An attack detection method and device, electronic equipment and storage medium

Abstract

The application relates to the technical field of network security, in particular to an attack detection method and device, electronic equipment and a storage medium, which are used to improve attack detection accuracy. The method comprises the following steps: in a current time period, a target request message sent by a target object for accessing a target resource is analyzed, and a resource set to which the target resource belongs is determined; when it is determined that the target object has not accessed resources in the resource set, reference access permissions of each reference object accessing the target resource in each historical time period are obtained; a permission level relationship between a target access permission of the target object and each reference access permission is determined respectively, and when the number of first level relationships in the permission level relationships is not less than a preset first number threshold, the target request message is determined as an attack message. The application can more accurately identify the attack behavior of the object by analyzing the historical access behavior and access permission of the object.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to an attack detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Unauthorized access refers to the attempt or successful access to a system, network, or data resource without authorization or permission. Such access may be carried out by internal personnel or external attackers, and typically involves bypassing security mechanisms, exploiting vulnerabilities, or abusing credentials. Unauthorized access can lead to the disclosure of sensitive information, data tampering, or system damage, posing a serious threat to an organization's security and privacy.

[0003] In related technologies, the detection of unauthorized access attacks mainly involves counting the number of times a visitor accesses resources within a short period. When the number of accesses exceeds a preset threshold, the visitor's behavior is considered an attack. However, this method fails to detect attacks that occur at a low frequency over a long period.

[0004] Therefore, improving the accuracy of attack detection has become an urgent problem to be solved. Summary of the Invention

[0005] This application provides an attack detection method, apparatus, electronic device, and storage medium to improve the accuracy of attack detection.

[0006] An attack detection method provided in this application includes:

[0007] Within the current time period, receive a target request message sent by the target object for accessing the target resource, parse the target request message, and determine the resource set to which the target resource belongs;

[0008] Based on the historical request messages sent by the target object within each historical time period, when it is determined that the target object has not accessed the resources in the resource set, the reference access permissions of each reference object that has accessed the target resource within each historical time period are obtained.

[0009] The permission level relationship between the target access permission of the target object and each reference access permission is determined respectively. When the number of first-level relationships in each permission level relationship is not less than a preset first number threshold, the target request message is determined to be an attack message. The first-level relationship is a permission level relationship that conforms to the preset level relationship.

[0010] Optionally, the preset level relationship is used to indicate that the corresponding reference access permission is higher than the target access permission, and the method further includes:

[0011] If, within each historical time period, there is no reference object that has accessed the target resource, or if the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then the historical Internet Protocol IP address of each historical request message is obtained. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0012] When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message. The first condition is that the target IP address does not exist in any of the historical IP addresses, and the second condition is that the location of the target IP address does not exist in the location of each of the historical IP addresses.

[0013] Optionally, the method further includes:

[0014] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the first specified time period;

[0015] Based on the historical resources requested by each of the historical request messages, unknown request messages are filtered out from the access request messages, wherein there are no resources requested by the unknown request messages in the historical resources.

[0016] When the ratio of the number of unknown request packets to the number of access request packets is greater than a preset value, the target request packet is determined to be an attack packet.

[0017] Optionally, the method further includes:

[0018] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the second specified time period;

[0019] Each access request message is parsed to determine the resource identifier of the resource requested by each access request message;

[0020] When the similarity relationship between resource identifiers conforms to a preset relationship, the target request message is determined to be an attack message.

[0021] Optionally, determining the target request message as an attack message when the relationship between the similarity of the resource identifiers conforms to a preset relationship includes:

[0022] The resource identifiers are sorted in lexicographical order to obtain the sorted resource identifiers.

[0023] For each sorted resource identifier, the similarity between every two adjacent resource identifiers is calculated to obtain each similarity score.

[0024] If there are two adjacent similarities that are both not less than a preset similarity threshold, then the target request message is an attack message.

[0025] Optionally, the preset level relationship is used to indicate that the corresponding reference access permission is higher than the target access permission, and the method further includes:

[0026] When the number of second-level relationships in each permission level relationship is greater than a preset second quantity threshold, the target request message is determined to be a normal message. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0027] Optionally, before obtaining the reference access permissions of each reference object that has accessed the target resource within each historical time period, the method further includes:

[0028] Based on the historical request messages sent by objects other than the target object within each historical time period, the first object that has accessed the resource set is obtained;

[0029] When it is determined that there is a second object in each of the first objects whose access permission is no greater than the target access permission, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are selected from each of the first objects.

[0030] An attack detection device provided in this application includes:

[0031] The receiving unit is configured to receive a target request message sent by the target object for accessing the target resource within the current time period, and to parse the target request message to determine the resource set to which the target resource belongs.

[0032] The acquisition unit is used to, based on the historical request messages sent by the target object in each historical time period, determine that the target object has not accessed the resources in the resource set, and then acquire the reference access permissions of each reference object that has accessed the target resource in each historical time period.

[0033] The first determining unit is used to determine the permission level relationship between the target access permission of the target object and each reference access permission, and to determine the target request message as an attack message when the number of first level relationships in each permission level relationship is not less than a preset first number threshold, wherein the first level relationship is a permission level relationship that conforms to the preset level relationship.

[0034] Optionally, the preset level relationship is used to characterize that the corresponding reference access permission is higher than the target access permission, and the device further includes a second determining unit, used for:

[0035] If, within each historical time period, there is no reference object that has accessed the target resource, or if the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then the historical Internet Protocol IP address of each historical request message is obtained. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0036] When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message. The first condition is that the target IP address does not exist in any of the historical IP addresses, and the second condition is that the location of the target IP address does not exist in the location of each of the historical IP addresses.

[0037] Optionally, the second determining unit is further configured to:

[0038] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the first specified time period;

[0039] Based on the historical resources requested by each of the historical request messages, unknown request messages are filtered out from the access request messages, wherein there are no resources requested by the unknown request messages in the historical resources.

[0040] When the ratio of the number of unknown request packets to the number of access request packets is greater than a preset value, the target request packet is determined to be an attack packet.

[0041] Optionally, the second determining unit is further configured to:

[0042] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the second specified time period;

[0043] Each access request message is parsed to determine the resource identifier of the resource requested by each access request message;

[0044] When the similarity relationship between resource identifiers conforms to a preset relationship, the target request message is determined to be an attack message.

