Zero-load interface security protection method, device, electronic device and storage medium

Abstract

This invention discloses a zero-load interface security protection method, device, electronic device, and storage medium, comprising: reading access logs of business services; dividing the access logs into internal network access logs and external network access logs based on the remote access IP field and a preset range of internal network IP addresses; determining the accessed internal network domain name and external network domain name based on the internal network access logs and external network access logs; locating the business project deployment location of the internal network domain name and external network domain name to obtain the business project deployment file, and extracting the interface address of the corresponding domain name based on the business project deployment file; determining the external open range of the interface address to obtain the public network open interface and the internal network access interface, and assembling the complete interface link of the public network open interface and the internal network access interface; identifying abnormal access based on the complete interface link, and intercepting abnormal access behavior. This invention improves the security protection capability of the interface and the security of the system, and can be applied to the field of information technology.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a zero-load interface security protection method, device, electronic device, and storage medium. Background Technology

[0002] An interface is a set of software functions encapsulated from server-side software to meet external software requirements. A typical HTTP / HTTPS interface consists of two parts: the interface link and the request method. The interface link is exposed on the network in the format "http or https: / / domain / location / interface address", where the " / location / " part can have any number of parts separated by the slash " / ".

[0003] All publicly accessible interfaces must be effectively protected by firewalls and other facilities; otherwise, business operations may be attacked, and business data may be leaked. Accurate and comprehensive interface information is also crucial for interface testing and monitoring coverage. Furthermore, interface information facilitates efficient handling of alarms and fault events in daily operations and maintenance, and can be used to analyze resources and improve the efficiency of interface development. However, internet companies may have hundreds of thousands or even more interfaces. How to continuously and accurately discover, effectively manage, assess, and protect against the security risks of all interfaces has become a critical issue that urgently needs to be addressed in practice.

[0004] Terminology Explanation:

[0005] An interface, also known as an API, is an abstraction of a set of software functions exposed by a server application for access by various software forms, such as web pages, mobile clients, or other server applications. It typically consists of predefined functions designed to provide applications and developers with the ability to access a set of routines based on specific software or hardware, without needing to access the source code or understand the details of the internal workings. In this invention, the term "interface" specifically refers to an interface exposed via the HTTP / HTTPS protocol.

[0006] Interface metadata refers to information about the interface itself, the project to which the interface belongs, the project's release (to be deployed) files, and the various resources that the interface needs to call to run.

[0007] Web Application Firewall (WAF): Also known as Web Application Level Protection / Intrusion Prevention System, it is a product that protects web applications by enforcing a series of security policies for HTTP / HTTPS at the application layer. It represents an emerging class of information security technologies used to solve web application security problems that traditional devices such as firewalls cannot handle. Summary of the Invention

[0008] The purpose of this invention is to at least partially solve one of the technical problems existing in the prior art.

[0009] Therefore, one objective of this invention is to provide a zero-load interface security protection method, which enables automatic discovery of interface information and automatic identification and interception of abnormal access behavior, thereby improving the security protection capability of the interface and the security of the system.

[0010] Another objective of this invention is to provide a zero-load interface security protection device.

[0011] To achieve the above-mentioned technical objectives, the technical solutions adopted in the embodiments of the present invention include:

[0012] On one hand, embodiments of the present invention provide a zero-load interface security protection method, comprising the following steps:

[0013] Read the access logs of the business service, and divide the internal network access logs and external network access logs according to the remote access IP field in the access logs and the preset internal network IP address range;

[0014] The accessed intranet domain name and the accessed extranet domain name are determined based on the intranet access log and the extranet access log;

[0015] Locate the business project deployment locations of the intranet domain name and the extranet domain name, obtain the business project deployment files, and extract the interface addresses of the corresponding domain names based on the business project deployment files;

[0016] Determine the external access scope of the interface address to obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface.

[0017] Abnormal access is identified based on the complete link of the interface, and abnormal access behavior is intercepted.

[0018] Furthermore, in one embodiment of the present invention, the zero-load interface security protection method further includes the following steps:

[0019] When the deployment files of the business project are updated, the interface address and the business project to which the changed domain name belongs are found based on the domain name change information.

[0020] Furthermore, in one embodiment of the present invention, the step of identifying abnormal access based on the complete interface link and intercepting abnormal access behavior specifically includes:

[0021] Extract the tail content of the complete link of the interface to obtain the tail interface link;

[0022] The target access log is located in the external network access log based on the tail interface link. The access link of the target access log contains the tail interface link, but other parts are different from the complete interface link.

[0023] Based on the source IP address, determine the suspiciousness analysis indicators of the target access log, and determine the region, range, and access frequency of the IP address in the target access log;

[0024] The suspiciousness analysis indicators, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency are input into a pre-trained abnormal access identification model to determine whether the target access log is an abnormal access log.

[0025] The corresponding source IP of the abnormal behavior is determined based on the abnormal access log, and the risk level of the source IP of the abnormal behavior is determined.

[0026] Abnormal access behavior is blocked based on the IP address from which the abnormal behavior originates and the risk level.

[0027] Furthermore, in one embodiment of the present invention, the step of finding the business project deployment location of the intranet domain name and the extranet domain name, obtaining the business project deployment file, and extracting the interface address of the corresponding domain name based on the business project deployment file specifically includes:

[0028] Determine the service IP and port information of the internal network domain name and the external network domain name;

[0029] Based on the service IP and the port information, locate the deployment location of the corresponding domain name and obtain the deployment file of the business project;

[0030] Determine the file type of the business project deployment file, parse the business project deployment file according to the file type, and obtain the interface address.

[0031] Furthermore, in one embodiment of the present invention, the step of determining the external open range of the interface address, obtaining the public network open interface and the internal network access interface, and assembling the complete interface link of the public network open interface and the internal network access interface specifically includes:

[0032] The context-path configuration value is found in the image file based on the starting path of the class file. The first interface address is obtained by concatenating the context-path configuration value with the interface address.

[0033] The location address of the interface address is obtained through a web server, and the location address is matched with the first interface address. The external open scope of the interface address is determined based on the matching result, thereby obtaining the public network open interface and the internal network access interface.

