Interface request processing method and device

Abstract

The invention discloses an interface request processing method and device, belongs to the technical field of network security, and can solve the problem that the security of an interface is relatively poor because the interface is easily attacked due to the fact that the abnormality of the interface request is difficult to accurately recognize in the related technology. The method comprises the following steps: acquiring a first interface request for a target interface; the first interface request comprises a plurality of first request parameters, and each first request parameter is composed of a first parameter name and a first parameter value; for each first request parameter, performing verification processing on the first request parameter according to a predetermined parameter verification rule to obtain a verification result; wherein the parameter verification rule is determined based on a plurality of historical interface requests of the target interface; the parameter verification rule is used for verifying the first parameter name, the length of the first parameter value and character elements contained in the first parameter value; and determining whether the first interface request is abnormal or not according to the verification result.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically relates to a method and device for processing an interface request. Background Art

[0002] Web (webpage) applications are applications that can be accessed through the Web. They have the advantages of being easy to maintain, fast to iterate, convenient to use, and cross-platform. They have been widely used in various fields such as finance, medical care, education, and manufacturing. At the same time, Web applications have also become the main target of attackers. Attackers launch attacks by modifying and forging interface requests, injecting malicious content into request parameters, etc., thus causing security issues such as illegal access, data leakage, and even asset control.

[0003] For this reason, in the related art, generally, during the interface design and development stage of the Web application, the technical personnel will design parameter verification logic for each interface respectively, so that after receiving the interface request, the interface will complete the verification of the request parameters, thereby rejecting the interface request with illegal parameters to achieve interface security protection. Among them, the parameter verification logic will be embedded or integrated into the Web application by conditional statement judgment, exception handling or introduction of a third-party library. However, on the one hand, the above scheme requires the technical personnel to design parameter verification logic for each interface. If the number of interfaces is large, the design workload of the technical personnel will also be large. In addition, if the request parameters required by the interface change, the parameter verification logic also needs to be adjusted accordingly, making the manual design and maintenance cost of the parameter verification logic high. On the other hand, due to the uneven business level of the technical personnel, it is difficult to ensure the accuracy of the verification result by verifying the request parameters based on the parameter verification logic designed by the technical personnel, so there is a risk that the interface is attacked by an interface request with illegal parameters, making it difficult to ensure the security of the interface. Summary of the invention

[0004] The embodiments of the present application provide a method and device for processing an interface request, which can solve the problem that the related technology is difficult to accurately identify the anomalies of the interface request, making the interface vulnerable to attack, thereby resulting in poor interface security.

[0005] In a first aspect, an embodiment of the present application provides a method for processing an interface request, including:

[0006] Obtaining a first interface request for a target interface; the first interface request includes a plurality of first request parameters, and the first request parameters are composed of a first parameter name and a first parameter value;

[0007] For each first request parameter, verify the first request parameter according to a predetermined parameter verification rule to obtain a verification result; wherein the parameter verification rule is determined based on multiple historical interface requests of the target interface; the parameter verification rule is used to verify the first parameter name, the length of the first parameter value, and the character elements contained in the first parameter value;

[0008] According to the verification result, it is determined whether the first interface request is abnormal.

[0009] In a second aspect, an embodiment of the present application provides a device for processing an interface request, including:

[0010] A first acquisition module, configured to acquire a first interface request for a target interface; the first interface request includes a plurality of first request parameters, and the first request parameters are composed of a first parameter name and a first parameter value;

[0011] A verification processing module, used for verifying each first request parameter according to a predetermined parameter verification rule to obtain a verification result; wherein the parameter verification rule is determined based on multiple historical interface requests of the target interface; the parameter verification rule is used to verify the first parameter name, the length of the first parameter value and the character elements contained in the first parameter value;

[0012] A first determining module is used to determine whether the first interface request is abnormal according to the verification result.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor; and a memory arranged to store computer-executable instructions, wherein the computer-executable instructions are configured to be executed by the processor, and the computer-executable instructions are executed by the processor to implement the steps of the method for processing interface requests as described in the first aspect.

[0014] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which is used to store computer-executable instructions. When the computer-executable instructions are executed by a processor, the steps of the method for processing interface requests as described in the first aspect are implemented.

[0015] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for processing an interface request as described in the first aspect are implemented.

[0016] In a sixth aspect, an embodiment of the present application provides a chip, comprising a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run executable instructions to implement the method for processing interface requests as described in the first aspect.

[0017] In an embodiment of the present application, a first interface request for a target interface can be obtained, the first interface request includes multiple first request parameters, and the first request parameter is composed of a first parameter name and a first parameter value, so that for each first request parameter, the first parameter name of the first request parameter, the length of the first parameter value, and the character elements contained in the first parameter value can be checked and processed according to the parameter verification rules determined in advance based on multiple historical interface requests of the target interface to obtain a verification result. Then, according to the verification result, it is determined whether the first interface request is abnormal. It can be seen that in terms of realizing interface security protection, compared with the method of using parameter verification logic designed and maintained by technicians in the related art to identify illegal parameters in interface requests, thereby identifying abnormal interface requests, this technical solution does not require technicians to design parameter verification rules for the target interface, thereby saving manual design and maintenance costs, avoiding the dependence of the parameter verification process on technicians, and reducing the difficulty of implementing parameter verification. Furthermore, since the parameter verification rules are determined based on multiple historical interface requests of the target interface, based on the parameter verification rules, the request parameters in the interface request for the target interface can be more specifically verified. At the same time, the parameter verification rules are used in the technical solution to verify data of multiple dimensions of the request parameters (including parameter name, length of parameter value, and character elements contained in the parameter value), so that the verification results are more accurate, thereby being able to more accurately determine whether there are abnormalities in the interface request, which is conducive to accurately realizing security protection of the target interface and improving the security of the target interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a flowchart of a method for processing an interface request provided in an embodiment of the present application;