[0045] Optionally, the second determining unit is specifically used for:

[0046] The resource identifiers are sorted in lexicographical order to obtain the sorted resource identifiers.

[0047] For each sorted resource identifier, the similarity between every two adjacent resource identifiers is calculated to obtain each similarity score.

[0048] If there are two adjacent similarities that are both not less than a preset similarity threshold, then the target request message is an attack message.

[0049] Optionally, the preset level relationship is used to characterize that the corresponding reference access permission is higher than the target access permission, and the device further includes a third determining unit, used for:

[0050] When the number of second-level relationships in each permission level relationship is greater than a preset second quantity threshold, the target request message is determined to be a normal message. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0051] Optionally, the device further includes a screening unit for:

[0052] Based on the historical request messages sent by objects other than the target object within each historical time period, the first object that has accessed the resource set is obtained;

[0053] When it is determined that there is a second object in each of the first objects whose access permission is no greater than the target access permission, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are selected from each of the first objects.

[0054] An electronic device provided in this application includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of any of the above-described attack detection methods.

[0055] This application provides a computer-readable storage medium including a computer program. When the computer program is run on an electronic device, the computer program is used to cause the electronic device to perform the steps of any of the above-described attack detection methods.

[0056] This application provides a computer program product, which includes a computer program stored in a computer-readable storage medium. When the processor of an electronic device reads the computer program from the computer-readable storage medium, the processor executes the computer program, causing the electronic device to perform the steps of any of the above-described attack detection methods.

[0057] The beneficial effects of this application are as follows:

[0058] This application provides an attack detection method, apparatus, electronic device, and storage medium. Within the current time period, it first determines the resource set to which the target resource requested by the target object belongs. If the target object has not accessed any resources in the determined resource set, it determines whether the target request message is an attack message by comparing the target object's target access permissions with the reference access permissions of each reference object that has accessed the target resource. Based on this method, by analyzing the target object's historical access behavior and combining it with the target object's access permissions, multi-dimensional information is integrated, enabling a more accurate understanding of the context and business logic of the target object's access behavior, thereby accurately identifying attack behavior and effectively improving the accuracy of attack detection.

[0059] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0060] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0061] Figure 1A This is a schematic diagram of attack detection methods in related technologies;

[0062] Figure 1BThis is an optional schematic diagram of an application scenario in an embodiment of this application;

[0063] Figure 2 This is a schematic diagram of a request resource tree in an embodiment of this application;

[0064] Figure 3 This is a flowchart illustrating the implementation of an attack detection method according to an embodiment of this application.

[0065] Figure 4 This is an overall flowchart of an attack detection method according to an embodiment of this application;

[0066] Figure 5 A schematic diagram of the structure of an attack detection device in an embodiment of this application;

[0067] Figure 6 This is a schematic diagram of the hardware structure of an electronic device using an embodiment of this application;

[0068] Figure 7 This is a schematic diagram of the hardware structure of another electronic device using an embodiment of this application. Detailed Implementation

[0069] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0070] The following describes some of the concepts involved in the embodiments of this application.

[0071] User and Entity Behavior Analytics (UEBA) is a technology that detects anomalous activity and potential threats by analyzing the behavioral patterns of users and entities (such as websites and applications). UEBA systems utilize big data analytics and artificial intelligence (AI) technologies to build baseline behavioral models and continuously monitor and compare the differences between current behavior and the baseline to identify potential security threats. Unlike traditional rule-based methods, UEBA places greater emphasis on behavioral analysis and contextual understanding, enabling it to detect more complex and covert attacks. The attack detection method in this application uses UEBA technology to improve the accuracy of attack detection.

[0072] Unauthorized access refers to the attempt or successful access to a system, network, or data resource without authorization or permission. Such access may be carried out by insiders or external attackers, and typically involves bypassing security mechanisms, exploiting vulnerabilities, or abusing credentials. Unauthorized access can lead to the disclosure of sensitive information, data tampering, or system damage, posing a serious threat to an organization's security and privacy.

[0073] Long-tail attacks are low-frequency but persistent attack patterns where attackers execute attacks at a low frequency over an extended period to avoid triggering frequent detection mechanisms in traditional security systems. These attacks are typically dispersed and covert, making them difficult to detect through short-term statistical analysis. The goals of long-tail attacks may include gradually gaining system privileges, collecting sensitive information, or implanting persistent threats into the system, posing a significant challenge to security protection. The attack detection method in this application can effectively identify long-tail attacks by analyzing users' historical behavior.

[0074] The design concept of this application is briefly introduced below:

[0075] Unauthorized access refers to the attempt or successful access to a system, network, or data resource without authorization or permission. Such access may be carried out by internal personnel or external attackers, and typically involves bypassing security mechanisms, exploiting vulnerabilities, or abusing credentials. Unauthorized access can lead to the disclosure of sensitive information, data tampering, or system damage, posing a serious threat to an organization's security and privacy.

[0076] In related technologies, such as Figure 1A As shown, when detecting unauthorized access attacks, user access logs are analyzed in real time and preprocessed. Static rule matching and simple frequent item statistics are then used, and an alarm is output when the matching or statistical results reach a threshold. These methods have significant limitations in dealing with complex and novel attacks. Attackers often bypass security device detection through slowly changing request paths, account impersonation / theft, etc., making it difficult to trigger alarm thresholds based on a single rule or frequent item analysis. For example, by counting the number of times a visitor accesses resources within a short period and judging the visitor's behavior as an attack when the number of accesses exceeds a preset threshold, this method fails to detect attacks performed at a low frequency over a long period.

[0077] Therefore, improving the accuracy of attack detection has become an urgent problem to be solved.

[0078] In view of this, embodiments of this application provide an attack detection method, apparatus, electronic device, and storage medium. Within the current time period, the resource set to which the target resource requested by the target object belongs is first determined. If the target object has not accessed resources in the determined resource set, the permission level relationship between the target object's target access permissions and the reference access permissions of each reference object that has accessed the target resource is compared to determine whether the target request message is an attack message. Based on the above method, by analyzing the target object's historical access behavior and combining it with the target object's access permissions, multi-dimensional information is integrated, enabling a more accurate understanding of the context and business logic of the target object's access behavior, thereby accurately identifying attack behavior and effectively enhancing the accuracy of attack detection.

