Application defense method, device and equipment

Abstract

The embodiment of the invention provides an application defense method which can be applied to the technical field of computers and the technical field of information security. The method comprises the following steps: in response to a defense instruction regularly sent by a client, obtaining a first uniform resource locator of a Web application from a server; and modifying the first uniform resource locator to generate a second uniform resource locator. And sending the second uniform resource locator to a server side using the first uniform resource locator, so that the server side applies the second uniform resource locator. And sending the second uniform resource locator to a client using the first uniform resource locator, so that the client applies the second uniform resource locator. The invention further provides an application defense device, computing equipment, a medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, specifically to the field of information security technology, and in particular to an application defense method, device, equipment, medium and program product. Background Art

[0002] With the development of the Internet, more and more Web applications are used by enterprises, including banks, and the security defense of Web applications has become an important consideration. Generally, when an attacker penetrates a Web application, he first needs to obtain the normal business messages of the Web application by manual interception or automatic crawling, and then construct an attack request based on the normal message and send it to the server to observe the server response to confirm whether there are vulnerabilities in the application, thereby achieving the purpose of the attack.

[0003] To prevent applications from being scanned and infiltrated by attackers, the current mainstream defense method is to deploy attack analysis and interception equipment outside the system to analyze whether the access message has attack characteristics to achieve attack blocking. However, due to the large number of attack characteristics, this method cannot effectively defend against various attack behaviors. If an attack characteristic that is not intercepted appears, it will cause serious losses to enterprises including banks. Summary of the invention

[0004] In view of the above problems, the present disclosure provides an application defense method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, the defense method is applied to a proxy server, and is characterized in that the method comprises:

[0006] Responding to defense instructions sent periodically by the client;

[0007] Obtaining a first uniform resource locator of a Web application from a server;

[0008] Modifying the first uniform resource locator to generate a second uniform resource locator;

[0009] Sending the second uniform resource locator to a server end using the first uniform resource locator, so that the server end applies the second uniform resource locator; and

[0010] The second uniform resource locator is sent to a client using the first uniform resource locator, so that the client applies the second uniform resource locator.

[0011] According to an embodiment of the present disclosure, it is characterized in that obtaining a first uniform resource locator of a Web application from a server side includes:

[0012] Obtaining a server-side configuration file of the Web application;

[0013] Querying the configuration file for a first uniform resource locator; and

[0014] Get the first uniform resource locator of the Web application.

[0015] According to an embodiment of the present disclosure, it is characterized in that modifying the first uniform resource locator to generate a second uniform resource locator includes:

[0016] Obtaining parameters of the first uniform resource locator; and

[0017] Modify the parameters to generate a second uniform resource locator,

[0018] The parameters include: protocol, domain name and port.

[0019] According to an embodiment of the present disclosure, it is characterized in that it is applied to a customer service end, and the method includes:

[0020] Obtaining user input data; and

[0021] The suspiciousness of the user input data is judged, and if the user input data is suspicious data, the suspicious data is intercepted and a defense instruction is sent to the proxy server.

[0022] According to an embodiment of the present disclosure, it is characterized in that the suspiciousness judgment of the user input data includes:

[0023] Perform code review on the user input data, and if the code of the user input data contains a preset function or variable, determine that the data is suspicious data; or

[0024] Performing content analysis on the user input data, and if the content of the user input data contains preset keywords or short sentences, determining that the data is suspicious data; or

[0025] The user input data is subjected to file verification, and if the file format or type of the user input data does not match the preset file format or type, the data is determined to be suspicious data.

[0026] According to a second aspect of the present disclosure, the defense method is applied to a client, a proxy server, and a server, and is characterized in that the method comprises:

[0027] The client obtains user input data;

[0028] The client determines the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server.

