Attack traffic countermeasure method and system based on WAF

Abstract

Multiple embodiments of this specification relate to the field of network security technology, and specifically to a WAF-based attack traffic countermeasure method and system. The method includes the following steps: detecting whether an access request is attack traffic according to a preset WAF matching rule; when the access request is attack traffic, marking the source IP of the attack traffic as a marked IP, and sending a real person verification to the access end; when the real person verification passes, generating a response page based on the page requested by the access request and a pre-configured simulated vulnerability page and sending it to the access end; when the interaction between the marked IP and the response page meets the preset trigger condition, generating an inducement file and prompting for download, and the inducement file includes a preset countermeasure code.

Description

Technical Field

[0001] Multiple embodiments of this specification relate to the field of network security technology, and specifically to a WAF-based attack traffic countermeasure method and system. Background Art

[0002] Web pages are of high value and are the main window for businesses and organizations to exist online, showcasing products, attracting customers, and promoting sales. At the same time, web pages are the center of data collection and analysis, helping companies optimize market strategies and improve user experience. In addition, web pages are an important line of defense for information security, protecting user data and business continuity. At the social level, web pages provide public service information and educational resources, enhancing transparency and participation. Therefore, it is crucial to strengthen the security and functionality of web pages. Attack traffic countermeasures of Web Application Firewall (WAF) are an important means to protect Web applications from various attacks. Attack traffic countermeasures are not only about detecting and blocking attacks, but also include a series of response measures to ensure the security and availability of the system. It can improve the security of web pages, but because the current network security is in an asymmetric state of attack and defense. In network security protection, defenders often focus too much on passive defense, while attackers have almost no cost and risk. This asymmetry causes attackers to become unscrupulous and defenders to always be in a passive state. It brings risks and challenges to web security, so it is necessary to study new defense strategies to help curb attack behaviors. Summary of the invention

[0003] Multiple embodiments of this specification describe a WAF-based attack traffic countermeasure method and system.

[0004] In a first aspect, the embodiments of this specification provide a WAF-based attack traffic countermeasure method, comprising the steps of:

[0005] Detect whether the access request is attack traffic based on the preset WAF matching rules;

[0006] When the access request is attack traffic, mark the source IP of the attack traffic as the marked IP, and send a real person verification to the access end;

[0007] When the real person verification is passed, a response page is generated according to the page requested by the access request and the pre-configured simulated vulnerability page and sent to the access end;

[0008] When the interaction between the marked IP and the response page meets the preset trigger condition, an inducement file is generated and prompted to download, and the inducement file includes a preset countermeasure code.

[0009] In a second aspect, the embodiment of this specification provides an attack traffic countermeasure system based on WAF, including:

[0010] The detection module detects whether the access request is attack traffic based on the preset WAF matching rules;

[0011] A verification module, when the access request is attack traffic, marks the source IP of the attack traffic as a marked IP, and sends a real person verification to the access end;

[0012] A response module, when the real person verification is passed, generates a response page according to the page requested by the access request and the pre-configured simulated vulnerability page and sends it to the access end;

[0013] The countermeasure module generates an inducement file and prompts for downloading when the interaction between the marked IP and the response page meets the preset trigger condition. The inducement file includes a preset countermeasure code.

[0014] In a third aspect, an embodiment of this specification provides an electronic device, including a processor and a memory;

[0015] The processor is connected to the memory;

[0016] The memory is used to store executable program code;

[0017] The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of the above aspects.

[0018] In a fourth aspect, an embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any of the above aspects.

[0019] In a fifth aspect, an embodiment of this specification provides a computer program product, including a computer program, which implements the method described in any of the above aspects when executed by a processor.

[0020] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0021] In multiple embodiments of this specification, a WAF-based attack traffic countermeasure method and system is provided to collect more information about the attack and understand the type of information the attacker is interested in by actively inducing the attacker to interact multiple times. It also enhances the attacker's confidence that the attack has been successful, thereby relaxing their vigilance and making it easier to actively download and open the inducement file, ultimately achieving countermeasures against the attacker. By simulating the vulnerability page to generate a response page, the attack traffic can be prevented from accessing the page that normally provides services, ensuring the safe operation of the server.