[0079] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0080] like Figure 1B The diagram shown is an application scenario illustration of an embodiment of this application. The application scenario diagram includes two terminal devices 110 and one server 120.

[0081] In this application embodiment, the terminal device includes, but is not limited to, mobile phones, tablets, laptops, desktop computers, e-book readers, smart voice interaction devices, smart home appliances, and in-vehicle terminals. The terminal device may have an attack detection-related client installed. This client can be software (such as a browser, security software, etc.), or a webpage, mini-program, etc. The server is the backend server corresponding to the software, webpage, mini-program, etc., or a server specifically used for attack detection; this application does not impose specific limitations. The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0082] It should be noted that the attack detection method in this application embodiment can be executed by an electronic device, which can be a server or a terminal device. That is, the method can be executed by the server or the terminal device alone, or by the server and the terminal device together.

[0083] In one alternative implementation, the terminal device and the server can communicate via a communication network.

[0084] In one alternative implementation, the communication network is a wired network or a wireless network.

[0085] It should be noted that, Figure 1B The examples shown are merely illustrative; in reality, the number of terminal devices and servers is unlimited and is not specifically limited in the embodiments of this application.

[0086] The attack detection method provided by the exemplary embodiments of this application will be described below with reference to the accompanying drawings and the application scenarios described above. It should be noted that the application scenarios described above are only shown to facilitate understanding of the spirit and principles of this application, and the embodiments of this application are not limited in any way in this respect.

[0087] Each time the server receives and processes a user's request message, it generates a corresponding user access log. The user access log contains relevant information about the request message. Before executing the attack detection method in this embodiment, the user access log needs to be batch-processed periodically.

[0088] Step 1: Data Preprocessing

[0089] 1) Key field extraction: Initial / periodic batch analysis of historical user access logs, filtering out and not analyzing logs whose status codes do not start with "4" or "5" and which were previously judged as unauthorized access attacks, and standardizing information such as Uniform Resource Locator (URL), request method, request parameters, response status code, user identifier (id), assigned role, login IP, and current batch time (segment_time);

[0090] 2) Data grouping: Group data according to role ID and user ID, and analyze the resources that different roles and users can access, the parameters they submit, and the response message information.

[0091] After data preprocessing, we can obtain Figure 2 The data in the table, where each row number represents information extracted from the corresponding user access logs.

[0092] Step 2: Generate a request resource tree for each user.

[0093] 1) Create the root node: e.g. Figure 2 As shown, the request resource tree contains user 1 and user 2. First, create the root node " / ", split the path according to the separator (slash / ), extract each path segment, and count the number of times each path segment appears in the same position.

[0094] 2) Mark dynamic path parameters: For path segments that appear frequently and have different content, mark them as dynamic path parameters. Use regular expressions to replace the dynamic part in the path with placeholders. For example, {number} means to replace the numeric parameter value with a placeholder, and {string} means to replace the character parameter value with a placeholder.

[0095] 3) Constructing tree nodes level by level: The request method is the second-level node, in Figure 2 The middle part is "GET", from the third-level node ( Figure 2 Starting with "api" in the middle, the tree nodes are built or searched level by level down from the split path. Each path part represents a node, and a new node is created if the node does not exist.

[0096] 4) Record key-value pairs of request parameters: In the target node, record the request parameters for each requested resource to form a `req_map` variable. For RESTful API path parameters, use the layer number as the variable name; for example, the fifth layer is named `leaf5`. For request parameters, use key-value pairs, and the value is a list of all values ​​that have appeared in historical logs, sorted chronologically by request time. Finally, convert all request parameters to JSON format and record the time information for the current batch. See details... Figure 2 The `req_map` column.

[0097] Step 3: Record the correspondence between users and IP addresses.

[0098] Record the user ID's historical IP address, IP location, login time, and other information. If the historical IP address is an internal network IP address, trace it back to the public network IP address used for access and store the data in the database.

[0099] After the above processing, it is possible to determine whether the target object and other objects have accessed the target resource and the resource set to which the target resource belongs by querying the request resource tree of each user.

[0100] See Figure 3 The diagram shown is a flowchart of an attack detection method provided in this application. Taking a server as the executing entity, the specific implementation process of this method includes the following steps S31-S34:

[0101] S31: Within the current time period, the server receives a target request message sent by the target object for accessing the target resource, parses the target request message, and determines the resource set to which the target resource belongs.

[0102] Specifically, the target object sends a target request message to the server to request access to the target resource. The target request message contains the URL of the target resource, which identifies the resource set to which the target resource belongs. In the following explanation, we will use resource set 1 as an example. The length of each time period can be set according to requirements, such as 1 week, 1 day, 1 hour, etc.

[0103] After determining the resource set to which the target resource belongs, the first step is to determine whether any object has accessed resource set 1 in previous historical time periods. Optionally, if the target object has not accessed resource set 1, but other objects have accessed resource set 1, then the following steps are performed:

[0104] Based on historical request messages sent by objects other than the target object within each historical time period, obtain the first object of the resource set that has been accessed; determine that there is a second object in each first object whose access permission is no greater than the target access permission, and when the number of second objects is greater than a preset number threshold, filter out the reference objects that have accessed the target resource from each first object.

[0105] Specifically, objects other than the target object can be called other objects. By analyzing the historical request messages of other objects, the first object that has accessed resource set 1 is selected from the other objects. At this time, it is necessary to compare the access permissions of the first object with the target access permissions of the target object. If the access permissions of the first object are equal to or lower than the target access permissions, that is, there is a second object, and the number of second objects is greater than the preset number threshold, then reference objects are selected from each first object for further judgment.

[0106] Taking a preset quantity threshold of 1 as an example, assuming that the access permissions from low to high are: level 1, level 2, level 3, level 4, and level 5, the target access permission is level 3, object 1 has access permission level 1, object 2 has access permission level 4, object 3 has access permission level 3, object 4 has access permission level 2, and object 5 has access permission level 4, then the second objects are object 1, object 3, and object 4, and the number of second objects is 3, which is greater than 1. Further combining the resources accessed by each first object, the reference objects that have accessed the target resource are object 1, object 2, and object 3.