[0029] The proxy server responds to the defense instructions sent by the client;

[0030] The proxy server obtains the first uniform resource locator of the Web application from the server;

[0031] The proxy server modifies the first uniform resource locator to generate a second uniform resource locator;

[0032] The proxy server sends the second uniform resource locator to the server using the first uniform resource locator;

[0033] The server side receives the second uniform resource locator sent by the proxy server side;

[0034] The server applies the second uniform resource locator;

[0035] The proxy server sends the second uniform resource locator to the client using the first uniform resource locator;

[0036] The client receives the second uniform resource locator sent by the proxy server; and

[0037] The client applies the second uniform resource locator.

[0038] According to a third aspect of the present disclosure, an application defense device is provided, which is applied to a proxy server, and is characterized in that the device includes:

[0039] A first response module, used to respond to the defense instruction sent regularly by the client;

[0040] A first acquisition module, used to acquire a first uniform resource locator of a Web application from a server;

[0041] A first modification module, used for modifying the first uniform resource locator to generate a second uniform resource locator;

[0042] a first sending module, configured to send the second uniform resource locator to a server end using the first uniform resource locator, so that the server end applies the second uniform resource locator; and

[0043] The second sending module is configured to send the second uniform resource locator to a client using the first uniform resource locator, so that the client applies the second uniform resource locator.

[0044] According to an embodiment of the present disclosure, it is characterized in that the first acquisition module includes:

[0045] A second acquisition module is used to acquire a configuration file of the server side of the Web application;

[0046] A query module, configured to query the first uniform resource locator in the configuration file; and

[0047] The third acquisition module is used to acquire a first uniform resource locator of the Web application.

[0048] According to an embodiment of the present disclosure, it is characterized in that the first modification module includes:

[0049] a fourth acquisition module, configured to acquire parameters of the first uniform resource locator; and

[0050] The second modification module is used to modify the parameters to generate a second uniform resource locator.

[0051] According to a fourth aspect of the present disclosure, an application defense device is provided, which is applied to a client, a proxy server, and a server, and is characterized in that the device includes:

[0052] The fifth acquisition module is used for the client to obtain user input data;

[0053] A judgment module is used for the client to judge the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server;

[0054] The second response module is used for the proxy server to respond to the defense instruction sent by the client;

[0055] A sixth acquisition module, configured to proxy the server end to acquire a first uniform resource locator of the Web application from the server end;

[0056] A third modification module, configured to modify the first uniform resource locator by the proxy server to generate a second uniform resource locator;

[0057] A third sending module, configured to act as an agent for the server to send the second uniform resource locator to the server using the first uniform resource locator;

[0058] A first receiving module, configured for receiving, at the server end, a second uniform resource locator sent by the proxy server end;

[0059] A first application module, used for applying the second uniform resource locator on the server side;

[0060] A fourth sending module, configured to proxy the server to send the second uniform resource locator to the client using the first uniform resource locator;

[0061] A second receiving module, configured for the client to receive a second uniform resource locator sent by the proxy server; and

[0062] The second application module is used for the client to apply the second uniform resource locator.

[0063] According to a fifth aspect of the present disclosure, a network system is provided, including:

[0064] A proxy server in an application defense device; or,

[0065] Application defense devices include clients, proxies, and servers.

[0066] According to a sixth aspect of the present disclosure, there is provided an electronic device, including:

[0067] one or more processors;

[0068] a storage device for storing one or more programs,

[0069] When the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned application defense method.

[0070] According to a seventh aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions are stored. When the instructions are executed by a processor, the processor executes the above-mentioned application defense method.

[0071] According to an eighth aspect of the present disclosure, a computer program product is also provided, including a computer program, which implements the above-mentioned application defense method when executed by a processor.