[0034] The complete link of the corresponding public network open interface is assembled based on the corresponding domain name, the location address, and the first interface address that is successfully matched;

[0035] The complete link of the corresponding intranet access interface is obtained by assembling the corresponding domain name, the location address, and the first interface address that failed to match.

[0036] Furthermore, in one embodiment of the present invention, the step of determining the suspiciousness analysis indicators of the target access log based on the access source IP, and determining the region, range, and access frequency of the target access log's IP, specifically includes:

[0037] Determine the source IP of the target access log, and find the suspiciousness analysis indicators based on the source IP. The suspiciousness analysis indicators include the User-Agent, request size, response size, response status code, access time, actual access link, the backend / underlying business service and IP that the access actually reached, and the project or domain name that was actually accessed.

[0038] The region and range of the IP are determined based on the source IP, and the IP access frequency is obtained by counting the number of times the source IP accesses the IP within a preset time period.

[0039] Furthermore, in one embodiment of the present invention, the step of determining the corresponding abnormal behavior source IP based on the abnormal access log and determining the risk level of the abnormal behavior source IP specifically includes:

[0040] The IP address from which the abnormal access log was accessed is taken as the IP address from which the abnormal behavior originated.

[0041] Determine the set of interface link addresses and corresponding access parameters found by the source IP of the abnormal behavior, and determine the business parameters, access frequency, access tool characteristics and abnormal behavior type set successfully obtained by the source IP of the abnormal behavior based on the status code and response;

[0042] The risk level of the source IP of the abnormal behavior is determined based on the business parameters, the access frequency, the characteristics of the access tool, and the abnormal behavior type set.

[0043] On the other hand, embodiments of the present invention provide a zero-load interface security protection device, including:

[0044] The access log reading module is used to read the access logs of business services and divide the access logs into internal network access logs and external network access logs based on the remote access IP field in the access logs and the preset internal network IP address range.

[0045] The access domain name determination module is used to determine the accessed intranet domain name and the accessed extranet domain name based on the intranet access log and the extranet access log;

[0046] The interface address extraction module is used to find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file;

[0047] The interface complete link assembly module is used to determine the external open scope of the interface address, obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface.

[0048] The abnormal access behavior interception module is used to identify abnormal access based on the complete link of the interface and to intercept abnormal access behavior.

[0049] On the other hand, embodiments of the present invention provide an electronic device, the electronic device including a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for implementing connection communication between the processor and the memory, wherein the program, when executed by the processor, implements the zero-load interface security protection method as described above.

[0050] On the other hand, embodiments of the present invention also provide a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs, which can be executed by one or more processors to implement the zero-load interface security protection method as described above.

[0051] The advantages and beneficial effects of the present invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention:

[0052] This invention reads access logs from business services, divides them into internal and external access logs based on the remote access IP field and a preset range of internal IP addresses, determines the accessed internal and external domain names, locates the business project deployment locations of these domain names, obtains the business project deployment files, extracts the corresponding domain name's interface address from the deployment files, determines the external access scope of the interface address, obtains the public network open interface and the internal network access interface, and assembles the complete interface links of the public network open interface and the internal network access interface. Abnormal access is identified and blocked based on the complete interface links. This invention achieves automatic discovery of interface information and automatic identification and blocking of abnormal access behavior, improving the security protection capabilities of interfaces and the security of the system. Attached Figure Description

[0053] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the embodiments of the present invention are described below. It should be understood that the drawings described below are only for the convenience of clearly describing some embodiments of the technical solutions of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0054] Figure 1 A flowchart illustrating the steps of a zero-load interface security protection method provided in an embodiment of the present invention;

[0055] Figure 2 A schematic diagram illustrating the implementation framework of the zero-load interface security protection method provided in this embodiment of the invention;

[0056] Figure 3 Another flowchart of the zero-load interface security protection method provided in this embodiment of the invention;

[0057] Figure 4 A flowchart of step S103 provided in an embodiment of the present invention;

[0058] Figure 5 A flowchart of step S104 provided in an embodiment of the present invention;

[0059] Figure 6 A flowchart of step S105 provided in an embodiment of the present invention;

[0060] Figure 7 A flowchart of step S1053 provided in an embodiment of the present invention;

[0061] Figure 8 A flowchart of step S1055 provided in an embodiment of the present invention;

[0062] Figure 9 This is a schematic diagram of the zero-load interface safety protection device provided in an embodiment of the present invention;

[0063] Figure 10 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present invention;

[0064] Figure 11 This is a schematic diagram of the structure of the storage medium provided in an embodiment of the present invention. Detailed Implementation

[0065] The embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. It should be noted that although functional modules are divided in the system schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system schematic diagram or the order in the flowchart. The step numbers in the following embodiments are only set for ease of explanation and do not limit the order between steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0066] In the description of this invention, "multiple" means two or more. The use of "first" and "second" is for distinguishing technical features only and should not be construed as indicating or implying relative importance, the number of indicated technical features, or the order of the indicated technical features. Furthermore, unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0067] Related technologies disclose techniques for automatically discovering and connecting to REST interfaces. These techniques involve analyzing data received from the REST interface of a web service in response to HTTP requests sent to the web service's endpoints using a vendor computing device. The analyzed data then represents patterns and confidence levels, generating one or more possible rules for the REST interface. This supposedly automatically discovers and connects to the REST interface. However, this approach introduces additional access to the interface, wasting resources and leading to junk data in the business system. Furthermore, interface discovery is inefficient, making it difficult to identify all interfaces.

[0068] Related technologies also disclose an API security management system and method for seamless automatic discovery, which requires prior registration of interfaces with security management needs; therefore, it cannot automatically discover unregistered interfaces. Another related technology discloses an API automatic discovery method based on eBPF. This solution increases the resource and performance overhead of fully collecting and parsing API information from the business domain, thus negatively impacting normal business communication. Furthermore, its approach of collecting interface information based on actual network traffic cannot obtain data from inactive interfaces.

[0069] Related technologies also disclose interface difference analysis methods, devices, storage media, and apparatuses, capable of extracting JAR files from Docker image files and then obtaining interface information from the JAR files using a preset class loader. The shortcomings of this approach include:

[0070] 1) It requires accurate information to be configured in advance. Obtaining this information is not only cumbersome, but also difficult or impossible to obtain accurately in advance due to technical barriers. This includes the possibility of developing a class loader specifically for some projects. This solution does not provide a technical method to automatically obtain all the preset information.