[0107] If the access permissions of each first object are higher than the target access permissions of the target object, then the target request message can be directly identified as an attack message.

[0108] S32: Based on the historical request messages sent by the target object within each historical time period, when the server determines that the target object has not accessed the resources in the resource set, it obtains the reference access permissions of each reference object that has accessed the target resource within each historical time period.

[0109] Specifically, if the target object has not accessed any resources in the resource set, it is necessary to make a judgment based on the access permissions of the reference objects that have accessed the target resources.

[0110] S33: The server determines the permission level relationship between the target access permission of the target object and each reference access permission, and determines the target request message as an attack message when the number of first-level relationships in each permission level relationship is not less than the preset first number threshold.

[0111] The first-level relationship is a permission level relationship that conforms to a preset level relationship. For example, a preset level relationship is used to indicate that the corresponding reference access permission is higher than the target access permission, or a preset level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission. In this embodiment, the example of a preset level relationship indicating that the corresponding reference access permission is higher than the target access permission is mainly used for explanation.

[0112] For example, if the target access permission is level 2, the reference access permission 1 is level 3, the reference access permission 2 is level 2, the reference access permission 3 is level 1, the reference access permission 4 is level 4, and the reference access permission 5 is level 5, and taking the first quantity threshold of 3 as an example, the number of first-level relationships is 3, thus determining that the target request message is an attack message.

[0113] If all reference access permissions are higher than the target access permissions, the target request message can be directly identified as an attack message. Under this rule, the first quantity threshold can be set according to the number of reference objects, and the first quantity threshold is equal to the number of reference objects.

[0114] In this embodiment, within the current time period, the resource set to which the target resource requested by the target object belongs is first determined. If the target object has not accessed any resources in the determined resource set, the permission level relationship between the target object's target access permission and the reference access permissions of each reference object that has accessed the target resource is compared to determine whether the target request message is an attack message. Based on the above method, by analyzing the target object's historical access behavior and combining it with the target object's access permissions, multi-dimensional information is integrated, enabling a more accurate understanding of the context and business logic of the target object's access behavior, thereby accurately identifying attack behavior and effectively enhancing the accuracy of attack detection.

[0115] Optionally, if the number of second-level relationships in each permission level relationship is greater than a preset second quantity threshold, the target request message is determined to be a normal message.

[0116] The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission. Taking the second quantity threshold of 1 as an example, when the quantity of the second-level relationship is greater than 1, the target request message can be judged as a normal message, and the target resource can be returned to the target object for access.

[0117] Optionally, if there is no reference object that has accessed the target resource within each historical time period, or if the number of second-level relationships in each permission level relationship is equal to the preset second number threshold, then obtain the historical IP address of each historical request message; when the target IP address meets the first condition and the location of the target IP address meets the second condition, determine that the target request message is an attack message.

[0118] The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission. The first condition is that the target IP address does not exist in each historical IP address, and the second condition is that the target IP address does not exist in the home region of each historical IP address.

[0119] In this method, the second quantity threshold can be 1. That is, when only one reference object's access permission is not greater than the target access permission, the target IP address and location of the target object's current target request message are further combined to determine whether the target object's login behavior is abnormal. When the target IP address and location have not appeared in the target object's previous accesses, the target request message is determined to be an attack message.

[0120] If the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be a normal message.

[0121] Optionally, if the target IP address meets the first condition but the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition but the location of the target IP address meets the second condition, then the behavior pattern of the target object is further compared, and the judgment is made in the following three ways:

[0122] Method 1:

[0123] Obtain all access request messages sent by the target object within a first specified time period; based on the historical resources requested by each historical request message, filter out each unknown request message from the access request messages, wherein there are no resources requested by the unknown request messages in the historical resources; when the ratio of the number of unknown request messages to the number of access request messages is greater than a preset value, determine that the target request message is an attack message.

[0124] Specifically, the system counts the number of access request packets M sent by the target object within the first specified time period, the number of unknown request packets N1, the number of candidate request packets N2, and the resource set to which the candidate request packet requests access does not exist in the resource set to which each historical resource belongs. The default value is set to a. When the ratio of N1 to M is greater than a, or the ratio of N2 to M is greater than a, the target request packet is determined to be an attack packet. The value of a can be set according to requirements.

[0125] By using the above method, the proportion of resources or resource sets that the target object has not previously requested can be counted to determine whether the current access is normal.

[0126] Method 2:

[0127] S41: Obtain each access request message sent by the target object within the second specified time period;

[0128] S42: Parse each access request message to determine the resource identifier of the resource requested by each access request message;

[0129] S43: When the relationship between the similarity of the resource identifiers conforms to the preset relationship, the target request message is determined to be an attack message.

[0130] Specifically, the validity of the access is determined by analyzing the relationships between the resources requested by the target object. The similarity between resource identifiers can be calculated using various methods, such as edit distance and cosine similarity, without specific limitations here.

[0131] Optionally, step S43 can be implemented as follows:

[0132] Sort the resource identifiers in lexicographical order to obtain the sorted resource identifiers; for each sorted resource identifier, calculate the similarity between every two adjacent resource identifiers to obtain each similarity; if there are two adjacent similarities that are not less than the preset similarity threshold, then the target request message is an attack message.

[0133] Specifically, the similarity between two resource identifiers is calculated using edit distance. The similarity threshold is the number of edits. In this application, we take 1 as an example. A similarity not less than the preset similarity threshold means that the number of edits is less than or equal to 1. For example, for the sorted resource identifiers [131, 1311, 13111, 131111], the similarity threshold is 1. The edit distance between 131 and 1311 is 1, the edit distance between 1311 and 13111 is 1, and the edit distance between 13111 and 131111 is 1. The adjacent edit distances are equal to 1, and the target request message is determined to be an attack message.

[0134] In practice, firstly, the value (resource identifier) ​​of all request parameters is extracted sequentially. For example, for a certain JSON key, the extracted value represents a list of strings called params that all parameters requested by that key variable in the recent period are params. Then, params is sorted lexicographically.