[0072] According to the disclosed proxy server, the URL is modified regularly, making it difficult for attackers to intercept normal business messages of the website, and then cannot use normal business messages to further construct attack messages to attack the application, so as to achieve the goal of "attack cannot be directed at the target". In addition, the client can intercept suspicious data to form the first layer of defense, and then modify the URL through the proxy server to form the second layer of defense, and form a double layer of protection through the server, proxy server and client to ensure the security of the Web application storage service end. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0074] Figure 1 The application scenario diagram of the application defense method and device according to the embodiment of the present disclosure is schematically shown;

[0075] Figure 2 A flowchart of an application defense method applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0076] Figure 3 A flowchart of obtaining a first uniform resource locator in an application defense method applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0077] Figure 4 A flowchart of obtaining a second uniform resource locator in an application defense method applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0078] Figure 5 A flowchart schematically shows an application defense method applied to a client, a proxy server, and a server according to an embodiment of the present disclosure;

[0079] Figure 6 A flowchart schematically shows a method for periodically sending defense instructions by a client in an application defense method according to an embodiment of the present disclosure;

[0080] Figure 7 A structural block diagram of an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0081] Figure 8 A structural block diagram of a first acquisition module in an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0082] Fig. 9 A structural block diagram of a first modification module in an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown;

[0083] Fig.10 A structural block diagram of an application defense device applied to a client, a proxy server, and a server according to an embodiment of the present disclosure is schematically shown;

[0084] Fig.11 A block diagram of an electronic device suitable for implementing an application defense method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0085] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0086] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0087] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0088] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0089] Some block diagrams and / or flow charts are shown in the accompanying drawings. It should be understood that some blocks or combinations thereof in the block diagrams and / or flow charts may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that these instructions, when executed by the processor, may create a device for implementing the functions / operations described in these block diagrams and / or flow charts.

[0090] First, the technical terms that appear in this article are explained as follows:

[0091] URL (Uniform Resource Locator): Uniform Resource Locator is a standard resource address. URL is a string used to identify the location of resources on the Internet.

[0092] An embodiment of the present disclosure provides an application defense method, the method comprising: in response to a defense instruction sent by a client at a fixed time, obtaining a first uniform resource locator of a Web application from a server, modifying the first uniform resource locator to generate a second uniform resource locator, sending the second uniform resource locator to a server using the first uniform resource locator, so that the server applies the second uniform resource locator, and sending the second uniform resource locator to a client using the first uniform resource locator, so that the client applies the second uniform resource locator.

[0093] This method uses a proxy server to respond to the defense instructions sent by the client at regular intervals, changes the URL and synchronizes it to the storage service and client, which can prevent suspicious data that is not intercepted by the client from damaging the storage service. Due to the change of the URL, it is difficult for attackers to intercept the normal business messages of the website, and then they cannot use the normal business messages to further construct attack messages to attack the application, achieving the technical effect of "the attack cannot be targeted" to improve the defense of Web applications.

[0094] Figure 1 The following schematically shows an application scenario diagram of the application defense method and device according to an embodiment of the present disclosure. It should be noted that: Figure 1 The examples shown are merely scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0095] like Figure 1 As shown, the application scenario 100 according to this embodiment may include multiple application terminals, proxy service terminals and application servers. For example, the multiple application terminals include application terminal 101, application terminal 102, application terminal 103, etc. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105, and the network 104 is also used to provide a medium for a communication link between the proxy server 106 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0096] The user can use the application terminal devices 101, 102, 103 to interact with the application server 105 through the network 104 through the proxy server 106 to receive or send messages, etc. Various applications can be installed on the application terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0097] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0098] The server 105 may be a server that provides various application services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0099] It should be noted that the application defense method provided in the embodiment of the present disclosure can generally be executed by the proxy server 106 or the terminal devices 101, 102, 103, the proxy server 106 and the server 105 can be executed interactively. Accordingly, the application defense device provided in the embodiment of the present disclosure can generally be set in the proxy server 106 or the terminal devices 101, 102, 103, the proxy server 106 and the server 105 can be executed interactively. The application defense method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the proxy server 106 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the application defense device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the proxy server 106 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0100] It should be understood that Figure 1 The number of terminal devices, networks, proxy servers and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided as required.

[0101] The following will be based on Figure 1 The scene described by Figure 2 to Figure 6 The application defense method of the disclosed embodiment is described in detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principle of the present disclosure, and the implementation of the present disclosure is not limited in this respect. On the contrary, the implementation of the present disclosure can be applied to any applicable scenario.

[0102] Figure 2 The flowchart of the application defense method applied to the proxy server according to the embodiment of the present disclosure is schematically shown.