[0019] Figure 2 It is a flowchart of another method for processing an interface request provided in an embodiment of the present application;

[0020] Figure 3 It is a structural diagram of a device for processing an interface request provided in an embodiment of the present application;

[0021] Figure 4 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0024] The following is a detailed description of the method and device for processing interface requests provided by the embodiments of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0025] Figure 1 A method for processing an interface request provided by an embodiment of the present application is shown. The method can be executed by an electronic device, and the electronic device may include: a server and / or a terminal device, wherein the terminal device may be, for example, a vehicle-mounted terminal or a mobile phone terminal. In other words, the method can be executed by software or hardware installed in the electronic device, and the method includes the following steps:

[0026] Step 102: Obtain a first interface request for a target interface, where the first interface request includes a plurality of first request parameters.

[0027] The first request parameter is composed of a first parameter name and a first parameter value. For example, when multiple first request parameters include a user name and a password, for the first request parameter of the user name, the first parameter name may be name, and the first parameter value may be Lily; for the first request parameter of the password, the first parameter name may be password, and the first parameter value may be 123456.

[0028] Optionally, the target interface may be an API (Application Programming Interface), and the first interface request may be an API request for accessing an application. The API request may include first request parameters such as path parameters, query parameters, request body parameters, and header information parameters. The path parameter is passed through the path portion of the URL (Uniform Resource Locator), such as / users / 342, where 342 is the user ID (IdentityDocument, account number). In this example, the first parameter name of the path parameter may be path, and the first parameter value may be / users / 342. The query parameter is passed through the query portion of the URL, generally in the form of a key-value pair, such as search? query=python&sort=asc. In this example, the first parameter name of the query parameter may be query, and the first parameter value may be search? query=python&sort=asc. Request body parameters are transmitted in the HTTP (Hypertext Transfer Protocol) request body, and are usually used for POST requests (for data submission and new operations) and PUT requests (for modifying specific content of a resource), such as: {"username":"Lily", "password":"123456"}. In this example, the first parameter name of the request body parameter can include username and password, and correspondingly, the first parameter value can be Lily and 123456. Header information parameters pass parameters in the header of the HTTP request, and are usually used to carry authentication information or other metadata, such as: Authorization: Bearer token. In this example, the first parameter name of the header information parameter can be Authorization, and the first parameter value can be Bearer token.

[0029] Step 104: for each first request parameter, perform verification processing on the first request parameter according to a predetermined parameter verification rule to obtain a verification result.

[0030] The parameter verification rule is determined based on multiple historical interface requests of the target interface. The parameter verification rule is used to verify the first parameter name, the length of the first parameter value, and the character elements contained in the first parameter value. The verification result may include verification passed or verification failed.

[0031] Step 106: Determine whether there is any abnormality in the first interface request based on the verification result.

[0032] Wherein, if the verification result is that the verification is passed, it can be determined that there is no abnormality in the first interface request. If the verification result is that the verification is not passed, it can be determined that there is an abnormality in the first interface request. Optionally, for the interface request with an abnormality, an error message can be issued to notify the technician that the target interface has been attacked.

[0033] Optionally, for the first interface request without any abnormality, it can be added to the historical interface request to increase the diversity of the historical interface request, thereby adjusting and optimizing the parameter verification rules so that the determined parameter verification rules can dynamically adapt to the changing attack patterns.

[0034] In an embodiment of the present application, a first interface request for a target interface can be obtained, the first interface request includes multiple first request parameters, and the first request parameter is composed of a first parameter name and a first parameter value, so that for each first request parameter, the first parameter name of the first request parameter, the length of the first parameter value, and the character elements contained in the first parameter value can be checked and processed according to the parameter verification rules determined in advance based on multiple historical interface requests of the target interface to obtain a verification result. Then, according to the verification result, it is determined whether the first interface request is abnormal. It can be seen that in terms of realizing interface security protection, compared with the method of using parameter verification logic designed and maintained by technicians in the related art to identify illegal parameters in interface requests, thereby identifying abnormal interface requests, this technical solution does not require technicians to design parameter verification rules for the target interface, thereby saving manual design and maintenance costs, avoiding the dependence of the parameter verification process on technicians, and reducing the difficulty of implementing parameter verification. Furthermore, since the parameter verification rules are determined based on multiple historical interface requests of the target interface, based on the parameter verification rules, the request parameters in the interface request for the target interface can be more specifically verified. At the same time, the parameter verification rules are used in the technical solution to verify data of multiple dimensions of the request parameters (including parameter name, length of parameter value, and character elements contained in the parameter value), so that the verification results are more accurate, thereby being able to more accurately determine whether there are abnormalities in the interface request, which is conducive to accurately realizing security protection of the target interface and improving the security of the target interface.

[0035] In one implementation, before obtaining the first interface request for the target interface (ie, step 102), the parameter verification rule corresponding to the target interface may be determined according to the following steps A1 to A4.

[0036] Step A1, obtaining multiple historical interface requests for the target interface, each historical interface request includes multiple sample request parameters, and the sample request parameters are composed of a sample parameter name and a sample parameter value.