[0135] An empty list `chains` is initialized to store all continuously changing chains. A list `current_chain` is initialized to store the current continuously changing string, starting with `params[0]`. Starting from `params[1]`, the list of strings is traversed. If the edit distance between the current string and the previous string is less than or equal to the threshold 1 (meaning that the difference between the two strings is allowed to be at most one edit operation), the current string is added to `current_chain`. Otherwise, `current_chain` is added to `chains`, and `current_chain` is reinitialized to the current string. After traversal, the last `current_chain` is added to `chains`. All `chains` are traversed, and if the length of any chain is greater than or equal to 3, it is considered unauthorized access.

[0136] For example, the following request sequence exists:

[0137] / GRT / api / username / aba

[0138] / GRT / api / username / abaaa

[0139] / GRT / api / username / abc

[0140] / GRT / api / username / abd

[0141] / GRT / api / username / abaa

[0142] / GRT / api / username / abb

[0143] After extracting the resource identifiers and sorting them lexicographically, we get: ["aba", "abaa", "abaaa", "abb", "abc", "abd"]. We use a sliding window method to traverse the sorted resource identifiers and calculate the edit distance of each pair of adjacent resource identifiers. If the edit distance is less than or equal to 1, the pair of resource identifiers is considered to be continuously changing, and the pair of resource identifiers is connected to the current chain. In this way, we obtain two continuously changing chains, ["aba", "abaa", "abaaa"] and ["abb", "abc", "abd"]. We traverse the generated chains. If any chain contains at least three identifiers, the target request message is judged as an attack message, i.e., unauthorized access.

[0144] Method 3:

[0145] Get the X most recent request messages sent by the target object, and find the Q request messages. The number of request messages whose requested resource sets belong to the resource sets of historical resources is Y. If the ratio of X to Y is less than a preset ratio, the target request message is determined to be an attack message.

[0146] By analyzing the relationship between users' historical behavior and requested resources, this application can better understand the context and business logic of user operations. For example, abnormal user login behavior, comparison of users' own behavior patterns, and comparison of behavior patterns among users can more accurately identify complex attack behaviors. However, traditional unauthorized detection methods, static rules, and frequency statistics methods cannot fully understand the context and business logic of user behavior, making it difficult to deal with complex, multi-step attacks.

[0147] Based on the above method, historical behavior logs marked as attack packets are filtered out, and normal logs are used to improve the request resource tree in the next time period.

[0148] Taking a common new attack method—a legitimate but anomalous sequence of requests—as an example, suppose there is a user A in the system. By analyzing historical access logs and performing data preprocessing, we can obtain user A's request resource tree. User A sent the following request messages over a period of time:

[0149] 1.10188user GET / api / data / 131 113.65.33.126X city

[0150] 2.10188user GET / api / data / 131111 113.65.33.126X city

[0151] 3.10188user GET / api / data / 1311 113.65.33.126X city

[0152] 4.10188user GET / api / data / 13111 113.65.33.126X city

[0153] (1) The request will be converted to / api / data / {number} for processing during the preprocessing stage, and will first be retrieved in the user request resource tree;

[0154] (2) The first requested resource node exists and the user has accessed the resource. The parameters can be found in req_map. It is considered a normal request, that is, this request message is a normal message.

[0155] (3) The second requested resource node / api / data / {number} exists and the user has accessed the resource, but the parameter cannot be found in req_map. The decision model turns to the pattern comparison between users. Assuming that other users have not accessed the resource / api / data / {number} and the dynamic path parameter is 131111, it is directly determined to be pending.

[0156] (4) The user logs in with a common IP address and a common location. In the comparison of user behavior patterns, the current / api / data / {number} already exists in the request resource tree and does not meet the frequent item statistics condition.

[0157] (5) If the edit distance between two adjacent strings is less than or equal to the set threshold 1, they are considered to be continuously changing and are linked to the current chain. If the length of any chain is greater than or equal to 3, it is determined to be unauthorized access, that is, this request message is an attack message.

[0158] (6) Continue to determine whether the parameters of the most recently requested resource meet the threshold of the edit distance. At this time, the continuous change chain contains 0 strings, and the sorted result is ['131', '131111'], the edit distance = 3. The user's most recently requested / api / data / {number} completely overlaps with the historical requested resource, so it is determined to be a normal request. At this time, the request is allowed and put into the analysis queue.

[0159] (7) The judgment process for the third request is the same as in 3), but other users have not accessed the resource / api / data / {number} and the dynamic path parameter is 1311, so the result is determined to be pending;

[0160] (8) The third request extracts the dynamic path request parameters. The sorted result is ['131', '1311', '131111']. The edit distance between '131' and '1311' is 1, so they are linked into the same chain. The edit distance between '1311' and '131111' is 3, so they cannot be linked into the same chain. The current chain ends, and a new chain begins. The generated chain of continuously changing strings is: [['131', '1311'], ['131111']]. At this point, the longest chain ['131', '1311'] has only 2 strings, which does not reach the threshold, so it is judged as a normal request. The request is then allowed and added to the analysis queue.

[0161] (9) The judgment process for the fourth request is the same as in 3), but if other users have not accessed the resource / api / data / {number} and the dynamic path parameter is 131111, then it is directly judged as pending.

[0162] (10) At this point, for / api / data / {number}, the result of sorting the parameters of the dynamic path is ['131','1311','13111','131111']. The edit distance between '131' and '1311' is 1, so they are linked into the same chain. The edit distance between '1311' and '13111' is 1, so they are also linked into the same chain. The edit distance between '13111' and '131111' is 1, so they continue to be linked into the same chain. The generated chain of continuously changing strings is: [['131', '1311', '13111', '131111']]. Traverse all the generated chains of continuously changing strings. If any chain of continuously changing strings contains at least three strings, it is determined to be unauthorized access. At this point, the length of the continuous change chain [['131', '1311', '13111', '131111']] is 4 (greater than or equal to 3), so it is judged as unauthorized access and an alarm is output.

[0163] like Figure 4 The diagram shown is a schematic representation of the overall process of an attack detection method according to an embodiment of this application, including the following steps:

[0164] S401: Receive the target request message and determine the resource set to which the target resource belongs;

[0165] S402: Has any user accessed this resource collection? If yes, execute S403; otherwise, execute S410.