[0103] like Figure 2 As shown, the method 200 includes steps S201 to S205.

[0104] Step S201, responding to the defense instruction sent regularly by the client.

[0105] The client can periodically send defense instructions to the proxy server, and the client can also send defense instructions to the proxy server after detecting an attack. The proxy server will receive the request defense instruction, parse it, and then take appropriate actions to respond to the client.

[0106] Step S202: Acquire a first uniform resource locator of the Web application from the server.

[0107] Figure 3 The flowchart of obtaining the first uniform resource locator in the application defense method applied to the proxy server according to the embodiment of the present disclosure is schematically shown.

[0108] like Figure 3 As shown, the method 300 includes steps S301 to S203.

[0109] Step S301, obtaining a configuration file of the server side of the Web application.

[0110] The proxy server will connect to the server of the Web application and obtain the configuration file of the server of the Web application.

[0111] Step S302: query the first uniform resource locator in the configuration file.

[0112] After obtaining the configuration file of the server side of the Web application, the proxy server queries it, for example, traverses the configuration file of the server side of the Web application, and after querying the URL of the server side of the Web application, it is convenient to obtain the URL of the server side of the Web application later.

[0113] Step S303: Obtain a first uniform resource locator of the Web application.

[0114] By querying the URL in the server configuration file, it is convenient to accurately obtain the URL of the Web application.

[0115] Return to reference Figure 2 In step S203, the first uniform resource locator is modified to generate a second uniform resource locator.

[0116] Figure 4 The flowchart of obtaining the second uniform resource locator in the application defense method applied to the proxy server according to the embodiment of the present disclosure is schematically shown.

[0117] like Figure 4 As shown, the method 400 includes steps S401-S402.

[0118] Step S401: Obtain parameters of the first uniform resource locator.

[0119] The proxy server can obtain parameters in the URL of the server of the Web application, wherein the parameters in the URL of the server of the Web application include: data such as the protocol, domain name, and port of the URL.

[0120] By modifying the protocol, domain name and port in the URL, you can block attacks from suspicious data and achieve a defensive effect.

[0121] Step S402: modify the parameters to generate a second uniform resource locator.

[0122] The proxy server can modify the URL's protocol, domain name, port and other parameters to generate a new modified URL.

[0123] For example, for some simple URLs, the protocol of the URL can be changed, for example, the network protocol "http" can be changed to the network protocol "https", the network protocol "ftp" can be changed to the network protocol "smtp", the network protocol "rtsp" can be changed to the network protocol "dns", etc.

[0124] The proxy server can also modify the domain name and port of the URL.

[0125] For example, the URL is http: / / yuming.com / OA / userlogin?Username=root, and "OA", "userlogin" and "Username" are extracted through regular expression matching, and the extracted parameters are replaced with dynamically generated random names.

[0126] The rule for dynamically generated random names is a random combination of uppercase letters, lowercase letters, and numbers. Specifically, it includes: first obtaining the domain name or port name to be replaced as the original phrase; obtaining 52 uppercase and lowercase letters and 0-9 numbers, a total of 62 letters or numbers, and then randomly selecting n numbers or letters from 1-62 numbers or letters to generate n numbers or letters as replacement phrases, verifying the original phrase and the replacement phrase, if they are not the same, replacing the original phrase with the replacement phrase to generate a random name.

[0127] Return to reference Figure 2 In step S204, the second uniform resource locator is sent to the server end that uses the first uniform resource locator, so that the server end applies the second uniform resource locator.

[0128] The proxy server sends the new modified URL to the server using the original URL through the original URL, so that the server applies the new modified URL.

[0129] Step S205: Send the second uniform resource locator to the client that uses the first uniform resource locator, so that the client applies the second uniform resource locator.

[0130] The proxy server sends the new modified URL to the client using the original URL through the original URL, so that the client applies the new modified URL.

[0131] Figure 5 The flowchart of the application defense method applied to the client, proxy service end and server end according to the embodiment of the present disclosure is schematically shown.