[0022] Other features and advantages of the various embodiments of the present specification will be further disclosed in the following detailed description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of this specification, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0024] Figure 1 A schematic diagram of an application scenario of the attack traffic countermeasure method provided in the embodiments of this specification.

[0025] Figure 2 A schematic diagram of another application scenario of the attack traffic countermeasure method provided in the embodiments of this specification.

[0026] Figure 3 A schematic diagram of the application architecture of the attack traffic countermeasure method provided in the embodiments of this specification.

[0027] Figure 4 A schematic diagram of the attack traffic countermeasure method provided in the embodiments of this specification.

[0028] Figure 5 A schematic diagram of the flow of a method for detecting attack traffic provided in an embodiment of this specification.

[0029] Figure 6 A flowchart of a method for configuring a simulated vulnerability page provided in an embodiment of this specification.

[0030] Figure 7 A schematic diagram of the flow of a method for generating a response page provided in an embodiment of this specification.

[0031] Figure 8 A flowchart of a method for generating an induction file provided in an embodiment of this specification.

[0032] Fig. 9 A schematic diagram of an attack traffic countermeasure system provided in an embodiment of this specification.

[0033] Fig.10 A schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0034] The following is an explanation and description of the technical solutions of the embodiments of this specification in conjunction with the drawings of the embodiments of this specification, but the following embodiments are only preferred embodiments of this specification, not all. Based on the embodiments in the implementation mode, other embodiments obtained by those skilled in the art without creative work are all within the scope of protection of this specification.

[0035] The terms "first", "second", "third", etc. in the description and claims of this specification and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0036] In the following description, terms such as "inside", "outside", "up", "down", "left", "right", etc. that indicate directions or positional relationships are only used to facilitate the description of the embodiments and simplify the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation of this specification.

[0037] The data involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection of relevant data complies with the relevant laws, regulations and standards of relevant countries and regions.

[0038] All technical solutions involved in this application are implemented under legal and compliant conditions.

[0039] Before describing the technical solution in this specification, the application scenarios and related technologies of the technical solution are introduced.

[0040] In the current Internet environment, servers 10 deployed on the network are facing various types of attack risks all the time. As WEB applications become more and more abundant, WEB servers have gradually become the main attack targets with their powerful computing power, processing performance and high value. Security incidents such as SQL injection, web page tampering, and web page Trojans occur frequently. These attacks include but are not limited to scanning by network service detection tools, malicious crawling by automated crawlers, and targeted attacks launched by real people. These attack methods are diverse and complex, ranging from simple port scanning to complex zero-day vulnerability exploits, which may pose a serious threat to the security and stability of the server 10.

[0041] Web Application Firewall (WAF) is one of the important tools to protect the server 10 from network attacks. WAF 20 detects and intercepts potential malicious requests by writing specific rules to match known network vulnerabilities. However, the protection capability of WAF 20 is not foolproof. For undisclosed network attack methods, especially those that exploit zero-day vulnerabilities, WAF 20 often finds it difficult to effectively intercept them. These unknown attack methods may bypass existing protection rules, resulting in the risk of server 10 still being compromised.

[0042] Therefore, when conducting a retrospective analysis of a network attack incident, it is necessary to collect as many valuable clues as possible. These clues include but are not limited to the attacker's IP address, attack time and frequency, attack tools and technical means used, specific interfaces and parameters attacked, etc. By comprehensively analyzing this information, the attacker's characteristics and behavior patterns can be more accurately identified, thus providing a reference for future protection strategies.

[0043] However, current network security is in an asymmetric state between offense and defense. In network security protection, the defender often focuses too much on passive defense and lacks countermeasures, while the attacker has almost no cost and risk. This asymmetry causes the attacker to become unscrupulous and the defender is always in a passive state, which is not conducive to the security of the web server 10.

[0044] Especially in the Internet of Things (IoT) environment, many devices use web pages as access and control interfaces. This is because web interfaces have advantages such as cross-platform, ease of use, and scalability. IoT devices that use web pages as access and control interfaces are widely used in various scenarios, from smart homes to industrial production, from medical health to agricultural management, to smart cities and security monitoring. The ease of use and cross-platform characteristics of web interfaces allow users to access and control these devices through browsers anytime and anywhere, improving the availability and management efficiency of devices. However, this also brings security challenges, and appropriate security measures need to be taken to protect these devices from attacks. With the rapid development of the Internet of Things, the access and control of IoT devices are also facing severe security situations.