[0037] In order to avoid the contingency of historical interface requests and ensure the accuracy of the generated parameter verification rules, when obtaining historical interface requests for generating parameter verification rules, it is necessary to obtain a sufficient number of historical interface requests. For example, more than 30 historical interface requests can be obtained. The specific number of historical interface requests obtained can be set according to the needs of the application scenario, and the embodiment of the present application does not limit this.

[0038] Step A2: Determine the required parameter set and the optional parameter set corresponding to the target interface according to the number of times each sample parameter name appears in multiple historical interface requests.

[0039] For example, the target interface is API and the interface request is API request. The request parameter X of the API request consists of the required parameter set X req and optional parameter set X opt Among them, the required parameter set X req Every legal API request must carry X req Can be an empty set The optional parameter set X opt It is not necessary to carry, that is, X opt Some parameters in the API request may not be carried. opt Can be

[0040] Step A3: for each sample request parameter, determine the parameter length range and character element set corresponding to the sample request parameter according to the sample parameter values ​​of the sample request parameter in multiple historical interface requests.

[0041] For each sample request parameter, its sample parameter value in multiple historical interface requests may be the same or different, but based on multiple sample parameter values, some regularities of the parameter value of the sample request parameter can be inferred, such as the length regularity of the sample parameter value, the regularity of the character elements contained in the sample parameter value, etc. The length regularity of the sample parameter value is the parameter length range corresponding to the sample request parameter, and the character element regularity contained in the sample parameter value is the character element set corresponding to the sample request parameter.

[0042] Step A4: Determine the parameter verification rule corresponding to the target interface according to the required parameter set, the optional parameter set, the parameter length range and the character element set.

[0043] In this embodiment, based on multiple historical interface requests of the target interface, the parameter verification rules corresponding to the target interface can be automatically determined through statistical processing, without the need for technical personnel to design parameter verification rules for the target interface. This saves manual design and maintenance costs, avoids the dependence of the parameter verification process on technical personnel, and reduces the difficulty of implementing parameter verification.

[0044] In one implementation, according to the number of times each sample parameter name appears in multiple historical interface requests, the required parameter set and the optional parameter set corresponding to the target interface (ie, step A2) are determined, which can be performed as follows: steps A21 to A24:

[0045] Step A21: for each sample parameter name, count the number of first occurrences of the sample parameter name in multiple historical interface requests.

[0046] Continuing with the example in step A2, assuming that the number of historical interface requests is N (N is a positive integer), then by counting the number of first times the sample parameter name appears in the N historical interface requests, it can be clearly known whether the sample parameter name has appeared in all N historical interface requests or only in some of the historical interface requests.

[0047] Step A22: when the first number is consistent with the number of the multiple historical interface requests, the sample request parameter corresponding to the sample parameter name is determined as a required parameter.

[0048] Continuing with the example in step A21, when the first number is N, it can be determined that the sample parameter name has appeared in N historical interface requests, and the sample request parameter corresponding to the sample parameter name can be determined as a required parameter.

[0049] Step A23, when the first number is inconsistent with the number of multiple historical interface requests, the sample request parameter corresponding to the sample parameter name is determined as an optional parameter.

[0050] Continuing with the example in step A21, when the first number is not N, that is, the first number is less than N, it can be determined that the sample parameter name has only appeared in some historical interface requests, then the sample request parameter corresponding to the sample parameter name can be determined as an optional parameter.

[0051] Step A24, determining a required parameter set corresponding to the target interface according to each required parameter; and determining an optional parameter set corresponding to the target interface according to each optional parameter.

[0052] In this embodiment, by counting the number of times each sample parameter name appears in multiple historical interface requests, the required parameter set and optional parameter set corresponding to the target interface can be automatically and accurately determined without manual intervention. This not only avoids dependence on technical personnel and makes the solution easy to implement, but also makes the solution more versatile and can determine the corresponding required parameter sets and optional parameter sets for different interfaces.

[0053] In one implementation, for each sample request parameter, according to the sample parameter values ​​of the sample request parameter in multiple historical interface requests, the parameter length range and character element set corresponding to the sample request parameter (i.e., step A3) are determined, which can be performed as follows: steps A31-A34:

[0054] Step A31: for each sample request parameter, according to the first length of the sample parameter value of the sample request parameter in multiple historical interface requests, determine a first length set corresponding to the sample request parameter.

[0055] Among them, the type of the sample parameter value may include a string type, a numerical type, etc. In the case where the type of the sample parameter value is a string type, the sample parameter value is composed of characters, and the first length of the sample parameter value may be the length of the string. For example, the sample parameter value of the path parameter path is / users / 634, then, from the 10 characters that constitute the sample parameter value, it can be known that the first length of the sample parameter value is 10. In the case where the type of the sample parameter value is a numerical type, the sample parameter value is a numerical value, and the first length of the sample parameter value may be the length of the numerical value. For example, the sample parameter value of the sample request parameter password is 123456, then the first length of the sample parameter value is 6.

[0056] Step A32: Determine the parameter length range corresponding to the sample request parameter according to the first length set.

[0057] Optionally, the left boundary and the right boundary of the parameter length range may be determined according to the elements included in the first length set, thereby obtaining the parameter length range corresponding to the sample request parameter.