[0132] like Figure 5 As shown, the method 500 includes steps S501 to S511.

[0133] Step S501: The client obtains user input data.

[0134] In step S502, the client determines the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server.

[0135] For example, the client performs a code review on the user input data, and if the code of the user input data contains a preset function or variable, the data is determined to be suspicious data.

[0136] The client performs content analysis on the user input data, and if the content of the user input data contains preset keywords or short sentences, the data is determined to be suspicious data.

[0137] The client performs file verification on the user input data, and if the file format or type of the user input data does not match the preset file format or type, the data is determined to be suspicious data.

[0138] By judging the suspiciousness of input data, intercepting suspicious data, and sending defense instructions to the proxy server for further interception, it can prevent unintercepted suspicious data from causing damage to the storage service, thus improving the defense of Web applications. In addition, suspicious data can be analyzed through code review, content analysis, and file verification, making it easier to identify suspicious data and intercept it, thus improving security.

[0139] Step S503: the proxy server responds to the defense instruction sent by the client.

[0140] The proxy server receives and analyzes the defense instructions sent by the client and responds to them.

[0141] Step S504: the proxy server obtains the first uniform resource locator of the Web application from the server.

[0142] After receiving the defense instruction, the proxy server obtains the URL of the Web application from the server.

[0143] Step S505: the proxy server modifies the first uniform resource locator to generate a second uniform resource locator.

[0144] The proxy server modifies the URL of the Web application obtained from the server.

[0145] Step S506: The proxy server sends the second uniform resource locator to the server that uses the first uniform resource locator.

[0146] The proxy server sends the modified URL of the Web application to the server.

[0147] Step S507: the server receives the second uniform resource locator sent by the proxy server.

[0148] The server receives the modified URL of the Web application sent by the proxy server.

[0149] Step S508: the server applies the second uniform resource locator.

[0150] Step S509: The proxy server sends the second uniform resource locator to the client using the first uniform resource locator.

[0151] The proxy server sends the modified URL of the web application to the client.

[0152] Step S510: the client receives a second uniform resource locator sent by the proxy server.

[0153] The client receives the modified URL of the Web application sent by the proxy server.

[0154] Step S511: the client applies the second uniform resource locator.

[0155] The proxy server can also modify the URLs of the server and client at regular intervals to improve the security of Web applications.

[0156] The client intercepts suspicious data to form the first layer of defense, and then modifies the URL through the proxy server to form the second layer of defense. The server, proxy server and client form a double layer of protection to ensure the security of the Web application storage service.

[0157] Figure 6 The flowchart of the client periodically sending defense instructions in the application defense method according to the embodiment of the present disclosure is schematically shown.

[0158] like Figure 6 As shown, the method 600 includes steps S601 to S604.

[0159] Step S601: The client sets a preset timing time.

[0160] Step S602: The client determines whether a preset time has been reached.

[0161] Step S603: If the preset time is reached, the client sends a defense instruction to the proxy server.

[0162] Step S604: The proxy service modifies the URL and sends it to the server and the client.

[0163] By periodically changing the application URL, the application defense capability is advanced to before hackers launch attacks. By periodically changing the system URL, malicious attacks cannot use parameter names to guess parameter functions, nor can they use collected links to continuously construct attack messages to implement vulnerability scanning and detection, thereby improving the application's anti-attack capabilities and strengthening the application's defense capabilities.

[0164] Figure 7 The structural block diagram of an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown.

[0165] like Figure 7 As shown, the application defense device 700 applied to the proxy server includes: a first response module 701, a first acquisition module 702, a first modification module 703, a first sending module 704 and a second sending module 705.

[0166] The first response module 701 is used to respond to the defense instruction sent by the client at a fixed time. In one embodiment, the first response module 701 can be used to execute the step S201 described above, which will not be described in detail here.

[0167] The first acquisition module 702 is used to acquire the first uniform resource locator of the Web application from the server. In one embodiment, the first acquisition module 702 can be used to execute the step S202 described above.

[0168] Figure 8 The structural block diagram of a first acquisition module in an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown.