[0071] 2) The obtained interface information is limited, making it impossible to identify important information related to practical applications, such as interface dependencies and potential security risks;

[0072] 3) Performance and stability defects: Extracting JAR packages from image files to the hard drive involves disk I / O. If the JAR file is deleted or corrupted during the process, it will cause the solution to malfunction. In addition, there are cases where the ClassLoader can load the classes in the JAR but cannot obtain the interface information described in the solution, making the solution practically infeasible for many projects.

[0073] Other technical solutions that could potentially obtain interface information include: ① Extracting interface addresses from source code. However, due to reasons such as domain name configuration and security protection during business deployment, the interface addresses defined in the development code cannot form a complete interface link deployed to the live network environment; ② Extracting interface addresses from business access logs. However, since business access logs for a certain period do not contain logs of inactive or unaccessed interfaces, a large amount of junk data can easily appear in the business access logs when there are abnormal accesses such as attacks and interface scanning. As a result, these solutions cannot provide an accurate set of full interface information at any time.

[0074] This invention provides a zero-load interface security protection method, device, electronic device, and storage medium to achieve the following objectives:

[0075] 1) Based on the remote host IPs recorded in the access logs of services such as Apache HTTP Server, Nginx, and k8s Ingress, find all domain names accessed by the public and private networks. Further use the obtained domain names to find the deployment configuration and deployment files of the corresponding business systems. Then, based on memory, directly retrieve and extract interface information from the deployment files. Further integrate the deployment information to obtain complete interface links and distinguish between internal and external interfaces. Under the premise of not affecting business operations, achieve accurate and automatic discovery of all interface information.

[0076] 2) By linking interface change events, including changes in the activation of a new domain name, updates to the project to which the interface belongs, or updates to the project deployment files, changes in the interface information of each project can be automatically detected and synchronized.

[0077] 3) Based on the found accurate interface address, by analyzing the actual access links, User-Agent, access frequency and other information of external access behavior in the access logs of business services, we can automatically identify and classify abnormal behaviors such as scanning and attacking business interfaces and implement appropriate protection to eliminate the impact of abnormal requests or non-real business requests on the business system.

[0078] The zero-load interface security protection method provided in this application can be applied to terminals, servers, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, set-top box, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the zero-load interface security protection method, etc., but is not limited to the above forms.

[0079] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0080] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards of the relevant countries and regions. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data for the proper functioning of the embodiments of this application obtained.

[0081] First, the implementation framework of the zero-load interface security protection method of this invention will be described, such as... Figure 2The diagram illustrates the implementation framework of the zero-load interface security protection method provided in this embodiment of the invention. It comprises three parts: a server, an automatic discovery client, and an automatic protection client. The automatic protection client needs to be deployed on the web server to be protected. The automatic discovery client, when parsing interface information from the deployment files of the business project, can be deployed on any server, as long as it has access to the business deployment files. The server is centrally deployed as a cluster service; data can be stored in a relational database or a NoSQL database, and topology data can be stored in a graph database. The automatic discovery client is mainly used to collect and report domain name, load balancing, and HTTP service process and configuration information. It also supports analyzing the deployment files of the business project, retrieving and extracting interface addresses, processing them, and reporting them to the server. The automatic protection client is mainly responsible for parsing HTTP and HTTPS protocols on the network device side, identifying abnormal access behavior to the interface based on whether the access link is a real interface link and the abnormal interface access behavior judgment model provided by the server. The server primarily provides management of domain names, load balancers, HTTP servers (Nginx, Apache HTTP Server, etc.) and their configurations and changes. It supports the classification and management of projects, interfaces and their changes, and the sources of abnormal interface access. It also provides management and auditing functions for abnormal information such as inactive interfaces, domain names that have not been officially activated, domain names that cannot be found in the configuration, and interface addresses with abnormal matching.

[0082] This invention not only automatically identifies the accurate information of the actual interfaces of each business project, but also does not require any access to the business project; it does not generate any logs on any part of the business project deployment architecture, and the business project does not store unnecessary data in its database; for different types of project release files, this solution is entirely memory-based during execution, which is not only high-performance (verified to be more than 110 times faster than conventional decompilation-based solutions, for example, on a server with 8GB of memory, it only takes about 0.3 seconds to complete the parsing and output process of all interfaces contained in a business project image), but also does not require a Docker environment or application startup, and has low resource requirements such as memory and CPU, and can run at high performance on low-configuration servers. No temporary files are generated on the disk during the entire process, so it also has higher reliability and is convenient to use; the result data is also valuable for the analysis of access logs of business projects.

[0083] like Figure 1 The diagram shown is a flowchart of one step of the zero-load interface security protection method provided in an embodiment of the present invention. (Refer to...) Figure 1 This invention provides a zero-load interface security protection method, which specifically includes the following steps:

[0084] S101. Read the access logs of the business service and divide the internal network access logs and external network access logs according to the remote access IP field in the access logs and the preset internal network IP address range.

[0085] S102. Determine the accessed intranet domain name and extranet domain name based on the intranet access log and extranet access log;

[0086] S103. Locate the deployment location of business projects for internal and external domain names, obtain the business project deployment files, and extract the interface address of the corresponding domain name based on the business project deployment files.

[0087] S104. Determine the scope of the interface address to be open to the outside world, obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface.

[0088] S105. Identify abnormal access based on the complete interface link and intercept abnormal access behavior.

[0089] like Figure 4 The diagram shown is a flowchart of step S103 provided in an embodiment of the present invention. (Refer to...) Figure 4 As an optional implementation, the deployment locations of business projects on internal and external domains are located to obtain the business project deployment files. The interface addresses of the corresponding domains are then extracted based on these files. Specifically, this includes:

[0090] S1031. Determine the service IP and port information for internal and external network domain names;

[0091] S1032. Locate the deployment location of the corresponding domain name based on the service IP and port information to obtain the deployment file of the business project;

[0092] S1033. Determine the file type of the business project deployment file, parse the business project deployment file according to the file type, and obtain the interface address.