[0058] Take the target interface as API and the historical interface request as API request as an example. To get the API request parameter x i The corresponding parameter length range S i , we can find N numbers containing x i historical interface requests, and determine x from these N historical interface requests i The corresponding first length set {l1,l2,...l N}, so that according to the elements l1, l2, ... l contained in the first length set N , determine the parameter length range S i The left boundary a and the right boundary b of the sample request parameter are obtained to obtain the parameter length range S corresponding to the sample request parameter. i =[a,b], 0≤a≤b. Among them, the sample request parameter x i The first length l of any sample parameter value i (i∈[1,N]) will not exceed S i , i.e. l i ∈Si =[a, b]. N is a positive integer, and the size of N can be set according to the needs of the application scenario. The embodiment of the present application does not limit this. However, in order to avoid the contingency of historical interface requests and ensure the accuracy of the generated parameter verification rules, the number of N needs to be sufficient.

[0059] In this embodiment, by counting the length set corresponding to the sample parameter value of each sample request parameter, the parameter length range corresponding to each sample request parameter is determined according to the elements in the length set, thereby achieving the effect of automatically determining the parameter length range corresponding to the sample request parameter, and providing a data basis for automatically generating parameter verification rules corresponding to the sample request parameters, which is beneficial to saving the cost of manually designing and maintaining parameter verification logic, avoiding the parameter verification process's dependence on technical personnel, and thus helping to reduce the difficulty of implementing parameter verification.

[0060] Step A33: determine the character elements contained in the sample parameter values ​​of the sample request parameters in the multiple historical interface requests respectively.

[0061] The sample parameter value may be composed of character elements of the type of letters, numbers, Chinese characters, symbols, etc. Optionally, according to the type of character elements, the value domain Ω may be divided into 10 value ranges r1 to r10, as follows: the value range r1 of Chinese characters is [\\u4e00-\\u9fff]; the value range r2 of letters is [az, AZ]; the value range r3 of numbers is [0-9]; the value range r4 of mathematical symbols is [+-* / =]; the value range r5 of punctuation marks is [! ? 。 ,:;]; the value range r6 of special meaning symbols is [@#￥%&]; the value range r7 of labels or brackets is [()[]{}<>]; the value range r8 of general symbols is [^~|\_]; the value range r9 of quotation marks is [“”'']; the value range r10 of other symbols is [other].

[0062] Step A34, determining a character element set corresponding to the sample request parameter according to the value ranges corresponding to the character elements; wherein the character element set is the union of the value ranges.

[0063] Take the target interface as API and the interface request as API request as an example. To get the API request parameter x i The corresponding character element set U i , we can find N numbers containing x i historical interface requests, and determine x from these N historical interface requests i The character elements {v1, v2, ... v m}, thereby determining the value range to which each character element belongs (such as the value range r1 to r10 mentioned above), and determining the union of multiple value ranges as x i The corresponding character element set. Wherein, N is a positive integer, and the size of N can be set according to the needs of the application scenario. The embodiment of the present application does not limit this. However, in order to avoid the contingency of historical interface requests and ensure the accuracy of the generated parameter verification rules, the number of N needs to be large enough. m is a positive integer, v1-v m Used to refer to x i Contains different types of character elements, such as numbers, mathematical symbols, Chinese characters, etc.

[0064] In the present embodiment, by counting the character elements contained in the sample parameter value of each sample request parameter, the character element set corresponding to the sample request parameter is determined according to the value range corresponding to each character element, thereby achieving the effect of automatically determining the character element set corresponding to the sample request parameter, and providing a data basis for automatically generating parameter verification rules corresponding to the sample request parameters, which is beneficial to saving the cost of manually designing and maintaining parameter verification logic, avoiding the dependence of the parameter verification process on technical personnel, and thus helping to reduce the difficulty of implementing parameter verification.

[0065] In one implementation, determining the parameter length range corresponding to the sample request parameter (i.e., step A32) according to the first length set may be performed as follows: steps A321 to A324:

[0066] Step A321: When all first lengths are consistent, determine that the left boundary and the right boundary of the parameter length range corresponding to the sample request parameter are both the first length.

[0067] Using the example in step A32, if l1, l2, ... l N If both are L, then a=b=L.

[0068] Step A322: When the first lengths are inconsistent, a normality test is performed on the first length set to obtain a normality test result.

[0069] Continuing with the example in step A32, the Shapiro-Wilk test (a method for testing normality) can be used to test {l1,l2,...l N} for normality test. If the calculated P value is greater than 0.05, it is considered that {l1,l2,…l N} is approximately in accordance with the normal distribution; if the calculated P value is less than or equal to 0.05, it is considered that {l1,l2,…l N} does not conform to the normal distribution.

[0070] Step A323, when the normality test result is in accordance with the normal distribution, determine the parameter length range corresponding to the sample request parameter according to the mean and standard deviation of the first length set.

[0071] If the normality test result is in accordance with the normal distribution, the mean e and standard deviation σ of the first length set can be calculated, and then the parameter length range S corresponding to the sample request parameter can be determined according to the mean e and standard deviation σ. i .

[0072] Optionally, the difference between the mean and three times the standard deviation, e-3σ, can be determined as the left boundary of the parameter length range, and the sum of the mean and three times the standard deviation, e+3σ, can be determined as the right boundary of the parameter length range, thereby obtaining the parameter length range S corresponding to the sample request parameter. i =[e-3σ,e+3σ].

[0073] Step A324, when the normality test result is not in accordance with the normal distribution, determine the parameter length range corresponding to the sample request parameter according to the range of the first length set.

[0074] Wherein, when the normality test result is not in accordance with the normal distribution, the first length set {l1,l2,...l N The maximum value l in} max and the minimum value l min , and then according to the maximum value l max and the minimum value l min The difference between the maximum value l max , minimum value l min and range R, determine the parameter length range S corresponding to the sample request parameter i .