[0166] S403: Has the target object accessed this resource collection? If yes, execute S404; otherwise, execute S405.

[0167] S404: Has the target object accessed the target resource? If yes, execute S414; otherwise, execute S405.

[0168] S405: Have other users accessed the target resource? If yes, execute S406; otherwise, execute S410.

[0169] S406: Determine a first number of other objects that have accessed this resource set whose access permissions are no higher than the target access permissions;

[0170] S407: Is the first quantity greater than or equal to 1? If it is greater than 1, execute S408; if it is equal to 1, execute S410; if it is less than 1, execute S415.

[0171] S408: Determine a second number of reference access permissions of reference objects that have accessed the target resource that is no higher than the target access permission.

[0172] S409: Is the second quantity greater than or equal to 1? If it is greater than 1, execute S414; if it is equal to 1, execute S410; if it is less than 1, execute S415.

[0173] S410: Does the target IP address meet the first condition and does the location of the target IP address meet the second condition? If yes, proceed to S415; otherwise, proceed to S411.

[0174] S411: Does the ratio of the set of unaccessed resources requested by the target object within the first specified time period exceed a preset value? If yes, execute S412; otherwise, execute S415.

[0175] S412: The similarity relationship between the resources requested by the target object within the second specified time period conforms to the preset relationship. If yes, execute S415; otherwise, execute S413.

[0176] S413: Does the overlap of the resource sets requested in the N most recent requests of the target object exceed a preset ratio? If yes, execute S414; otherwise, execute S415.

[0177] S414: Normal message;

[0178] S415: Attack message.

[0179] The unique multi-dimensional unauthorized access decision tree model in this application integrates multi-dimensional information, including user behavior sequence analysis and request resource similarity calculation, to determine unauthorized access from different perspectives. This multi-dimensional analysis improves the breadth and depth of detection. However, traditional unauthorized access detection methods, based on high-frequency access statistics rules, can play a certain role in detecting high-frequency access in the short term, but their ability to identify long-term, low-frequency, and dispersed attacks (such as slow attacks) is insufficient.

[0180] The attack detection method in this application embodiment can be generally divided into the following steps:

[0181] Step 1: Perform initial / periodic batch analysis of historical user access logs, group users according to system roles and users, and generate a user request resource tree for each user;

[0182] Step 2: For path segments that appear frequently and have different content, mark them as dynamic path parameters, use regular expressions to replace the dynamic parts in the path with placeholders, and mark the historical request parameters on the leaf nodes of the tree. At this point, the unique user request resource tree has been initialized.

[0183] Step 3: Perform initial / periodic batch analysis of historical user access logs, identify the relationship between user IDs and their historical login IPs and IP locations, and store the results in the database;

[0184] Step 4: After initialization is complete, analyze user access logs in real time, load user request resource tree and user historical login information into program memory, and build a unique unauthorized access decision tree model based on abnormal user login behavior, comparison of behavior patterns between users, and comparison of user behavior patterns. When the decision tree alarm conditions are met, an unauthorized access alarm is generated in real time.

[0185] Step 5: Cache normal logs, read cached data in the next batch and filter false alarms from manual auditing (optional), and continue to repeat steps 1) to 3) to improve the user request resource tree and strengthen the unauthorized access decision model.

[0186] The unique dynamic behavior analysis of the request resource tree in this embodiment constructs a request resource tree and analyzes the mapping relationship between users and their historical login IPs. It accurately identifies attackers from multiple perspectives, including abnormal user login behavior and comparison of user behavior patterns. This method can more flexibly respond to dynamically changing attack paths, improving the accuracy and real-time performance of detection. However, traditional unauthorized access detection methods often cannot cover novel attack methods using conventional static rules. For example, static rules struggle to detect dynamically changing attack paths such as legitimate but abnormal request sequences and low-privilege accounts accessing high-privilege resources laterally.

[0187] Based on the same inventive concept, embodiments of this application also provide an attack detection device. For example... Figure 5 As shown, this is a schematic diagram of the attack detection device 500, which may include:

[0188] The receiving unit 501 is used to receive a target request message sent by the target object for accessing the target resource within the current time period, and to parse the target request message to determine the resource set to which the target resource belongs.

[0189] The acquisition unit 502 is used to acquire the reference access permissions of each reference object that has accessed the target resource in each historical time period when it is determined that the target object has not accessed the resource in the resource set based on the historical request messages sent by the target object in each historical time period.

[0190] The first determining unit 503 is used to determine the permission level relationship between the target access permission of the target object and each reference access permission, and to determine the target request message as an attack message when the number of first-level relationships in each permission level relationship is not less than a preset first quantity threshold, wherein the first-level relationship is a permission level relationship that conforms to the preset level relationship.

[0191] Optionally, a preset hierarchy is used to indicate that the corresponding reference access permission is higher than the target access permission. The device also includes a second determining unit 504, used for:

[0192] If there is no reference object that has accessed the target resource within each historical time period, or if the number of second-level relationships in each permission level relationship is equal to the preset second number threshold, then obtain the historical Internet Protocol IP address of each historical request message. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0193] If the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request packet is determined to be an attack packet. The first condition is that the target IP address does not exist in any of the historical IP addresses, and the second condition is that the location of the target IP address does not exist in the location of each of the historical IP addresses.

[0194] Optionally, the second determining unit 504 is also used for:

[0195] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the first specified time period.

[0196] Based on the historical resources requested by each historical request message, unknown request messages are filtered out from each access request message. Among them, there are no resources requested by unknown request messages in each historical resource.

[0197] When the ratio of the number of unknown request packets to the number of access request packets is greater than a preset value, the target request packet is determined to be an attack packet.

[0198] Optionally, the second determining unit 504 is also used for:

[0199] If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the second specified time period.

[0200] Each access request message is parsed to determine the resource identifier of the resource that each access request message requests to access;

[0201] When the similarity relationship between resource identifiers matches a preset relationship, the target request message is identified as an attack message.

[0202] Optionally, the second determining unit 504 is specifically used for:

[0203] Sort the resource identifiers in lexicographical order to obtain the sorted resource identifiers;

[0204] For each sorted resource identifier, the similarity between every two adjacent resource identifiers is calculated to obtain each similarity score.