[0093] like Figure 5 The diagram shown is a flowchart of step S104 provided in an embodiment of the present invention. (Refer to...) Figure 5 As an optional implementation, the scope of the interface address to be exposed to the outside world is determined to obtain the public network open interface and the internal network access interface, and the complete interface link of the public network open interface and the internal network access interface is assembled, which specifically includes:

[0094] S1041. Find the context-path configuration value in the image file according to the starting path of the class file, and concatenate the context-path configuration value with the interface address to obtain the first interface address;

[0095] S1042. Obtain the location address of the interface address through the Web server, match the location address with the first interface address, determine the external open scope of the interface address based on the matching result, and obtain the public network open interface and the internal network access interface.

[0096] S1043. Assemble the complete link of the corresponding public network open interface based on the corresponding domain name, location address and the first interface address that is successfully matched;

[0097] S1044. Assemble the complete link of the corresponding intranet access interface based on the corresponding domain name, location address, and the first interface address that failed to match.

[0098] Specifically, the process of the zero-load interface automatic discovery scheme in this embodiment of the invention is as follows:

[0099] 1) Read and analyze the access logs of business services (usually access logs of services such as Apache HTTP Server, Nginx, and k8sIngress), find the access logs that are as close as possible to the backend service interface based on the content at the end of the access link, and find the remote access host IP in these log records.

[0100] 2) Determine whether the log record was initiated by a public or private IP address based on the remote host IP: If it's a regular IP address, consider IPs within the following ranges: 10.0.0.0~10.255.255.255, 172.0.0.0~172.255.255.255, 192.0.0.0~192.255.255.255, 169.0.0.0~169.255.255.255, and 127.0.0.1 as private IP addresses; otherwise, consider them public IP addresses. If it's an IPv6 address, consider IPs starting with fc00:: / 7, fd00:: / 8, or fe80:: / 10 as private IP addresses; consider all other IP addresses as public IP addresses. The IP range for this determination can be adjusted based on actual needs.

[0101] 3) Summarize the logs of all public IP and internal IP accesses, extract and summarize the domain names open to the public network from the corresponding access links, and the remaining domain names are domain names open to the internal network;

[0102] The following two steps realize the topology discovery from the address pointed to by the domain name to the server where the business project deployment file is located, and finally find the location of the business project deployment file, so as to obtain all the interfaces of the corresponding business that have been deployed and launched from the business deployment file.

[0103] 4) Based on the domain name information, search for all service IPs and possible port information corresponding to each domain name obtained above from public and private network DNS services, and record the domain names that cannot be found and the last update time of the configuration;

[0104] 5) Locate the deployment address of the backend business system: Based on the runtime processes and port information on the relevant servers, and combined with the results obtained in the previous step, find the specific service on the corresponding IP and port until the deployment address of the backend business system is found. This mainly includes business systems, traditional web services and Kubernetes services. Calculate the total amount of computing resources used by the business project, such as how many servers or how many Pods, including how many CPU cores and how many GB of memory.

[0105] 6) Locate the deployment files of the business system deployed under the domain name: If it is a business system, find the specific deployment path of the business system based on the runtime process information on the server and obtain the business deployment files; if it is a web service such as Nginx or Apache HTTP Server, first verify the deployment relationship by checking whether the access IP of this type of service comes from the IP of the service in the previous step, then find and record the possible locations and reverse proxy and load balancing configurations. If there are multiple, connect through / in the actual configuration order, record the creation time and update time of the relevant configuration files, and then recursively search for the services on the configuration addresses or IPs and ports of its backend services; if it is a Kubernetes service, find the corresponding image.

[0106] 7) Here, based on memory usage, the project's interface addresses are obtained by parsing the business deployment files according to their type: First, the file creation and update times are recorded. Then, the interface addresses are obtained by processing the files according to their type.

[0107] a. If the deployment file is a file with the extension .jar or .war, it can be handled by taking advantage of the fact that these files are essentially compressed files:

[0108] ① Read the contents of the compressed file through the corresponding compressed input stream to obtain each compressed item, and then determine whether further analysis and processing is needed based on the path, name and contents of each compressed item;

[0109] ② Taking advantage of the fact that most current Internet businesses are built based on the MVC pattern, we can search for all compressed items in the controller folder or compressed items whose names contain "Controller" and whose extension is ".class" based on the MVC pattern. Alternatively, we can use reflection to retrieve all classes with interface address annotations to ensure that only the necessary classes are processed, thereby eliminating the influence of a large number of other files in the compressed files. We can also record the starting path of the class files. Here, we can also use the enterprise's inherent package path information to locate the target folder.

[0110] ③ For each such compressed item, first read its compressed byte stream from the compressed file, then read the class, methods and related annotation information from the class byte stream in sequence according to the JVM specification, and then use this information to construct a bytecode object representing the corresponding class.

[0111] ④ Next, leveraging the common practice of using annotations to define interfaces in various programming languages ​​and development frameworks, we can find all classes and methods that define interfaces by searching for annotations related to the interface definition information of the class or its methods obtained in the previous step. (For example, using the Spring framework, the RestController annotation can be used to declare a class containing an interface, and then the interface can be defined in the methods of such a class; you can also use annotations such as RequestMapping, GetMapping, PostMapping, PutMapping, and DeleteMapping (mainly the first three) to define interface information from both the class and method perspectives. Similar annotations also exist in languages ​​such as Go, Python, and C# or their mainstream frameworks, and interface information can be parsed in a similar way.)

[0112] ⑤ Use both class and method annotations to determine if a class annotation is a formal interface definition: When a class annotation contains interface address information, use the ' / ' symbol to connect the class annotation address and the method annotation address in that order as the interface address. Otherwise, determine the interface address directly based on the address information in the method annotation. Simultaneously, use the annotation's definition and usage to parse its request method. For example, the request methods for GetMapping, PostMapping, and DeleteMapping annotations are Get, Post, and Delete, respectively. RequestMapping either uses the request method defined by the developer through the annotation's method attribute or uses the default request method. Also, ignore all annotations without defined address link information and class interface annotations that do not contain method interface annotations. Add a ' / ' to the left of the first character if the class annotation address does not start with ' / '. These cases can be logged and alerted for technical personnel to improve.