[0075] Optionally, the left boundary of the parameter length range may be determined based on the minimum value and the range in the first length set, and the right boundary of the parameter length range may be determined based on the maximum value and the range in the first length set.

[0076] In an optional embodiment, the difference between the minimum value and the range in the first length set can be min -R, determined as the left boundary of the parameter length range, can be the sum of the maximum value and the range in the first length set l max +R, which is determined as the right boundary of the parameter length range, thereby obtaining the parameter length range S corresponding to the sample request parameter i =[l min -R,l max +R].

[0077] In this embodiment, the parameter length range corresponding to the sample request parameter can be determined by adopting a corresponding strategy based on the specific circumstances of the first length set (including whether the first lengths are consistent, whether the first length set conforms to a normal distribution, etc.), rather than adopting a fixed parameter length range determination strategy. This not only makes the implementation of the solution more flexible, but also helps to improve the accuracy of the determined parameter length range.

[0078] In one implementation, for each first request parameter, the first request parameter is verified according to a predetermined parameter verification rule to obtain a verification result (i.e., step 104), which can be performed as follows: step B1-step B2:

[0079] Step B1: judging whether the first request parameter belongs to a required parameter set or an optional parameter set according to the first parameter name.

[0080] Step B2: If it is determined that the first request parameter does not belong to the required parameter set or the optional parameter set, it is determined that the first request parameter verification fails.

[0081] Continuing with the example in step A2, for a normal API request, in addition to including the required parameter set X req If other parameters are required, they should all belong to the optional parameter set X opt If the API request contains parameters that do not belong to X req , nor does it belong to X opt , then the parameter is an illegal parameter, it can be determined that the parameter verification fails, and the API request is an abnormal request. Therefore, any API request parameter x i The parameter range should satisfy:

[0082] In one implementation, after determining whether the first request parameter belongs to a required parameter set or an optional parameter set according to the first parameter name (i.e., step B1), if it is determined that the first request parameter belongs to a required parameter set or an optional parameter set, it is further determined whether the length of the first parameter value is within the parameter length range. If it is determined that the length of the first parameter value is not within the parameter length range, it is determined that the first request parameter check fails.

[0083] In this embodiment, if the length of the first parameter value exceeds the parameter length range, it means that the length of the parameter value is abnormal or non-compliant, so it can be determined that the first request parameter check fails.

[0084] In one implementation, after determining whether the length of the first parameter value is within the parameter length range, if it is determined that the length of the first parameter value is within the parameter length range, it is further determined whether the character element included in the first parameter value is included in the character element set. If it is determined that the character element included in the first parameter value is not included in the character element set, it is determined that the first request parameter check fails.

[0085] In this embodiment, if the character elements included in the first parameter value include elements that do not belong to the character element set, it means that the value of the parameter value is abnormal or non-compliant, so it can be determined that the first request parameter check fails.

[0086] In this embodiment, by performing layer-by-layer verification on the parameter name of the request parameter, the length of the parameter value, and the character elements contained in the parameter value, the verification result is made more accurate, so that it is possible to more accurately determine whether there is an abnormality in the interface request, which is conducive to accurately implementing security protection for the target interface and improving the security of the target interface.

[0087] Figure 2 is a flowchart of another method for processing an interface request provided by an embodiment of the present application. Figure 2 When the interface request processing method shown is applied to the interface security protection scenario of a Web application, the interface request processing method can be deployed in an independent interface request processing device, and the interface request processing device can be deployed in front of the Web application, that is, the interface request processing device can perform request parameter verification processing on the interface request for accessing the Web application in advance, so that when an abnormal interface request is identified, the interface request is rejected, and the abnormal identification of the interface request is decoupled from the Web application. In this way, the update of the parameter verification rule does not need to be packaged and deployed in the Web application, which greatly reduces the cost of changing the parameter verification rule.

[0088] like Figure 2 As shown, the method for processing an interface request may include the following steps 201 to 208:

[0089] Step 201: Obtain a first interface request for a target interface, where the first interface request includes a plurality of first request parameters, and the first request parameters are composed of a first parameter name and a first parameter value.

[0090] Step 202 , for each first request parameter, determine whether the first request parameter belongs to a required parameter set or an optional parameter set according to the first parameter name; if so, execute step 203 ; if not, execute step 207 .

[0091] The required parameter set and the optional parameter set are determined based on multiple historical interface requests of the target interface.

[0092] Step 203 , determining whether the length of the first parameter value is within the parameter length range corresponding to the first request parameter; if so, executing step 204 ; if not, executing step 207 .

[0093] The parameter length range is determined based on multiple historical interface requests of the target interface.

[0094] Step 204 , determining whether the character element included in the first parameter value is included in the character element set corresponding to the first request parameter; if so, executing step 205 ; if not, executing step 207 .

[0095] The character element set is determined based on multiple historical interface requests of the target interface.

[0096] Step 205: Determine whether the first request parameter verification passes.

[0097] Step 206: Determine that there is no abnormality in the first interface request.

[0098] Step 207: Determine whether the first request parameter verification fails.

[0099] Step 208: Determine whether the first interface request is abnormal.

[0100] The specific process of the above steps 201 to 208 has been described in detail in the above embodiment and will not be repeated here.