[0169] like Figure 8 As shown, the first acquisition module 702 includes: a second acquisition module 801 , a query module 802 and a third acquisition module 803 .

[0170] The second acquisition module 801 is used to acquire the configuration file of the server side of the Web application. In one embodiment, the second acquisition module 801 can be used to execute the step S301 described above, which will not be described in detail here.

[0171] The query module 802 is used to query the first uniform resource locator in the configuration file. In one embodiment, the query module 802 can be used to execute the step S302 described above, which will not be described in detail here.

[0172] The third acquisition module 803 is used to acquire the first uniform resource locator of the Web application. In one embodiment, the third acquisition module 803 can be used to execute the step S303 described above, which will not be described in detail here.

[0173] Return to reference Figure 7 The first modification module 703 is used to modify the first uniform resource locator to generate a second uniform resource locator. In one embodiment, the first modification module 703 can be used to execute the step S203 described above.

[0174] Fig. 9 The structure block diagram of a first modification module in an application defense device applied to a proxy server according to an embodiment of the present disclosure is schematically shown.

[0175] like Fig. 9 As shown, the first modifying module 703 includes: a fourth acquiring module 901 and a second modifying module 902 .

[0176] The fourth acquisition module 901 is used to acquire the parameters of the first uniform resource locator. In one embodiment, the fourth acquisition module 901 can be used to execute the step S401 described above, which will not be described in detail here.

[0177] The second modification module 902 is used to modify the parameters to generate a second uniform resource locator. In one embodiment, the second modification module 902 can be used to execute the step S402 described above, which will not be described in detail here.

[0178] Return to reference Figure 7 The first sending module 704 is used to send the second uniform resource locator to the server end using the first uniform resource locator, so that the server end applies the second uniform resource locator. In one embodiment, the first sending module 704 can be used to execute the step S204 described above, which will not be repeated here.

[0179] The second sending module 705 is used to send the second uniform resource locator to the client using the first uniform resource locator, so that the client applies the second uniform resource locator. In one embodiment, the second sending module 705 can be used to execute the step S205 described above, which will not be repeated here.

[0180] According to an embodiment of the present disclosure, any multiple modules of the first response module 701, the first acquisition module 702, the first modification module 703, the first sending module 704, and the second sending module 705 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first response module 701, the first acquisition module 702, the first modification module 703, the first sending module 704, and the second sending module 705 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or by any one of the three implementation methods of software, hardware, and firmware, or by a suitable combination of any of them. Alternatively, at least one of the first responding module 701, the first acquiring module 702, the first modifying module 703, the first sending module 704 and the second sending module 705 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0181] Fig.10 The structural block diagram of an application defense device applied to a client, a proxy server and a server according to an embodiment of the present disclosure is schematically shown.

[0182] like Fig.10 As shown, the application defense device 1000 applied to the client, proxy service and server includes: a fifth acquisition module 1001, a judgment module 1002, a second response module 1003, a sixth acquisition module 1004, a third modification module 1005, a third sending module 1006, a first receiving module 1007, a first application module 1008, a fourth sending module 1009, a second receiving module 1010 and a second application module 1011.

[0183] The fifth acquisition module 1001 is used by the client to acquire user input data. In one embodiment, the fifth acquisition module 1001 can be used to execute the step S501 described above, which will not be described in detail here.

[0184] The judgment module 1002 is used for the client to judge the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server. In one embodiment, the judgment module 1002 can be used to execute the step S502 described above, which will not be repeated here.

[0185] The second response module 1003 is used for the proxy server to respond to the defense instruction sent by the client. In one embodiment, the second response module 1003 can be used to execute the step S503 described above, which will not be repeated here.

[0186] The sixth acquisition module 1004 is used for the proxy server to acquire the first uniform resource locator of the Web application from the server. In one embodiment, the sixth acquisition module 1004 can be used to execute the above-described step S504, which will not be described in detail here.

[0187] The third modification module 1005 is used for the proxy server to modify the first uniform resource locator to generate a second uniform resource locator. In one embodiment, the third modification module 1005 can be used to execute the above-described step S505, which will not be described in detail here.