[0113] ⑥ Parse and record the class and specific method name of the interface. If the project does not use annotations to define the interface address, extract the interface address and corresponding Java class method from the XML configuration file. If this fails, record the domain name and its corresponding project information for later troubleshooting.

[0114] If the release files are for projects developed using languages ​​such as C#, Python, or Go, they can be processed using techniques like reflection and annotations. Here, you can also obtain information such as the development language / platform of the business project and the technical frameworks used.

[0115] b. If the deployment file is another type of compressed file, such as a Docker image of a business system deployed on Kubernetes, which is a compressed file with the .tar extension, then this type of compressed file may contain nested .tar files in a certain path. Therefore, it is important to note that these files may contain two or more nested compressed files. The actual business system deployment file is often a compressed file of a different format, possibly residing in another compressed file within another compressed file, and the image file size may exceed 1GB. The industry generally believes that "the .tar file must be decompressed before the files within it can be accessed directly," which inevitably leads to inefficiency or even instability due to disk I / O. Therefore, if interface information can be read directly from such files in a high-performance and stable manner using only memory, it will be very beneficial for automatically discovering interfaces defined by various projects. The solution here does not require specifying or configuring any information for the business image being processed, and the entire process can be completed within the server's memory.

[0116] ① Based on the type (file extension) of the business deployment files released by each development platform and the common release path where the business files may exist, locate the business system release files and their paths. Note that typical folders included in the operating system should be excluded. Then proceed with the following steps:

[0117] ② Read the contents of all types of compressed files layer by layer based on memory until the target type of file is obtained based on the characteristics of the extension of the business deployment file, the enterprise-specific package structure information, the business class name where the interface is located and its extension class and its path. Find the compressed item containing the interface definition class file and its path in a certain compressed file in the inner layer.

[0118] ③ Read the byte data of the compressed items of the inner compressed file sequentially, construct the corresponding file-like data stream object, until no more data can be read;

[0119] ④ Following the order specified in the JVM specification, the annotations, classes, and methods contained in the data stream are read, parsed, and saved sequentially from the class byte stream in memory for later use. Then, this information is used to construct an object representing the corresponding class bytecode. The traditional approach for this part is to use various ClassLoader objects of the JVM. However, these class loaders essentially put the loaded class into a state where it can be instantiated and run. Extracting the class annotation information does not require this. Therefore, using class loaders requires more resources. More importantly, regular class loaders cannot handle the compressed byte stream from the image file. Other situations include: due to differences in class loaders, the timing of class loading, and the influence of the context, even if a class object can be obtained through the class loader, the class annotations may still not be available. Therefore, class loaders are not suitable in this environment and are cumbersome and require more resources.

[0120] ⑤ Use this object to find the class of the annotation that defines the interface address information as described in the section on processing "jar or war files". Similarly, use the method annotation of such class to further obtain the interface address. In this process, the class and specific method name of the interface can be easily parsed and recorded.

[0121] c. If the file is deployed through source code or after the source code has been obfuscated, then find the link address from the file by using regular expressions based on the characteristics of the link address content and its position above the class and method definitions;

[0122] d. If the business project deployment file has been compiled into a binary file, then all interface addresses can be found through symbol supplementation and symbol analysis. In special cases, they can be extracted through relevant source code retrieval.

[0123] 8) Based on the starting path of the class file, search for project configuration files with the extensions .properties, .yml, or .yaml in the compressed file or image based on memory, and search for possible context-path configurations. If they exist, concatenate the context-path configuration value with each of the above interface addresses in sequence to form a new interface address.

[0124] 9) Based on the rules for matching the web server's (e.g., Nginx) location configuration with the actual business interface address, and considering the possible existence of such location configurations, determine the scope of the interface to be exposed by checking whether the address obtained from the location part matches (whether the beginning of the interface address is the address configured in the location).

[0125] a. If the interface belongs to a public domain name, the matching interface is a public interface. The interface that cannot be matched is an interface that cannot be accessed from the outside and can only be accessed from the internal network. The address format of this type of interface is usually http: / / business deployment IP:port / project context / interface address defined by the business system.

[0126] b. If the interface belongs only to an internal network domain, the matching interfaces can be accessed within the internal network, while the unmatched interfaces can only be accessed based on the deployment server of the business.

[0127] Next, the domain name, the address obtained from the location part, and the successfully matched interface address are combined into a complete interface address by using the / . This gives us all the public interfaces and their complete links, and also gives us all the interfaces and their links that cannot be accessed from the public network and can only be accessed from the internal network.

[0128] 10) Summarize and record the domain name of the business project, the deployment file name of the business project, the development language / platform of the project, the complete links of each interface included in the project, the request method of the interface, the class file and package of the interface, and mark each interface as a public network or internal network interface. Based on this information, relevant staff can confirm and supplement information such as the purpose of the interface, the department to which it belongs, and the person in charge in actual work. This is helpful for specific review of the deployment environment of different interfaces and the scope of openness to different networks.

[0129] like Figure 3 The diagram shown is another step flowchart of the zero-load interface security protection method provided in this embodiment of the invention. (Refer to...) Figure 3 As an optional implementation, the zero-load interface security protection method further includes the following steps:

[0130] S201. When the deployment files of a business project are updated, find the interface address and the business project to which the changed domain name belongs based on the domain name change information.

[0131] Specifically, when an interface is added to or removed from a project, a batch of interfaces may also be added or removed. When the project release documentation is updated, information such as the interface's public access scope, request methods, and complete interface link may change. This interface change information can be automatically obtained by following these steps:

[0132] 1) Periodically scan and check the location and configuration information of the domain names, load balancers and other services recorded above. Synchronously identify changes to the domain names and their projects based on changes in DNS configuration, domain name online / offline events, and changes in the update time of business project deployment files. Adjust the correspondence between domain names and business projects as necessary.

[0133] 2) For all changed domain names and projects, repeat steps 4) to 7) above to find the changed interfaces and their respective projects, and record the change time, change content, and the service (project) where the change occurred, including newly launched interfaces, offline interfaces and related domain names;

[0134] 3) Based on the results of the previous step, obtain the latest list of domain names, projects, and interfaces, including interfaces for both internal and external networks.