[0101] In an embodiment of the present application, a first interface request for a target interface can be obtained, the first interface request includes multiple first request parameters, and the first request parameter is composed of a first parameter name and a first parameter value, so that for each first request parameter, the first parameter name of the first request parameter, the length of the first parameter value, and the character elements contained in the first parameter value can be checked and processed according to the parameter verification rules determined in advance based on multiple historical interface requests of the target interface to obtain a verification result. Then, according to the verification result, it is determined whether the first interface request is abnormal. It can be seen that in terms of realizing interface security protection, compared with the method of using parameter verification logic designed and maintained by technicians in the related art to identify illegal parameters in interface requests, thereby identifying abnormal interface requests, this technical solution does not require technicians to design parameter verification rules for the target interface, thereby saving manual design and maintenance costs, avoiding the dependence of the parameter verification process on technicians, and reducing the difficulty of implementing parameter verification. Furthermore, since the parameter verification rules are determined based on multiple historical interface requests of the target interface, based on the parameter verification rules, the request parameters in the interface request for the target interface can be more specifically verified. At the same time, the parameter verification rules are used in the technical solution to verify data of multiple dimensions of the request parameters (including parameter name, length of parameter value, and character elements contained in the parameter value), so that the verification results are more accurate, thereby being able to more accurately determine whether there are abnormalities in the interface request, which is conducive to accurately realizing security protection of the target interface and improving the security of the target interface.

[0102] It should be noted that the execution subject of the method for processing an interface request provided in the embodiment of the present application may be a processing device for an interface request, or a control module in the processing device for an interface request for executing the method for processing an interface request. In the embodiment of the present application, the method for processing an interface request is executed by a processing device for an interface request as an example to illustrate the processing device for an interface request provided in the embodiment of the present application.

[0103] Figure 3 Schematic diagram of a structure of an interface request processing device provided in an embodiment of the present application. Figure 3 As shown, the interface request processing device includes: a first acquisition module 310, a verification processing module 320 and a first determination module 330.

[0104] The first acquisition module 310 is used to obtain a first interface request for a target interface; the first interface request includes multiple first request parameters, and the first request parameters are composed of a first parameter name and a first parameter value; the verification processing module 320 is used to verify the first request parameter according to a predetermined parameter verification rule for each first request parameter, and obtain a verification result; wherein the parameter verification rule is determined based on multiple historical interface requests of the target interface; the parameter verification rule is used to verify the first parameter name, the length of the first parameter value and the character elements contained in the first parameter value; the first determination module 330 is used to determine whether there is an abnormality in the first interface request based on the verification result.

[0105] In one implementation, the interface request processing device further includes a second acquisition module, a second determination module, a third determination module, and a fourth determination module;

[0106] The second acquisition module is used to obtain multiple historical interface requests for the target interface before obtaining the first interface request for the target interface; each historical interface request includes multiple sample request parameters, and the sample request parameters are composed of a sample parameter name and a sample parameter value; the second determination module is used to determine the required parameter set and optional parameter set corresponding to the target interface according to the number of times each sample parameter name appears in the multiple historical interface requests; the third determination module is used to determine, for each sample request parameter, the parameter length range and character element set corresponding to the sample request parameter according to the sample parameter value of the sample request parameter in the multiple historical interface requests; the fourth determination module is used to determine the parameter verification rule corresponding to the target interface according to the required parameter set, optional parameter set, parameter length range and character element set.

[0107] In one implementation, the second determination module includes a statistical unit, a first determination unit, a second determination unit, and a third determination unit;

[0108] A statistical unit, used to count the number of first appearances of each sample parameter name in multiple historical interface requests; a first determination unit, used to determine the sample request parameter corresponding to the sample parameter name as a mandatory parameter when the first number is consistent with the number of multiple historical interface requests; a second determination unit, used to determine the sample request parameter corresponding to the sample parameter name as an optional parameter when the first number is inconsistent with the number of multiple historical interface requests; a third determination unit, used to determine a mandatory parameter set corresponding to the target interface based on each mandatory parameter; and, based on each optional parameter, determine an optional parameter set corresponding to the target interface.

[0109] In one implementation, the third determination module includes a fourth determination unit, a fifth determination unit, a sixth determination unit, and a seventh determination unit;

[0110] The fourth determination unit is used to determine, for each sample request parameter, a first length set corresponding to the sample request parameter according to the first length of the sample parameter value of the sample request parameter in multiple historical interface requests; the fifth determination unit is used to determine the parameter length range corresponding to the sample request parameter according to the first length set; the sixth determination unit is used to respectively determine the character elements contained in the sample parameter values ​​of the sample request parameter in multiple historical interface requests; the seventh determination unit is used to determine the character element set corresponding to the sample request parameter according to the value ranges corresponding to each character element; wherein the character element set is the union of each value range.

[0111] In one implementation, the fifth determination unit is specifically used to: when the first lengths are consistent, determine that the left and right boundaries of the parameter length range corresponding to the sample request parameter are both the first length; when the first lengths are inconsistent, perform a normality test on the first length set to obtain a normality test result; when the normality test result is consistent with the normal distribution, determine the parameter length range corresponding to the sample request parameter according to the mean and standard deviation of the first length set; when the normality test result is inconsistent with the normal distribution, determine the parameter length range corresponding to the sample request parameter according to the range of the first length set.

[0112] In one implementation, the fifth determination unit is specifically used to: determine the difference between the mean and 3 times the standard deviation as the left boundary of the parameter length range; determine the sum of the mean and 3 times the standard deviation as the right boundary of the parameter length range.

[0113] In one implementation, the fifth determination unit is specifically used to: determine the left boundary of the parameter length range according to the minimum value and the range in the first length set; determine the right boundary of the parameter length range according to the maximum value and the range in the first length set.