[0205] If two adjacent requests have similarities that are both not less than a preset similarity threshold, then the target request message is an attack message.

[0206] Optionally, a preset hierarchy is used to indicate that the corresponding reference access permission is higher than the target access permission. The device also includes a third determining unit 505, used for:

[0207] When the number of second-level relationships in each permission level relationship is greater than the preset second number threshold, the target request message is determined to be a normal message. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

[0208] Optionally, the device also includes a screening unit 506 for:

[0209] Based on the historical request messages sent by objects other than the target object within each historical time period, obtain the first object that has accessed the resource set;

[0210] If it is determined that there is a second object in each first object whose access permission is no greater than the target access permission, and the number of second objects is greater than a preset number threshold, then reference objects that have accessed the target resource are selected from each first object.

[0211] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0212] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0213] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0214] Based on the same inventive concept as the above-described method embodiments, this application also provides an electronic device. In one embodiment, the electronic device may be a server, such as... Figure 1B The server is shown. In this embodiment, the structure of the electronic device can be as follows. Figure 6 As shown, it includes a memory 601, a communication module 603, and one or more processors 602.

[0215] The memory 601 is used to store computer programs executed by the processor 602. The memory 601 may mainly include a program storage area and a data storage area. The program storage area may store the operating system and programs required to run instant messaging functions, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0216] Memory 601 may be volatile memory, such as random-access memory (RAM); memory 601 may also be non-volatile memory, such as read-only memory, flash memory, hard disk drive (HDD), or solid-state drive (SSD); or memory 601 may be any other medium capable of carrying or storing a desired computer program having the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 601 may be a combination of the above-described memories.

[0217] Processor 602 may include one or more central processing units (CPUs) or digital processing units, etc. Processor 602 is used to implement the above-mentioned attack detection method when calling computer programs stored in memory 601.

[0218] The communication module 603 is used to communicate with terminal devices and other servers.

[0219] This application embodiment does not limit the specific connection medium between the memory 601, communication module 603, and processor 602 described above. This application embodiment... Figure 6 The memory 601 and the processor 602 are connected via a bus 604, and the bus 604 is in Figure 6 The diagram uses thick lines to describe the connections between other components; these are for illustrative purposes only and should not be considered limiting. The 604 bus can be divided into address bus, data bus, control bus, etc. For ease of description, Figure 6 It is described using only a thick line, but does not indicate that there is only one bus or one type of bus.

[0220] The memory 601 stores a computer storage medium, which stores computer-executable instructions for implementing the attack detection method of this application embodiment. The processor 602 is used to execute the above-described attack detection method, such as... Figure 3 As shown.

[0221] In another embodiment, the electronic device may also be other electronic devices, such as... Figure 1B The terminal device is shown. In this embodiment, the electronic device can be structured as follows. Figure 7 As shown, it includes components such as a communication component 710, a memory 720, a display unit 730, a camera 740, a sensor 750, an audio circuit 760, a Bluetooth module 770, and a processor 780.

[0222] The communication component 710 is used to communicate with the server. In some embodiments, it may include a Wireless Fidelity (WiFi) module, which is a short-range wireless transmission technology. Electronic devices can use the WiFi module to help users send and receive information.

[0223] The memory 720 can be used to store software programs and data. The processor 780 executes various functions of the terminal device and data processing by running the software programs or data stored in the memory 720. The memory 720 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The memory 720 stores an operating system that enables the terminal device to run. In this application, the memory 720 can store the operating system and various application programs, and may also store computer programs that execute the attack detection method of the embodiments of this application.

[0224] The display unit 730 can also be used to display information input by the user or information provided to the user, as well as various menus of the terminal device, forming a graphical user interface (GUI). Specifically, the display unit 730 may include a display screen 732 disposed on the front of the terminal device. The display screen 732 may be configured as a liquid crystal display, a light-emitting diode, or the like. The display unit 730 can be used to display the attack detection user interface, etc., as described in the embodiments of this application.

[0225] The display unit 730 can also be used to receive input digital or character information and generate signal inputs related to user settings and function control of the terminal device. Specifically, the display unit 730 may include a touch screen 731 disposed on the front of the terminal device, which can collect user touch operations on or near it, such as clicking buttons, dragging scroll boxes, etc. The touch screen 731 can cover the display screen 732, or the touch screen 731 and the display screen 732 can be integrated to realize the input and output functions of the terminal device; the integrated screen can be referred to as a touch display screen. In this application, the display unit 730 can display applications and corresponding operation steps. The camera 740 can be used to capture still images, and users can post comments on the images captured by the camera 740 through the application. There can be one or multiple cameras 740. An object generates an optical image through a lens and projects it onto a photosensitive element. The photosensitive element can be a charge-coupled device (CCD) or a complementary metal-oxide-semiconductor (CMOS) phototransistor. The photosensitive element converts the light signal into an electrical signal, which is then transmitted to the processor 780 to be converted into a digital image signal.

[0226] The terminal device may also include at least one sensor 750, such as an accelerometer 751, a proximity sensor 752, a fingerprint sensor 753, and a temperature sensor 754. The terminal device may also be equipped with other sensors such as a gyroscope, barometer, hygrometer, thermometer, infrared sensor, light sensor, and motion sensor.

[0227] Audio circuitry 760, speaker 761, and microphone 762 provide an audio interface between the user and the terminal device. Audio circuitry 760 converts received audio data into electrical signals, which are then transmitted to speaker 761, where they are converted into sound signals for output. The terminal device can also be equipped with volume buttons for adjusting the volume of the sound signal. Conversely, microphone 762 converts collected sound signals into electrical signals, which are then received by audio circuitry 760, converted back into audio data, and output to communication component 710 for transmission to, for example, another terminal device, or to memory 720 for further processing.

[0228] The Bluetooth module 770 is used to interact with other Bluetooth devices that also have a Bluetooth module via the Bluetooth protocol. For example, a terminal device can establish a Bluetooth connection with a wearable electronic device (such as a smartwatch) that also has a Bluetooth module through the Bluetooth module 770, thereby exchanging data.