[0135] The above solution can obtain the interface address without obtaining the original development code, which can avoid cross-departmental coordination and code security issues. It can also solve the problem that the business code does not define the actual deployment domain name and path, which makes it impossible to obtain the complete interface link from the business deployment file or the corresponding source code. Furthermore, it can automatically obtain accurate interface links for both the public and internal networks.

[0136] like Figure 6 The diagram shown is a flowchart of step S105 provided in an embodiment of the present invention. (Refer to...) Figure 6 As an optional implementation, abnormal access is identified based on the complete interface link, and abnormal access behavior is intercepted. Specifically, this includes:

[0137] S1051. Extract the tail content of the complete interface link to obtain the tail interface link;

[0138] S1052. Find the target access log from the external network access log based on the tail interface link. The access link of the target access log includes the tail interface link, but the other parts are different from the complete interface link.

[0139] S1053. Determine the suspiciousness analysis indicators of the target access log based on the access source IP, and determine the IP region, IP range, and IP access frequency of the target access log.

[0140] S1054. Input the suspiciousness analysis indicators, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency into the pre-trained abnormal access identification model to determine whether the target access log is an abnormal access log.

[0141] S1055. Determine the source IP of the abnormal behavior based on the abnormal access log, and determine the risk level of the source IP of the abnormal behavior;

[0142] S1056. Block abnormal access behavior based on the source IP and risk level of the abnormal behavior.

[0143] like Figure 7 The diagram shown is a flowchart of step S1053 provided in an embodiment of the present invention. (Refer to...) Figure 7As an optional implementation, the suspiciousness analysis indicators of the target access log are determined based on the source IP address, and the region, range, and access frequency of the target access log's IP address are determined. Specifically, this includes:

[0144] S10531. Determine the source IP of the target access log, and find suspicious analysis indicators based on the source IP. Suspicious analysis indicators include User-Agent, request size, response size, response status code, access time, actual access link, the backend / underlying business service and IP that the access actually reached, and the project or domain name that was actually accessed.

[0145] S10532. Determine the region and range of the IP based on the source IP, and count the number of times the source IP accesses the IP within a preset time period to obtain the IP access frequency.

[0146] like Figure 8 The diagram shown is a flowchart of step S1055 provided in an embodiment of the present invention. (Refer to...) Figure 8 As an optional implementation, the source IP of the abnormal behavior is determined based on the abnormal access log, and the risk level of the source IP is determined, specifically including:

[0147] S10551. Use the IP address of the abnormal access log as the IP address of the abnormal behavior.

[0148] S10552. Determine the set of interface link addresses and corresponding access parameters found by the source IP of the abnormal behavior, and determine the business parameters, access frequency, access tool characteristics and abnormal behavior type set successfully obtained by the source IP of the abnormal behavior based on the status code and response.

[0149] S10553. Determine the risk level of the source IP of abnormal behavior based on business parameters, access frequency, access tool characteristics, and abnormal behavior type set.

[0150] The following describes the process of identifying and intercepting abnormal access behavior according to an embodiment of the present invention.

[0151] Based on the fact that no interface link or request method errors will occur when the enterprise's business accesses the relevant interfaces (if they do occur, it is a system bug and needs to be eliminated before the project goes live), analyzing the access logs of the corresponding project using the real interface information obtained above is helpful in easily identifying and classifying risky access behaviors, and the results can be used for interface security protection.

[0152] The main steps are as follows:

[0153] 1) First, filter the logs from the business access logs that have access originating from an internal network address. Then, extract the part excluding the domain name from the actual interface address, or the last 2 to 3 parts separated by the ' / ' symbol. Let the result be pu. Search the business access logs for access links that contain pu.

[0154] 2) Check the access links in the found logs where the parts before and after "pu" are different from the corresponding content in the real interface address corresponding to "pu", and check the links and their logs.

[0155] 3) Further group these logs by source IP address to find the User-Agent, request size, response size, response status code, access time, actual accessed link, the actual backend / underlying business service and IP address reached, and the actual accessed project or domain. Use this data to determine if the access source can undoubtedly access the business interface, and further utilize the results to determine if the corresponding access source is suspicious. Sort each group of records by access time.

[0156] 4) Calculate the geographical region and IP range of the access based on the source IP, and calculate the time interval between different access requests from the same IP and the access frequency within a certain period of time based on the access time;

[0157] 5) Based on the detection and protection history of WAF and similar tools, or other identified problem data and normal access logs, select the dataset composed of the contents of the previous two steps as the training set to train the random forest or support vector machine model. Next, use a batch of historical datasets based on these detection and protection tools as the test set to test the trained model. Then, use grid search to find the optimal model and its parameter combination and evaluate the model performance. Select the best one as the model for judging illegal access behavior.

[0158] 6) Use the above model to classify the interface access logs, and further identify the source of interface link scanning and attack behavior and its IP set;

[0159] 7) For each source of abnormal behavior, record the set of interface link addresses that have been found, access parameters, business parameters successfully obtained by each abnormal source based on status codes and responses, corresponding interfaces, number of accesses within a certain period of time, access frequency, characteristics of the access tools used, and set of abnormal behavior types.

[0160] 8) Classify all sources of abnormal behavior and verify them in conjunction with the original access logs of each source. Record the results of each category according to the frequency, severity or impact of the abnormal behavior to facilitate the subsequent implementation of appropriate protective measures.

[0161] 9) Leveraging the characteristic that network requests first pass through the Linux kernel before being passed to the corresponding business system, develop an eBPF program to integrate the above model, supporting remote updates of the model. This program parses HTTP / HTTPS requests in real time, and based on the actual request header information, whether the accessed interface link is a genuine link, and the proportion of genuine links among all access links, it classifies abnormal access behavior using the above model. At the network interface card side of the business service or an appropriate network device side, it analyzes, identifies, and filters abnormal access behavior. This ensures that abnormal requests are detected and intercepted by the operating system kernel before reaching the corresponding interface or the web server with the business signature, effectively terminating the abnormal request directly on the network device. This prevents it from affecting the business system, consuming unnecessary business server resources, and generating unnecessary business access logs. Next, it records the main data of the filtered requests in batches according to time periods, including the source of the exception, related interfaces, access count, request parameters, etc. It can also output these incomplete access log records in the required format.