[0114] In one implementation, the verification processing module 320 includes: a first judgment unit and an eighth determination unit;

[0115] The first judgment unit is used to judge whether the first request parameter belongs to a required parameter set or an optional parameter set according to the first parameter name; the eighth determination unit is used to determine that the first request parameter verification fails if it is determined that the first request parameter does not belong to the required parameter set or the optional parameter set.

[0116] In one implementation, the verification processing module 320 further includes: a second judgment unit and a ninth determination unit;

[0117] The second judgment unit is used to judge whether the first request parameter belongs to the required parameter set or the optional parameter set according to the first parameter name, and if it is determined that the first request parameter belongs to the required parameter set or the optional parameter set, then judge whether the length of the first parameter value is within the parameter length range; the ninth determination unit is used to determine that the first request parameter check fails if it is determined that the length of the first parameter value is not within the parameter length range.

[0118] In one implementation, the verification processing module 320 further includes: a third judgment unit and a tenth determination unit;

[0119] The third judgment unit is used to judge whether the length of the first parameter value is within the parameter length range, and if it is determined that the length of the first parameter value is within the parameter length range, then judge whether the character elements contained in the first parameter value are included in the character element set; the tenth determination unit is used to determine that the first request parameter check fails if it is determined that the character elements contained in the first parameter value are not included in the character element set.

[0120] In an embodiment of the present application, a first interface request for a target interface can be obtained, the first interface request includes multiple first request parameters, and the first request parameter is composed of a first parameter name and a first parameter value, so that for each first request parameter, the first parameter name of the first request parameter, the length of the first parameter value, and the character elements contained in the first parameter value can be checked and processed according to the parameter verification rules determined in advance based on multiple historical interface requests of the target interface to obtain a verification result. Then, according to the verification result, it is determined whether the first interface request is abnormal. It can be seen that in terms of realizing interface security protection, compared with the method of using parameter verification logic designed and maintained by technicians in the related art to identify illegal parameters in interface requests, thereby identifying abnormal interface requests, this technical solution does not require technicians to design parameter verification rules for the target interface, thereby saving manual design and maintenance costs, avoiding the dependence of the parameter verification process on technicians, and reducing the difficulty of implementing parameter verification. Furthermore, since the parameter verification rules are determined based on multiple historical interface requests of the target interface, based on the parameter verification rules, the request parameters in the interface request for the target interface can be more specifically verified. At the same time, the parameter verification rules are used in the technical solution to verify data of multiple dimensions of the request parameters (including parameter name, length of parameter value, and character elements contained in the parameter value), so that the verification results are more accurate, thereby being able to more accurately determine whether there are abnormalities in the interface request, which is conducive to accurately realizing security protection of the target interface and improving the security of the target interface.

[0121] The interface request processing device in the embodiment of the present application can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device can be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc. The non-mobile electronic device can be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0122] The interface request processing device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0123] The interface request processing device provided in the embodiment of the present application can realize Figure 1 to Figure 2 To avoid repetition, the various processes implemented in the method embodiment are not described here.

[0124] Based on the same technical concept, an embodiment of the present application further provides an electronic device, which is used to execute the above-mentioned method for processing an interface request. Figure 4 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor (processor) 410, a communication interface (Communications Interface) 420, a memory (memory) 430 and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call a computer program stored in the memory 430 and executable on the processor 410 to perform the following steps:

[0125] Obtain a first interface request for a target interface; the first interface request includes multiple first request parameters, and the first request parameters are composed of a first parameter name and a first parameter value; for each first request parameter, the first request parameter is verified according to a predetermined parameter verification rule to obtain a verification result; wherein the parameter verification rule is determined based on multiple historical interface requests of the target interface; the parameter verification rule is used to verify the first parameter name, the length of the first parameter value and the character elements contained in the first parameter value; based on the verification result, determine whether the first interface request has an abnormality.

[0126] In an embodiment of the present application, a first interface request for a target interface can be obtained, the first interface request includes multiple first request parameters, and the first request parameter is composed of a first parameter name and a first parameter value, so that for each first request parameter, the first parameter name of the first request parameter, the length of the first parameter value, and the character elements contained in the first parameter value can be checked and processed according to the parameter verification rules determined in advance based on multiple historical interface requests of the target interface to obtain a verification result. Then, according to the verification result, it is determined whether the first interface request is abnormal. It can be seen that in terms of realizing interface security protection, compared with the method of using parameter verification logic designed and maintained by technicians in the related art to identify illegal parameters in interface requests, thereby identifying abnormal interface requests, this technical solution does not require technicians to design parameter verification rules for the target interface, thereby saving manual design and maintenance costs, avoiding the dependence of the parameter verification process on technicians, and reducing the difficulty of implementing parameter verification. Furthermore, since the parameter verification rules are determined based on multiple historical interface requests of the target interface, based on the parameter verification rules, the request parameters in the interface request for the target interface can be more specifically verified. At the same time, the parameter verification rules are used in the technical solution to verify data of multiple dimensions of the request parameters (including parameter name, length of parameter value, and character elements contained in the parameter value), so that the verification results are more accurate, thereby being able to more accurately determine whether there are abnormalities in the interface request, which is conducive to accurately realizing security protection of the target interface and improving the security of the target interface.

[0127] The specific execution steps can refer to the various steps of the embodiment of the method for processing interface requests mentioned above, and the same technical effect can be achieved. To avoid repetition, they will not be repeated here.