[0045] To this end, this manual provides a WAF-based attack traffic countermeasure method and system, which can identify, intercept, track and counterattack attacks. It helps to improve network security. Figure 1 , which is a schematic diagram of the application scenario of the technical solution recorded in this specification. The page 11 for providing services and the simulated vulnerability page 12 are both set on the server 10. The WAF 20 can be set on the server 10 or on a dedicated firewall server 2110 (such as the attached Figure 2As shown in FIG. 1 ). The access request sent by the request end 30 first reaches the WAF 20, which identifies the access request. The normal access request will be directed to the requested page 11 that can provide the service, and the attack access request will be redirected to the simulated vulnerability page 12, and finally the countermeasure is achieved. The method described in this specification runs on the server 10. When the WAF 20 is set on a dedicated firewall server 21, some steps are run on the firewall server 21, and some steps are run on the server 10.

[0046] The method provided in this application is applied to Figure 3 The system architecture shown, Figure 3 is a schematic diagram of the system architecture in the embodiment of the present application, such as Figure 3 As shown, the system architecture includes a server 10 and a terminal device, and the request end 30 (i.e., a web browser) is deployed on the terminal device. The server 10 involved in this application can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms. The terminal device can be a smart phone, a tablet computer, a laptop, a PDA, a personal computer, a smart speaker, a smart TV, a smart watch, a car device, a wearable device, etc., but is not limited to this. The terminal device and the server 10 can be directly or indirectly connected by wired or wireless communication, and this application is not limited here. The number of servers 10 and terminal devices is also not limited.

[0047] Since this application involves some professional terms, these professional terms will be introduced below.

[0048] WAF

[0049] WAF refers to a web application protection system (also known as a website application-level intrusion prevention system, in English: Web Application Firewall, or WAF for short). A web application firewall is a product that specifically provides protection for web applications by executing a series of security policies for HTTP / HTTPS.

[0050] Attack traffic

[0051] Attack traffic refers to network traffic on the Internet that is initiated by malicious attackers and is intended to cause damage, interference, or unauthorized access to the target system or network. These traffics usually contain specific malicious behaviors, such as probing, scanning, injection, denial of service, etc., which are intended to disrupt the normal operation of the target system or steal sensitive information. Attack traffic can perform illegal operations on the target system or network or have destructive results, such as damaging system components, making the target system unable to operate normally, causing service interruption. Steal information and obtain sensitive information of the target system, such as user data, passwords, financial information, etc. Tamper with information and modify data in the target system, resulting in inconsistent or incorrect data. Unauthorized access, obtaining unauthorized access rights to the target system and performing illegal operations.

[0052] Induction File

[0053] Lure Files are files that are intentionally placed on a system or network with the goal of attracting the attacker's attention and tricking them into downloading or accessing them. These files often contain content disguised as legitimate files, but actually contain countermeasures so that security teams can detect and analyze the attacker's activities.

[0054] Countermeasure code

[0055] Countermeasures Code refers to specially designed codes or scripts used to detect, block or respond to attack behaviors. Countermeasures Code can be integrated into various security tools and systems, such as firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc.

[0056] The main functions of the countermeasure code are detection and alarm, and it can automatically execute predefined response measures, such as blocking malicious IP addresses, isolating infected hosts, etc. It can also record detailed attack logs, including the attacker's behavior, timestamps, attack methods, etc., to provide data support for subsequent attack analysis and evidence collection.

[0057] This manual first provides a WAF-based attack traffic countermeasure method. Figure 4 , including the steps of:

[0058] Step S101) detects whether the access request is attack traffic according to the preset WAF matching rules.

[0059] Web Application Firewall (WAF) detects and blocks various types of network attacks through preset matching rules.

[0060] For example, the matching rules for SQL injection attack traffic are:

[0061] "@rx(union\s+select|exec\s+\(|insert\s+into|update\s+set|delete\s+from)" "id:100,rev:1,severity:2,msg:'SQL Injection Attack Detected',logdata:'Matched Data:%{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',

[0062] phase:2,deny,status:403,t:lowercase,t:replaceNulls,t:compressWhitespace".