[0162] The method steps of the embodiments of the present invention have been described above. It can be understood that the embodiments of the present invention realize the automatic discovery of interface information and the automatic identification and interception of abnormal access behavior, thereby improving the security protection capability of the interface and the security of the system. The present invention will be further described below with reference to a specific embodiment.

[0163] Company A, an internet company, spent several months manually collecting and summarizing information on publicly accessible interfaces for its various business operations. Even after two rounds of reporting and refinement, they still encountered problems including incomplete data, missing interface links, data errors and non-standardization, and duplication. The solution presented in this invention can automatically collect information on interfaces for both internal and external networks. It can automatically obtain accurate links and request methods for all publicly accessible interfaces without manual intervention. The resulting data also helps to use interfaces as a basis and object for in-depth resource management and protection. The main implementation steps are as follows:

[0164] 1) Collect and store access logs of various business projects through services such as Apache HTTP Server, Nginx, and k8sIngress using ELK or similar tools;

[0165] 2) Collect the processes and configurations of security services such as DNS, load balancing, reverse proxy, and firewall on various servers in the production environment;

[0166] 3) Analyze the logs of the above-mentioned interface automatic discovery scheme to find the actual accessed domain name, and simultaneously find all the interfaces deployed on the live network and respond to the interface update related events based on the domain name to obtain the interface change information, so as to always obtain an accurate set of information about the interface and its associated project and domain name.

[0167] 4) Generate a report file in .xlsx format containing the public network open interface and related information for relevant personnel to confirm and supplement necessary data;

[0168] 5) Further options include analyzing the access logs of the business project to which the interface belongs based on the obtained interface address, identifying abnormal access behaviors, classifying them, and taking appropriate protective measures accordingly.

[0169] The method steps of the embodiments of the present invention have been described above. It can be recognized that this invention comprehensively utilizes the access logs of business projects and the deployment files of corresponding projects, and uses reflection or symbolic analysis technology to automatically obtain the real interface link dataset and deployment topology of related projects based entirely on memory, including obtaining the latest interface information by responding to interface deployment information change events. This solves the problem of not being able to accurately obtain the full set of public and intranet interfaces and their complete links at any time due to reasons such as incomplete interface addresses contained in the source code, difficulty in including inactive interfaces in the logs, and inaccurate interface addresses caused by abnormal access in massive logs. Analyzing interface access logs based on real interface links helps to distinguish normal access from a large amount of log data, identify and classify abnormal access behaviors, and deal with them accordingly, including directly shielding the impact of abnormal access on real interface data from the network card or network device. Using the discovered accurate interface link dataset and access logs, the actual access volume, abnormal access volume, and access quality of interfaces, modules, microservices, projects, and products are evaluated and determined. At the same time, specific interfaces and corresponding code with different access volume and access quality levels are provided, along with quantitative data on corresponding R&D efficiency and quality. Furthermore, based on the semantics of interface functions, tags reflecting interface characteristics and interface resource utilization at the project level are provided.

[0170] Compared with the prior art, the embodiments of the present invention also have the following advantages:

[0171] 1) High performance and good versatility: This invention does not require users to specify unique information about business systems and their interfaces. It can directly obtain the interface address from the packaged and officially deployed project release file entirely based on memory parsing. It can universally and with high performance parse and extract the interface of any project built using different programming languages, frameworks or development platforms, filling the industry gap of obtaining interface information directly from the project release file without decompressing it.

[0172] 2) Zero load: The tool built using the sampling method of this invention can run on any server that can access the business deployment files, without having to be deployed to the official business server. Moreover, the discovery and protection process of interface information will not affect the running business services, nor will it cause any increase or change in the data of the business access log.

[0173] 3) This invention can accurately identify the links of all interfaces actually deployed on the public network and the internal network, the corresponding implementation methods of the interfaces, the last access information of the interfaces, and the inactive interfaces.

[0174] 4) This invention can identify the hierarchical deployment topology from domain name to business project deployment files;

[0175] 5) This invention supports treating interface links as important resources and deepens the management of business projects and their resources into the management based on interface information, which helps to quickly and accurately discover inactive or rarely accessed interfaces.

[0176] 6) Analyzing business access behavior using real interface addresses helps to quickly and more accurately identify the source of interface scanning and attack behavior, making it easier to classify and protect against abnormal access behavior separately.

[0177] 7) Apart from intercepting abnormal access based on the network card, the solution of the present invention will not have any impact on business files, user operations on business systems, business data and logs during the execution process, nor will it cause any increase in data or files in the specific business system.

[0178] like Figure 9 The diagram shown is a structural schematic of the zero-load interface safety protection device provided in an embodiment of the present invention. (Refer to...) Figure 9 This invention provides a zero-load interface security protection device, comprising:

[0179] The access log reading module is used to read the access logs of business services and divides the access logs into internal network access logs and external network access logs based on the remote access IP field in the access logs and the preset internal network IP address range.

[0180] The access domain name determination module is used to determine the accessed internal network domain name and external network domain name based on the internal network access log and the external network access log;

[0181] The interface address extraction module is used to find the deployment location of business projects in the internal network domain name and the external network domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name based on the business project deployment file;

[0182] The interface complete link assembly module is used to determine the external open scope of the interface address, obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface.

[0183] The abnormal access behavior interception module is used to identify abnormal access based on the complete interface link and to intercept abnormal access behavior.

[0184] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0185] This invention also provides an electronic device, comprising: a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for communication between the processor and the memory. When the program is executed by the processor, it implements the aforementioned zero-load interface security protection method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0186] like Figure 10 The diagram shown is a hardware structure schematic of an electronic device provided in an embodiment of the present invention. (Refer to...) Figure 10 This invention provides an electronic device, comprising:

[0187] The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0188] The memory 1002 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1002 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001 to execute the zero-load interface security protection method of the embodiments of this invention.

[0189] Input / output interface 1003 is used to implement information input and output;

[0190] The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0191] Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004);

[0192] The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0193] like Figure 11 The diagram shown is a structural schematic of the storage medium provided in an embodiment of the present invention. (Refer to...) Figure 11 The present invention also provides a storage medium, which is a computer-readable storage medium for computer-readable storage. The storage medium stores one or more programs 1101, which can be executed by one or more processors to implement the above-mentioned zero-load interface security protection method.