[0188] The third sending module 1006 is used for the proxy server to send the second uniform resource locator to the server using the first uniform resource locator. In one embodiment, the third sending module 1006 can be used to execute the above-described step S506, which will not be described in detail here.

[0189] The first receiving module 1007 is used for the server to receive the second uniform resource locator sent by the proxy server. In one embodiment, the first receiving module 1007 can be used to execute the step S507 described above, which will not be described in detail here.

[0190] The first application module 1008 is used for the server to apply the second uniform resource locator. In one embodiment, the first application module 1008 can be used to execute the above-described step S508, which will not be described in detail here.

[0191] The fourth sending module 1009 is used for the proxy server to send the second uniform resource locator to the client using the first uniform resource locator. In one embodiment, the fourth sending module 1009 can be used to execute the above-described step S509, which will not be described in detail here.

[0192] The second receiving module 1010 is used for the client to receive the second uniform resource locator sent by the proxy server. In one embodiment, the second receiving module 1010 can be used to execute the step S510 described above, which will not be described in detail here.

[0193] The second application module 1011 is used for the client to apply the second uniform resource locator. In one embodiment, the second application module 1011 can be used to execute the step S511 described above, which will not be described in detail here.

[0194] According to an embodiment of the present disclosure, any multiple modules among the fifth acquisition module 1001, the judgment module 1002, the second response module 1003, the sixth acquisition module 1004, the third modification module 1005, the third sending module 1006, the first receiving module 1007, the first application module 1008, the fourth sending module 1009, the second receiving module 1010 and the second application module 1011 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the fifth acquisition module 1001, the judgment module 1002, the second response module 1003, the sixth acquisition module 1004, the third modification module 1005, the third sending module 1006, the first receiving module 1007, the first application module 1008, the fourth sending module 1009, the second receiving module 1010 and the second application module 1011 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the fifth acquisition module 1001, the judgment module 1002, the second response module 1003, the sixth acquisition module 1004, the third modification module 1005, the third sending module 1006, the first receiving module 1007, the first application module 1008, the fourth sending module 1009, the second receiving module 1010 and the second application module 1011 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is executed.

[0195] Fig.11 A block diagram of an electronic device suitable for implementing an application defense method according to an embodiment of the present disclosure is schematically shown.

[0196] like Fig.11As shown, the electronic device 1100 according to an embodiment of the present disclosure includes a processor 1101, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1102 or a program loaded from a storage part 1108 to a random access memory (RAM) 1103. The processor 1101 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1101 may also include an onboard memory for caching purposes. The processor 1101 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0197] In RAM 1103, various programs and data required for the operation of electronic device 1100 are stored. Processor 1101, ROM 1102 and RAM 1103 are connected to each other via bus 1104. Processor 1101 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1102 and / or RAM 1103. It should be noted that the program can also be stored in one or more memories other than ROM 1102 and RAM 1103. Processor 1101 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0198] According to an embodiment of the present disclosure, the electronic device 1100 may further include an input / output (I / O) interface 1105, which is also connected to the bus 1104. The electronic device 1100 may further include one or more of the following components connected to the I / O interface 1105: an input portion 1106 including a keyboard, a mouse, etc.; an output portion 1107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1108 including a hard disk, etc.; and a communication portion 1109 including a network interface card such as a LAN card, a modem, etc. The communication portion 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to the I / O interface 1105 as needed. A removable medium 1111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1110 as needed, so that a computer program read therefrom is installed into the storage portion 1108 as needed.

[0199] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0200] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM1102 and / or RAM 1103 described above and / or one or more memories other than ROM1102 and RAM1103.

[0201] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the program delivery method for application defense provided by the embodiment of the present disclosure.