[0063] This matching rule can detect and block requests containing SQL injection features, such as `union select`, `exec(`, `insert into`, `update set`, and `delete from`. Specifically, the regular expression `@rx (union\s+select|exec\s+\(|insert\s+into|update\s+set|delete\s+from)` is used to detect whether the request parameters contain SQL injection features. If the match is successful, the access request is determined to be attack traffic. Among them, `t:lowercase` converts the input to lowercase, `t:replaceNulls` replaces null characters, and `t:compressWhitespace` compresses whitespace characters to improve the accuracy of matching.

[0064] Another exemplary matching rule for cross-site scripting (XSS) attack traffic is:

[0065] "@rx ( <script>|<iframe>|onerror=|alert\()" "id:101,rev:1,severity:2,msg:'XSS Attack Detected',logdata:'Matched Data: %{TX.0} found within %{MATCHED_VAR_NAME}: %{MATCHED_VAR}',phase:2,deny,status:403,t:lowercase,t:replaceNulls,t:compressWhitespace"。

[0066] 该匹配规则能够检测并阻止包含跨站脚本攻击特征的请求，如 `<script>`、`<iframe>`、`onerror=` 和 `alert(` 等。使用正则表达式 `@rx (<script>|<iframe>|onerror=|alert\()` 检测请求参数中是否包含 XSS 攻击特征。

[0067] 又一示例性的，针对跨站请求伪造（CSRF）的匹配规则为：

[0068] SecRule REQUEST_HEADERS:Referer "!@streq http: / / example.com" "id:102,rev:1,severity:2,msg:'CSRF Attack Detected',logdata:'Invalid Referer: %{REQUEST_HEADERS:Referer}',phase:2,deny,status:403"

[0069] 该匹配规则能够检测并阻止缺少有效 CSRF 令牌的请求，确保请求来自合法的来源。检查请求的 `Referer` 头是否等于 `http: / / example.com`，如果不是，则认为是CSRF 攻击。

[0070] 通过这些示例规则，WAF 可以根据URL包含的字符，进行有效的检测匹配攻击流量。实际应用中，可以根据具体的需求和环境，通过本领域已公开的技术，调整和扩展这些规则。

[0071] 步骤S102）当所述访问请求为攻击流量时，标注所述攻击流量的来源IP，记为标记IP，向访问端发送真人验证。在检测到攻击流量后，将攻击流量的来源 IP 标注为标记 IP。可以通过设置环境变量来实现，如使用代码setenv:ATTACK_IP=%{REMOTE_ADDR}实现。创建一个用于真人验证的验证页面（例如 verify.php），用于进行真人验证。这个页面可以包含验证码、滑动验证或其他形式的验证机制。

[0072] 示例性的，使用如下验证码的方式进行验证。验证码以带有复杂背景的方式显示在验证页面上。

[0073] 请完成以下验证以继续访问。

[0074] <form action=" / verify.php" method="post">

[0075] <label for="captcha">请输入验证码：< / label>

[0076] <input type="text" id="captcha" name="captcha" required>

[0077] <input type="hidden" name="ip" value="<?php echohtmlspecialchars($ip); ?>">

[0078] <button type="submit">验证< / button>

[0079] < / form>

[0080] 服务器10接收到提交的表单后，使用if ($captcha == '123456') / / 示例验证码 / / 验证通过，清除标记，可以判定是否为真人。

[0081] 步骤S103）当所述真人验证通过时，根据所述访问请求所请求的页面，以及预先配置的模拟漏洞页面12，生成响应页面发送给访问端。

[0082] 模拟漏洞页面12看起来像是存在漏洞的页面，但实际上只是用于迷惑和追踪攻击者。模拟漏洞页面12的页面格式、内容均与正常提供服务的页面11高度相似，只是具体内容是经过修改的。使攻击者无法分辨真伪。示例性的，若用户请求的是控制页面，则返回的响应页面也显示相同的控件，但是控件参数以及控制的对象信息均经过修改，而显示为错误的信息。使攻击者误以为攻击成功。