[0229] The processor 780 is the control center of the terminal device, connecting various parts of the terminal through various interfaces and lines. It executes software programs stored in the memory 720 and calls data stored in the memory 720 to perform various functions and process data. In some embodiments, the processor 780 may include one or more processing units; the processor 780 may also integrate an application processor and a baseband processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the baseband processor mainly handles wireless communication. It is understood that the baseband processor may not be integrated into the processor 780. In this application, the processor 780 can run the operating system, applications, user interface display and touch response, as well as the attack detection method of this application embodiment. Furthermore, the processor 780 is coupled to the display unit 730.

[0230] In some possible implementations, various aspects of the attack detection method provided in this application can also be implemented in the form of a program product, which includes a computer program. When the program product is run on an electronic device, the computer program causes the electronic device to perform the steps in the attack detection method according to the various exemplary embodiments of this application described above. For example, the electronic device can perform actions such as... Figure 3 The steps are shown in the figure.

[0231] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0232] The program product of the embodiments of this application may employ a portable compact disc read-only memory (CD-ROM) and include a computer program, and may run on an electronic device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0233] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a readable computer program. This propagated data signal may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device.

[0234] Computer programs contained on readable media may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0235] Computer programs for performing the operations of this application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The computer program can execute entirely on the user's electronic device, partially on the user's device, as a standalone software package, partially on the user's electronic device and partially on a remote electronic device, or entirely on a remote electronic device or server. In cases involving remote electronic devices, the remote electronic device can be connected to the user's electronic device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external electronic device (e.g., via the Internet using an Internet service provider).

[0236] It should be noted that although several units or sub-units of the device have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units.

[0237] Furthermore, although the operations of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0238] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing a computer-usable computer program.

[0239] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0240] These computer program commands may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the commands stored in the computer-readable storage medium produce an article of manufacture including command means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0241] These computer program commands may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the commands executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0242] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0243] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An attack detection method, characterized in that, Applied to a server, the method includes: Within the current time period, receive a target request message sent by the target object for accessing the target resource, parse the target request message, and determine the resource set to which the target resource belongs; Based on the historical request messages sent by the target object within each historical time period, when it is determined that the target object has not accessed the resources in the resource set, the reference access permissions of each reference object that has accessed the target resource within each historical time period are obtained. The permission level relationships between the target access permission of the target object and each reference access permission are determined respectively. When the number of first-level relationships in each permission level relationship is not less than a preset first number threshold, the target request message is determined to be an attack message. The first-level relationship is a permission level relationship that conforms to a preset level relationship. The preset level relationship is used to indicate that the corresponding reference access permission is higher than the target access permission. Before obtaining the reference access permissions for each reference object that has accessed the target resource within each historical time period, the method further includes: Based on the historical request messages sent by objects other than the target object within each historical time period, the first object that has accessed the resource set is obtained; When it is determined that there is a second object in each of the first objects whose access permission is no greater than the target access permission, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are selected from each of the first objects.

2. The method as described in claim 1, characterized in that, The method further includes: If, within each historical time period, there is no reference object that has accessed the target resource, or if the number of second-level relationships in each permission level relationship is equal to a preset second number threshold, then the historical Internet Protocol IP address of each historical request message is obtained. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission. When the target IP address meets the first condition and the location of the target IP address meets the second condition, the target request message is determined to be an attack message. The first condition is that the target IP address does not exist in any of the historical IP addresses, and the second condition is that the location of the target IP address does not exist in the location of each of the historical IP addresses.

3. The method as described in claim 2, characterized in that, The method further includes: If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the first specified time period; Based on the historical resources requested by each of the historical request messages, unknown request messages are filtered out from the access request messages, wherein there are no resources requested by the unknown request messages in the historical resources. When the ratio of the number of unknown request packets to the number of access request packets is greater than a preset value, the target request packet is determined to be an attack packet.

4. The method as described in claim 2, characterized in that, The method further includes: If the target IP address meets the first condition and the location of the target IP address does not meet the second condition, or if the target IP address does not meet the first condition and the location of the target IP address meets the second condition, then obtain each access request message sent by the target object within the second specified time period; Each access request message is parsed to determine the resource identifier of the resource requested by each access request message; When the similarity relationship between resource identifiers conforms to a preset relationship, the target request message is determined to be an attack message.

5. The method as described in claim 4, characterized in that, The step of determining the target request message as an attack message when the relationship between the similarity of the resource identifiers conforms to a preset relationship includes: The resource identifiers are sorted in lexicographical order to obtain the sorted resource identifiers. For each sorted resource identifier, the similarity between every two adjacent resource identifiers is calculated to obtain each similarity score. If there are two adjacent similarities that are both not less than a preset similarity threshold, then the target request message is an attack message.

6. The method according to any one of claims 1 to 5, characterized in that, The preset hierarchy is used to indicate that the corresponding reference access permission is higher than the target access permission, and the method further includes: When the number of second-level relationships in each permission level relationship is greater than a preset second quantity threshold, the target request message is determined to be a normal message. The second-level relationship is used to indicate that the corresponding reference access permission is not higher than the target access permission.

7. An attack detection device, characterized in that, include: The receiving unit is configured to receive a target request message sent by the target object for accessing the target resource within the current time period, and to parse the target request message to determine the resource set to which the target resource belongs. The acquisition unit is used to, based on the historical request messages sent by the target object in each historical time period, determine that the target object has not accessed the resources in the resource set, and then acquire the reference access permissions of each reference object that has accessed the target resource in each historical time period. The first determining unit is configured to determine the permission level relationship between the target access permission of the target object and each reference access permission, and determine the target request message as an attack message when the number of first-level relationships in each permission level relationship is not less than a preset first number threshold. The first-level relationship is a permission level relationship that conforms to a preset level relationship. The preset level relationship is used to indicate that the corresponding reference access permission is higher than the target access permission. The device also includes a screening unit for: Based on the historical request messages sent by objects other than the target object within each historical time period, the first object that has accessed the resource set is obtained; When it is determined that there is a second object in each of the first objects whose access permission is no greater than the target access permission, and the number of the second objects is greater than a preset number threshold, reference objects that have accessed the target resource are filtered out from each of the first objects.

8. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described in claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of any of the methods described in claims 1 to 6.

Images