bluetooth modules through the Bluetooth protocol. For example, the terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smart watch) that also has a Bluetooth module through the Bluetooth module 770 to exchange data.

[0229] The processor 780 is the control center of the terminal device. It uses various interfaces and lines to connect various parts of the entire terminal. It executes various functions of the terminal device and processes data by running or executing software programs stored in the memory 720 and calling data stored in the memory 720. In some embodiments, the processor 780 may include one or more processing units; the processor 780 may also integrate an application processor and a baseband processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the baseband processor mainly processes wireless communications. It is understandable that the above-mentioned baseband processor may not be integrated into the processor 780. In the present application, the processor 780 can run the operating system, application programs, user interface display and touch response, as well as the attack detection method of the embodiment of the present application. In addition, the processor 780 is coupled to the display unit 730.

[0230] In some possible implementations, various aspects of the attack detection method provided by the present application may also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of the attack detection method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 3 Follow the steps shown in .

[0231] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0232] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on an electronic device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which can be used by or in combination with a command execution system, apparatus, or device.

[0233] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0234] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0235] Computer programs for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer program may be executed entirely on the user electronic device, partially on the user device, as a separate software package, partially on the user electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In the case of a remote electronic device, the remote electronic device may be connected to the user electronic device via any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external electronic device (e.g., via the Internet using an Internet service provider).

[0236] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0237] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0238] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain a computer-usable computer program.

[0239] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program commands. These computer program commands can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the command executed by the processor of the computer or other programmable data processing device produces a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0240] These computer program commands may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the commands stored in the computer-readable memory produce a manufactured product including a command device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0241] These computer program commands can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the commands executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0242] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0243] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An attack detection method, characterized in that: Applied to a server, the method comprises: In a current time period, a target request message for accessing a target resource sent by a target object is received, and the target request message is parsed to determine a resource set to which the target resource belongs; When it is determined that the target object has not accessed a resource in the resource set based on each historical request message sent by the target object in each historical time period, obtaining reference access rights of each reference object that has accessed the target resource in each historical time period; Determine the permission level relationship between the target access rights of the target object and each reference access right respectively, and when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, determine that the target request message is an attack message, wherein the first level relationship is a permission level relationship that conforms to the preset level relationship.

2. The method according to claim 1, characterized in that The preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the method further includes: If there is no reference object that has accessed the target resource within each historical time period, or the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then obtaining a historical Internet Protocol IP address of each historical request message, wherein the second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission; When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message, wherein the first condition is: the target IP address does not exist in each historical IP address, and the second condition is: the location of the target IP address does not exist in the respective locations of the historical IP addresses.

3. The method according to claim 2, characterized in that The method further comprises: If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within the first specified time period; Based on the historical resources requested to be accessed by each of the historical request messages, each unknown request message is screened out from each of the access request messages, wherein the resources requested to be accessed by the unknown request message do not exist in each of the historical resources; When the ratio of the number of the unknown request messages to the number of the access request messages is greater than a preset value, it is determined that the target request message is an attack message.

4. The method according to claim 2, characterized in that The method further comprises: If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtaining each access request message sent by the target object within a second specified time period; Parsing each access request message to determine a resource identifier of a resource to which each access request message requests access; When the relationship between the similarities between the resource identifiers meets the preset relationship, the target request message is determined to be an attack message.

5. The method according to claim 4, characterized in that When the relationship between the similarities between the resource identifiers meets the preset relationship, determining that the target request message is an attack message includes: Sorting the resource identifiers in lexicographic order to obtain sorted resource identifiers; For each sorted resource identifier, respectively calculate the similarity between every two adjacent resource identifiers to obtain each similarity; If there are two adjacent similarities that are not less than a preset similarity threshold, the target request message is an attack message.

6. The method according to any one of claims 1 to 5, characterized in that: The preset hierarchical relationship is used to indicate that the corresponding reference access right is higher than the target access right, and the method further includes: When the number of second level relationships in the permission level relationships is greater than a preset second number threshold, the target request message is determined to be a normal message, and the second level relationship is used to indicate that the corresponding reference access right is not higher than the target access right.

7. The method according to any one of claims 1 to 5, characterized in that: Before obtaining the reference access rights of the reference objects that have accessed the target resource in the historical time periods, the method further includes: Based on historical request messages sent by objects other than the target object within each historical time period, obtaining a first object that has accessed the resource set; When it is determined that there are second objects among the first objects whose corresponding access rights are not greater than the target access rights, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are filtered out from the first objects.

8. An attack detection device, characterized in that: include: A receiving unit, configured to receive a target request message sent by a target object for accessing a target resource within a current time period, and parse the target request message to determine a resource set to which the target resource belongs; an acquisition unit, configured to acquire, based on each historical request message sent by the target object in each historical time period, reference access rights of each reference object that has accessed the target resource in each historical time period when it is determined that the target object has not accessed a resource in the resource set; The first determination unit is used to respectively determine the permission level relationships between the target access rights of the target object and each reference access right, and to determine that the target request message is an attack message when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, wherein the first level relationship is a permission level relationship that conforms to a preset level relationship.

9. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of any one of the methods of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: It includes a computer program. When the computer program is run on an electronic device, the computer program is used to enable the electronic device to execute the steps of any method described in claims 1 to 7.

Images