[0083] 步骤S104）当所述标记IP与所述响应页面交互满足预设的触发条件时，生成诱导文件并提示下载，所述诱导文件包括预设的反制代码。当攻击者多次交互，即多次发送访问请求，相应的服务器10会产生多个响应页面。则会形成多个与响应页面的交互的记录。当交互满足预设的触发条件时，生成诱导文件并提示下载。诱导文件中设置的反制代码使用本领域公开的技术进行设置即可。

[0084] 另一方面，记录预设时长内全部访问请求的交互日志。请参阅附图5，根据预设的WAF匹配规则检测访问请求是否为攻击流量的方法包括：

[0085] 步骤S201）判断所述访问请求使用的IP地址是否与所述标记IP相符，若相符，则判定所述访问请求为攻击流量。

[0086] 步骤S202）读取所述访问请求的URL，解析出所述URL的参数，将所述参数与预设的WAF匹配规则进行匹配，若匹配相符，则判定所述访问请求为攻击流量。

[0087] 步骤S203）若匹配不相符，则从所述交互日志读取获得所述访问请求使用的IP地址的交互记录。

[0088] 步骤S204）将所述交互记录与预设的交互规则进行匹配，若匹配相符，则判断所述请求为攻击流量。

[0089] 需要注意的是，web的交互方式决定每次访问请求均是一个新的URL承载的访问请求。但能够通过来源的IP地址判断是否是之前已经进行过访问的请求端30的访问。当然请求端30有条件更换IP地址，当请求端30更换IP地址时，会导致标记IP无法识别该次新的访问请求是攻击流量。当通过标记IP不能识别为攻击流量时，则使用WAF匹配规则进行匹配。

[0090] 其中，预设WAF匹配规则的方法包括：根据配置的攻击类型，生成字符、命令及参数的匹配规则。

[0091] 预设交互规则的方法包括：根据配置的异常访问类型，生成关于交互次数、交互频率、交互相似度的匹配规则。

[0092] 当以一个IP地址为来源的在先的多次访问请求均未被标注为标记IP，但发现多次访问请求的频率过高（如1秒钟1000次访问请求），或者交互相似度过高，如不断的重复请求访问同一个页面，或者不断的操作提交页面上的一个表单。通过交互相似度即可判断出该访问请求属于攻击流量。具体而言，可以设置交互次数大于设定的一个阈值，或者交互频率大于设定的一个阈值，或者交互相似度大于设定的一个阈值，作为预设交互规则。

[0093] 另一方面，请参阅附图6，预先配置模拟漏洞页面12的方法包括：

[0094] 步骤S301）修改所述访问请求所请求的页面的内容，作为所述模拟漏洞页面12的内容。使用程序自动修改，也可以通过人工预先配置的修改模板进行修改。将真实数据和信息修改为错误的数据及信息。

[0095] 步骤S302）设置所述模拟漏洞页面12不触发WAF匹配规则及所述交互规则。

[0096] 步骤S303）配置重定向规则，所述重定向规则将所述标记IP的后续访问请求均重定向到预设的防御页面。

[0097] 步骤S304）所述防御页面根据所述后续访问请求，生成新的响应页面发送给访问端。

[0098] 另一方面，在另外的实施方式中，请参阅附图7，所述防御页面根据所述后续访问请求，生成新的响应页面发送给访问端的方法包括：

[0099] 步骤S401）读取所述后续访问请求所请求的页面的内容，获得所述内容中信息类型的占比，所述信息类型包括数据信息、账号信息及状态信息。

[0100] 具体包括从请求的页面中读取内容，而后使用文本解析技术提取页面中的信息，再将提取的信息分类为数据信息、账号信息和状态信息，最后，计算每种信息类型的占比。

[0101] 示例性的，使用如下代码从请求的页面中读取内容：

[0102] function fetch_page_content($url){$ch = curl_init($url);curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $content = curl_exec($ch); curl_close($ch); return $content;}，而后使用正则表达式或其他文本解析技术提取页面中的信息。

[0103] 示例性的，正则表达式如下：

[0104] preg_match_all(' / (.*?)<\ / div> / is', $content, $matches_data);