[0128] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0129] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0130] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0131] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0132] An embodiment of the present application also provides a computer-readable storage medium, which is used to store computer-executable instructions. When the computer-executable instructions are executed by a processor, the various processes of the embodiment of the processing method for the above-mentioned interface request are implemented, and the same technical effect can be achieved. To avoid repetition, they are not repeated here.

[0133] The processor is the processor in the electronic device described in the above embodiment. The computer readable storage medium is, for example, a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0134] An embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the various processes of the embodiment of the processing method for the above-mentioned interface request are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0135] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run programs or instructions to implement the various processes of the embodiment of the above-mentioned interface request processing method, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0136] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0137] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0138] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0139] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for processing an interface request, characterized in that: include: Obtaining a first interface request for a target interface; The first interface request includes a plurality of first request parameters, wherein the first request parameters are composed of a first parameter name and a first parameter value; For each first request parameter, verify the first request parameter according to a predetermined parameter verification rule to obtain a verification result; wherein the parameter verification rule is determined based on multiple historical interface requests of the target interface; the parameter verification rule is used to verify the first parameter name, the length of the first parameter value, and the character elements contained in the first parameter value; According to the verification result, it is determined whether the first interface request is abnormal.

2. The method according to claim 1, characterized in that: Before obtaining the first interface request for the target interface, the method further includes: Acquire the multiple historical interface requests for the target interface; each historical interface request includes multiple sample request parameters, and the sample request parameters are composed of sample parameter names and sample parameter values; Determine a required parameter set and an optional parameter set corresponding to the target interface according to the number of times each sample parameter name appears in the multiple historical interface requests; For each sample request parameter, determining a parameter length range and a character element set corresponding to the sample request parameter according to sample parameter values ​​of the sample request parameter in the multiple historical interface requests; The parameter verification rule corresponding to the target interface is determined according to the required parameter set, the optional parameter set, the parameter length range and the character element set.

3. The method according to claim 2, characterized in that The determining, according to the number of times each sample parameter name appears in the multiple historical interface requests, a required parameter set and an optional parameter set corresponding to the target interface includes: For each sample parameter name, counting the number of first occurrences of the sample parameter name in the multiple historical interface requests; In a case where the first number is consistent with the number of the plurality of historical interface requests, determining the sample request parameter corresponding to the sample parameter name as a required parameter; In the case where the first number is inconsistent with the number of the plurality of historical interface requests, determining the sample request parameter corresponding to the sample parameter name as an optional parameter; According to each of the mandatory parameters, the mandatory parameter set corresponding to the target interface is determined; and according to each of the optional parameters, the optional parameter set corresponding to the target interface is determined.

4. The method according to claim 2, characterized in that: The step of determining, for each sample request parameter, a parameter length range and a character element set corresponding to the sample request parameter according to sample parameter values ​​of the sample request parameter in the multiple historical interface requests, includes: For each sample request parameter, determining a first length set corresponding to the sample request parameter according to a first length of a sample parameter value of the sample request parameter in the plurality of historical interface requests; Determine, according to the first length set, the parameter length range corresponding to the sample request parameter; Respectively determining character elements contained in sample parameter values ​​of the sample request parameter in the plurality of historical interface requests; According to the value ranges corresponding to the character elements, the character element set corresponding to the sample request parameter is determined; wherein the character element set is the union of the value ranges.

5. The method according to claim 4, characterized in that The determining, according to the first length set, the parameter length range corresponding to the sample request parameter includes: In the case where the first lengths are all the same, determining that the left boundary and the right boundary of the parameter length range corresponding to the sample request parameter are both the first length; In the case where the first lengths are inconsistent, performing a normality test on the first length set to obtain a normality test result; When the normality test result is in accordance with the normal distribution, determining the parameter length range corresponding to the sample request parameter according to the mean and standard deviation of the first length set; When the normality test result is not in compliance with the normal distribution, the parameter length range corresponding to the sample request parameter is determined according to the range of the first length set.

6. The method according to claim 5, characterized in that The determining, according to the mean and standard deviation of the first length set, the parameter length range corresponding to the sample request parameter includes: The difference between the mean and 3 times the standard deviation is determined as the left boundary of the parameter length range; The sum of the mean and three times the standard deviation is determined as the right boundary of the parameter length range.

7. The method according to claim 5, characterized in that The determining, according to the range of the first length set, the parameter length range corresponding to the sample request parameter includes: Determine the left boundary of the parameter length range according to the minimum value in the first length set and the range; The right boundary of the parameter length range is determined according to the maximum value in the first length set and the range.

8. The method according to claim 2, characterized in that: The step of performing verification processing on each first request parameter according to a predetermined parameter verification rule to obtain a verification result includes: Determining, according to the first parameter name, whether the first request parameter belongs to the required parameter set or the optional parameter set; If it is determined that the first request parameter does not belong to the required parameter set or the optional parameter set, it is determined that the first request parameter verification fails.

9. The method according to claim 8, characterized in that After determining, according to the first parameter name, whether the first request parameter belongs to the required parameter set or the optional parameter set, the method further includes: If it is determined that the first request parameter belongs to the required parameter set or the optional parameter set, determining whether the length of the first parameter value is within the parameter length range; If it is determined that the length of the first parameter value is not within the parameter length range, it is determined that the first request parameter check fails.

10. The method according to claim 9, characterized in that After determining whether the length of the first parameter value is within the parameter length range, the method further includes: If it is determined that the length of the first parameter value is within the parameter length range, determining whether the character element included in the first parameter value is included in the character element set; If it is determined that the character element included in the first parameter value is not included in the character element set, it is determined that the first request parameter check fails.

Images