[0202] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1101. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0203] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1109, and / or installed from a removable medium 1111. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0204] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1109, and / or installed from the removable medium 1111. When the computer program is executed by the processor 1101, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0205] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0206] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0207] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0208] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. An application defense method, applied to a proxy server, characterized in that: The method includes: Responding to defense instructions sent periodically by the client; Obtaining a first uniform resource locator of a Web application from a server; Modifying the first uniform resource locator to generate a second uniform resource locator; Sending the second uniform resource locator to a server end using the first uniform resource locator, so that the server end applies the second uniform resource locator; and The second uniform resource locator is sent to a client using the first uniform resource locator, so that the client applies the second uniform resource locator.

2. The method according to claim 1, characterized in that Obtain the first uniform resource locator of the Web application from the server, including: Obtaining a server-side configuration file of the Web application; Querying the configuration file for a first uniform resource locator; and Get the first uniform resource locator of the Web application.

3. The method according to claim 1 or 2, characterized in that: Modifying the first uniform resource locator to generate a second uniform resource locator includes: Obtaining parameters of the first uniform resource locator; and Modify the parameters to generate a second uniform resource locator, The parameters include: protocol, domain name and port.

4. An application defense method, applied to a customer service end, characterized in that: The method includes: Obtaining user input data; and The suspiciousness of the user input data is judged, and if the user input data is suspicious data, the suspicious data is intercepted and a defense instruction is sent to the proxy server.

5. The method according to claim 4, characterized in that The suspiciousness of the user input data is judged, including: Perform code review on the user input data, and if the code of the user input data contains a preset function or variable, determine that the data is suspicious data; or Performing content analysis on the user input data, and if the content of the user input data contains preset keywords or short sentences, determining that the data is suspicious data; or The user input data is subjected to file verification, and if the file format or type of the user input data does not match the preset file format or type, the data is determined to be suspicious data.

6. An application defense method, applied to a client, a proxy server and a server, characterized in that: The method includes: The client obtains user input data; The client determines the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server. The proxy server responds to the defense instructions sent by the client; The proxy server obtains the first uniform resource locator of the Web application from the server; The proxy server modifies the first uniform resource locator to generate a second uniform resource locator; The proxy server sends the second uniform resource locator to the server using the first uniform resource locator; The server side receives the second uniform resource locator sent by the proxy server side; The server applies the second uniform resource locator; The proxy server sends the second uniform resource locator to the client using the first uniform resource locator; The client receives the second uniform resource locator sent by the proxy server; and The client applies the second uniform resource locator.

7. An application defense device, applied to a proxy server, characterized in that: The device includes: A first response module, used to respond to the defense instruction sent regularly by the client; A first acquisition module, used to acquire a first uniform resource locator of a Web application from a server; A first modification module, used for modifying the first uniform resource locator to generate a second uniform resource locator; a first sending module, configured to send the second uniform resource locator to a server end using the first uniform resource locator, so that the server end applies the second uniform resource locator; and The second sending module is configured to send the second uniform resource locator to a client using the first uniform resource locator, so that the client applies the second uniform resource locator.

8. An application defense device, applied to a client, a proxy server, and a server, characterized in that: The device includes: The fifth acquisition module is used for the client to obtain user input data; A judgment module is used for the client to judge the user input data. If the user input data is suspicious data, the client intercepts the suspicious data and sends a defense instruction to the proxy server; The second response module is used for the proxy server to respond to the defense instruction sent by the client; A sixth acquisition module, configured to proxy the server end to acquire a first uniform resource locator of the Web application from the server end; A third modification module, configured to modify the first uniform resource locator by the proxy server to generate a second uniform resource locator; A third sending module, configured to act as an agent for the server to send the second uniform resource locator to the server using the first uniform resource locator; A first receiving module, configured for receiving, at the server end, a second uniform resource locator sent by the proxy server end; A first application module, used for applying the second uniform resource locator on the server side; A fourth sending module, configured to proxy the server to send the second uniform resource locator to the client using the first uniform resource locator; A second receiving module, configured for the client to receive a second uniform resource locator sent by the proxy server; and The second application module is used for the client to apply the second uniform resource locator.

9. An electronic device, comprising: an or processor; A storage device for storing a program or When the one or program is executed by the one or processor, the one or processor executes the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 6.

Images