[0105] preg_match_all(' / (.*?)<\ / div> / is', $content, $matches_account);

[0106] preg_match_all(' / (.*?)<\ / div> / is', $content, $matches_status)。

[0107] 分别用于匹配数据信息、账号信息和状态信息。示例性的，访问的网页为智能家居控制页面。数据信息则包含与设备状态、环境参数等相关的数据。例如：温度：当前室内的温度值。湿度：当前室内的湿度值。光照强度：当前室内的光照强度值。空气质量：当前室内的空气质量指数。能耗：设备的能耗数据。传感器数据：各种传感器（如烟雾传感器、红外传感器）的数据。

[0108] 账号信息包含与用户账户相关的信息。例如：用户名：用户的登录名。密码：用户的登录密码（通常在页面上不会明文显示，但在表单中可能存在）。邮箱：用户的注册邮箱地址。手机号：用户的注册手机号。用户ID：用户的唯一标识符。权限等级：用户的权限等级，如管理员、普通用户等。

[0109] 状态信息包含与设备状态、系统状态等相关的数据。例如：设备状态：设备的在线 / 离线状态。连接状态：设备与服务器10的连接状态。电池电量：设备的电池电量。故障信息：设备的故障信息或错误代码。操作状态：设备的当前操作状态，如开启 / 关闭、运行 / 暂停等。更新状态：设备的固件更新状态。根据三种类型的信息占用的字节数获得每种信息类型的占比。

[0110] 步骤S402）修改所请求的页面的内容，作为所述响应页面的内容。

[0111] 步骤S403）获得占比最大的信息类型，记为主信息类型，生成更多所述主信息类型的信息添加到所述响应页面中。

[0112] 步骤S404）将所述响应页面发送给访问端。

[0113] 示例性的，攻击者对状态信息更为感兴趣，因此会不断的访问具有更多状态信息显示的页面。

[0114] 预设触发条件包括：根据所述响应页面的内容中所述主信息类型的占比，设置触发条件。请参阅附图8，当所述主信息类型的占比超过预设阈值时，判定满足预设的触发条件，生成诱导文件的方法包括：

[0115] 步骤S501）生成所述主信息类型的信息作为所述诱导文件的内容。

[0116] 步骤S502）生成反制代码添加到所述诱导文件中。

[0117] 步骤S503）根据所述主信息类型生成所述诱导文件的文件名。

[0118] 当攻击者对状态信息更为感兴趣时，专门为攻击者生成一个声称记载有大量历史的状态信息的，或者生成一个声称记载有当前全部状态的文件，该文件为诱导文件，使攻击者更容易主动下载诱导文件。反制代码通过本领域已公开技术进行添加即可。

[0119] 通过主动诱导攻击者多次进行交互，从而收集更多关于攻击的信息，并了解到攻击者感兴趣的信息类型。并增强攻击者已经攻击成功的自信心，进而放松警惕性，更容易主动下载并打开诱导文件，最终实现对攻击者的反制。