[0194] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0195] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform... Figure 1 The method shown.

[0196] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the aforementioned blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0197] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the aforementioned functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0198] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0199] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0200] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the aforementioned program can be printed, because the aforementioned program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or, if necessary, processing in other suitable ways, and then stored in computer memory.

[0201] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0202] In the foregoing description of this specification, references to terms such as "one embodiment," "another embodiment," or "some embodiments" indicate that a specific feature, structure, material, or characteristic described in connection with an embodiment or example is included in at least one embodiment or example of the present invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0203] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0204] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the above embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. A zero-load interface security protection method, characterized in that, Includes the following steps: Read the access logs of the business service, and divide the internal network access logs and external network access logs according to the remote access IP field in the access logs and the preset internal network IP address range; The accessed intranet domain name and the accessed extranet domain name are determined based on the intranet access log and the extranet access log; Locate the business project deployment locations of the intranet domain name and the extranet domain name, obtain the business project deployment files, and extract the interface addresses of the corresponding domain names based on the business project deployment files; Determine the external access scope of the interface address to obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface. Abnormal access is identified based on the complete link of the interface, and abnormal access behavior is intercepted.

2. The zero-load interface security protection method according to claim 1, characterized in that, The zero-load interface security protection method further includes the following steps: When the deployment files of the business project are updated, the interface address and the business project to which the changed domain name belongs are found based on the domain name change information.

3. The zero-load interface security protection method according to claim 1, characterized in that, The step of identifying abnormal access based on the complete link of the interface and intercepting abnormal access behavior specifically includes: Extract the tail content of the complete link of the interface to obtain the tail interface link; The target access log is located in the external network access log based on the tail interface link. The access link of the target access log contains the tail interface link, but other parts are different from the complete interface link. Based on the source IP address, determine the suspiciousness analysis indicators of the target access log, and determine the region, range, and access frequency of the IP address in the target access log; The suspiciousness analysis indicators, the region to which the IP belongs, the range to which the IP belongs, and the IP access frequency are input into a pre-trained abnormal access identification model to determine whether the target access log is an abnormal access log. The corresponding source IP of the abnormal behavior is determined based on the abnormal access log, and the risk level of the source IP of the abnormal behavior is determined. Abnormal access behavior is blocked based on the IP address from which the abnormal behavior originates and the risk level.

4. The zero-load interface security protection method according to claim 1, characterized in that, The process of finding the deployment location of the business project for the internal and external domain names, obtaining the business project deployment file, and extracting the interface address of the corresponding domain name based on the business project deployment file specifically includes: Determine the service IP and port information of the internal network domain name and the external network domain name; Based on the service IP and the port information, locate the deployment location of the corresponding domain name and obtain the deployment file of the business project; Determine the file type of the business project deployment file, parse the business project deployment file according to the file type, and obtain the interface address.

5. The zero-load interface security protection method according to claim 1, characterized in that, The process of determining the external access scope of the interface address, obtaining the public network open interface and the internal network access interface, and assembling the complete interface link of the public network open interface and the internal network access interface specifically includes: The context-path configuration value is found in the image file based on the starting path of the class file. The first interface address is obtained by concatenating the context-path configuration value with the interface address. The location address of the interface address is obtained through a web server, and the location address is matched with the first interface address. The external open scope of the interface address is determined based on the matching result, thereby obtaining the public network open interface and the internal network access interface. The complete link of the corresponding public network open interface is assembled based on the corresponding domain name, the location address, and the first interface address that is successfully matched; The complete link of the corresponding intranet access interface is obtained by assembling the corresponding domain name, the location address, and the first interface address that failed to match.

6. A zero-load interface security protection method according to claim 3, characterized in that, The step of determining the suspiciousness analysis indicators of the target access log based on the access source IP, and determining the region, range, and access frequency of the IP of the target access log, specifically includes: Determine the source IP of the target access log, and find the suspiciousness analysis indicators based on the source IP. The suspiciousness analysis indicators include the User-Agent, request size, response size, response status code, access time, actual access link, the backend / underlying business service and IP that the access actually reached, and the project or domain name that was actually accessed. The region and range of the IP are determined based on the source IP, and the IP access frequency is obtained by counting the number of times the source IP accesses the IP within a preset time period.

7. A zero-load interface security protection method according to claim 3, characterized in that, The step of determining the corresponding abnormal behavior source IP based on the abnormal access log, and determining the risk level of the abnormal behavior source IP, specifically includes: The IP address from which the abnormal access log was accessed is taken as the IP address from which the abnormal behavior originated. Determine the set of interface link addresses and corresponding access parameters found by the source IP of the abnormal behavior, and determine the business parameters, access frequency, access tool characteristics and abnormal behavior type set successfully obtained by the source IP of the abnormal behavior based on the status code and response; The risk level of the source IP of the abnormal behavior is determined based on the business parameters, the access frequency, the characteristics of the access tool, and the abnormal behavior type set.

8. A zero-load interface safety protection device, characterized in that, include: The access log reading module is used to read the access logs of business services and divide the access logs into internal network access logs and external network access logs based on the remote access IP field in the access logs and the preset internal network IP address range. The access domain name determination module is used to determine the accessed intranet domain name and the accessed extranet domain name based on the intranet access log and the extranet access log; The interface address extraction module is used to find the business project deployment location of the intranet domain name and the extranet domain name, obtain the business project deployment file, and extract the interface address of the corresponding domain name according to the business project deployment file; The interface complete link assembly module is used to determine the external open scope of the interface address, obtain the public network open interface and the internal network access interface, and assemble the complete interface link of the public network open interface and the internal network access interface. The abnormal access behavior interception module is used to identify abnormal access based on the complete link of the interface and to intercept abnormal access behavior.

9. An electronic device, characterized in that, The electronic device includes a memory, a processor, a program stored in the memory and executable on the processor, and a data bus for enabling communication between the processor and the memory. When the program is executed by the processor, it implements the steps of the zero-load interface security protection method as described in any one of claims 1 to 7.

10. A storage medium, said storage medium being a computer-readable storage medium for computer-readable storage, characterized in that, The storage medium stores one or more programs, which can be executed by one or more processors to implement the steps of the zero-load interface security protection method as described in any one of claims 1 to 7.

Images