[0120] 另一方面，本说明书提供了一种基于WAF的攻击流量反制系统，请参阅附图9，包括：

[0121] 检测模块100，根据预设的WAF匹配规则检测访问请求是否为攻击流量；

[0122] 验证模块200，当所述访问请求为攻击流量时，标注所述攻击流量的来源IP，记为标记IP，向访问端发送真人验证；

[0123] 响应模块300，当所述真人验证通过时，根据所述访问请求所请求的页面，以及预先配置的模拟漏洞页面12，生成响应页面发送给访问端；

[0124] 反制模块400，当所述标记IP与所述响应页面交互满足预设的触发条件时，生成诱导文件并提示下载，所述诱导文件包括预设的反制代码。

[0125] 请参阅图10示出的本说明书实施例提供的一种电子设备的结构示意图。

[0126] 如图10所示，该电子设备 1100可以包括:至少一个处理器 1101、至少一个网络接口 1104、用户接口 1103、存储器 1105以及至少一个通信总线 1102。其中，通信总线 1102可用于实现上述各个组件的连接通信。其中，用户接口 1103可以包括按键，可选用户接口还可以包括标准的有线接口、无线接口。其中，网络接口 1104 可以但不局限于包括蓝牙模块、NFC 模块、Wi-Fi 模块等。其中，处理器 1101 可以包括一个或者多个处理核心。处理器1101 利用各种接口和线路连接整个电子设备 1100内的各个部分，通过运行或执行存储在存储器 1105 内的指令、程序、代码集或指令集，以及调用存储在存储器 1105 内的数据，执行路由设备 1100 的各种功能和处理数据。可选的，处理器 1101 可以采用 DSP、FPGA、PLA 中的至少一种硬件形式来实现。处理器 1101 可集成CPU、GPU 和调制解调器等中的一种或几种的组合。其中，CPU 主要处理操作系统、用户界面和应用程序等；GPU 用于负责显示屏所需要显示的内容的渲染和绘制；调制解调器用于处理无线通信。

[0127] 可以理解的是，上述调制解调器也可以不集成到处理器 1101中，单独通过一块芯片进行实现。

[0128] 其中，存储器 1105 可以包括 RAM，也可以包括 ROM。可选的，该存储器 1105 包括非瞬时性计算机可读介质。存储器 1105 可用于存储指令、程序、代码、代码集或指令集。存储器 1105可包括存储程序区和存储数据区，其中，存储程序区可存储用于实现操作系统的指令、用于至少一个功能的指令（比如触控功能、声音播放功能、图像播放功能等）、用于实现上述各个方法实施例的指令等；存储数据区可存储上面各个方法实施例中涉及到的数据等。存储器1105 可选的还可以是至少一个位于远离前述处理器 1101 的存储装置。作为一种计算机存储介质的存储器 1105中可以包括操作系统、网络通信模块、用户接口模块以及应用程序。处理器 1101 可以用于调用存储器 1105 中存储的应用程序，并执行上述多个实施例中的方法。

[0129] 本说明书实施例还提供了一种计算机可读存储介质，该计算机可读存储介质中存储有指令，当其在计算机或处理器上运行时，使得计算机或处理器执行上述实施例中的多个步骤。上述电子设备的各组成模块如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在所述计算机可读取存储介质中。

[0130] 本说明书实施例还提供了一种计算机程序产品，包括计算机程序，该计算机程序被处理器执行时实现上述实施例中的多个步骤。

[0131] 在不冲突的情况下，本实施例和实施方案中的技术特征可以任意组合。

[0132] 在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生按照本说明书实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者通过所述计算机可读存储介质进行传输。所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线（例如同轴电缆、光纤、数字用户线（Digital SubscriberLine，DSL））或无线（例如红外、无线、微波等）方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，（例如，软盘、硬盘、磁带）、光介质(例如，数字多功能光盘（Digital Versatile Disc，DVD）)、或者半导体介质（例如，固态硬盘（Solid State Disk，SSD））等。

[0133] 当通过硬件、固件实现时，将前述的方法流程编程到硬件电路中来得到相应的硬件电路结构，实现相应的功能。例如，可编程逻辑器件(Programmable Logic Device,PLD)(例如现场可编程门阵列(FieldProgrammable GateArray，FPGA))就是这样一种集成电路，其逻辑功能由用户对器件编程来确定。由设计人员自行编程来把一个数字系统"集成”在一片PLD上，而不需要请芯片制造厂商来设计和制作专用的集成电路芯片。而且，如今，取代手工地制作集成电路芯片，这种编程也多半改用"逻辑编译器(logic compiler)”软件来实现，它与程序开发撰写时所用的软件编译器相类似，而要编译之前的原始代码也得用特定的编程语言来撰写，此称之为硬件描述语言(Hardware Description Language，HDL)，而HDL也并非仅有一种，而是有许多种。本领域技术人员也应该清楚，只需要将方法流程用上述几种硬件描述语言稍作逻辑编程并编程到集成电路中，就可以很容易得到实现该逻辑方法流程的硬件电路。

[0134] 以上所述的实施例仅仅是本说明书的优选实施例方式进行描述，并非对本说明书的范围进行限定，在不脱离本说明书的设计精神的前提下，本领域普通技术人员对本说明书的技术方案作出的各种变形及改进，均应落入本说明书的权利要求书确定的保护范围内。< / script>

Claims

1. The attack traffic countermeasure method based on WAF is characterized by: Includes steps: Detect whether the access request is attack traffic based on the preset WAF matching rules; When the access request is attack traffic, mark the source IP of the attack traffic as the marked IP, and send a real person verification to the access end; When the real person verification is passed, a response page is generated according to the page requested by the access request and the pre-configured simulated vulnerability page and sent to the access end; When the interaction between the marked IP and the response page meets the preset trigger condition, an inducement file is generated and prompted to download, wherein the inducement file includes a preset countermeasure code; Methods for pre-configuring simulated vulnerability pages include: Modifying the content of the page requested by the access request as the content of the simulated vulnerability page; Set the simulated vulnerability page not to trigger WAF matching rules and interaction rules; Configure a redirection rule, wherein the redirection rule redirects subsequent access requests of the marked IP to a preset defense page; The defense page generates a new response page according to the subsequent access request and sends it to the access end; The method in which the defense page generates a new response page according to the subsequent access request and sends it to the access end includes: Reading the content of the page requested by the subsequent access request, and obtaining the proportion of information types in the content of the page requested by the subsequent access request, wherein the information types include data information, account information, and status information; Modify the content of the requested page as the content of the response page; The information type with the largest proportion is obtained, recorded as the main information type, and more information of the main information type is generated and added to the response page; The response page is sent to the access end.

2. The WAF-based attack traffic countermeasure method according to claim 1, characterized in that: Record the interaction log of all access requests within a preset time period. Methods for detecting whether an access request is attack traffic based on preset WAF matching rules include: Determine whether the IP address used in the access request matches the marked IP address, and if so, determine that the access request is attack traffic; Read the URL of the access request, parse the parameters of the URL, match the parameters with the preset WAF matching rules, and if the match is consistent, determine that the access request is attack traffic; If the match does not match, then reading from the interaction log to obtain the interaction record of the IP address used in the access request; The interaction record is matched with a preset interaction rule, and if the match is consistent, the request is determined to be attack traffic.

3. The WAF-based attack traffic countermeasure method according to claim 1, characterized in that: Methods for presetting WAF matching rules include: Generate matching rules for characters, commands, and parameters based on the configured attack type; Methods for presetting interaction rules include: Generate matching rules for the number of interactions, interaction frequency, and interaction similarity based on the configured abnormal access type.

4. The WAF-based attack traffic countermeasure method according to claim 1, characterized in that: The preset trigger conditions include: Setting a trigger condition according to the proportion of the main information type in the content of the response page; When the proportion of the main information type exceeds a preset threshold, it is determined that a preset trigger condition is met, and the method for generating an induction file includes: Generate information of the main information type as the content of the induction file; Generate countermeasure code and add it to the inducement file; The file name of the induction file is generated according to the main information type.

5. The attack traffic countermeasure system based on WAF is characterized by: include: The detection module detects whether the access request is attack traffic based on the preset WAF matching rules; A verification module, when the access request is attack traffic, marks the source IP of the attack traffic as a marked IP, and sends a real person verification to the access end; A response module, when the real person verification is passed, generates a response page according to the page requested by the access request and the pre-configured simulated vulnerability page and sends it to the access end; A countermeasure module, when the interaction between the marked IP and the response page satisfies a preset trigger condition, generates an inducement file and prompts downloading, wherein the inducement file includes a preset countermeasure code; Methods for pre-configuring simulated vulnerability pages include: Modifying the content of the page requested by the access request as the content of the simulated vulnerability page; Set the simulated vulnerability page not to trigger WAF matching rules and interaction rules; Configure a redirection rule, wherein the redirection rule redirects subsequent access requests of the marked IP to a preset defense page; The defense page generates a new response page according to the subsequent access request and sends it to the access end; The method in which the defense page generates a new response page according to the subsequent access request and sends it to the access end includes: Reading the content of the page requested by the subsequent access request, and obtaining the proportion of information types in the content of the page requested by the subsequent access request, wherein the information types include data information, account information, and status information; Modify the content of the requested page as the content of the response page; The information type with the largest proportion is obtained, recorded as the main information type, and more information of the main information type is generated and added to the response page; The response page is sent to the access end.

6. An electronic device, characterized in that including a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

8. Computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images