Protection method and device based on web application, equipment and storage medium

Abstract

The invention provides a protection method, device and equipment based on a web application and a storage medium, the protection method based on the web application acquires service information of the web application, analyzes the service information through a service index analyzer to obtain a service configuration index, calculates a service index and a user-defined index, and performs protection on the basis of a protection rule. The service configuration index, the calculation service index and the self-defined index are subjected to protection analysis to obtain a protection analysis result, the service configuration index and the calculation service index related to the service can be automatically analyzed, and the self-defined index and the protection rule reflecting the self demand can be determined, so that the protection analysis result is more accurate, and the user experience is improved. The method is beneficial for adapting to various different business scenes, executing protection actions according to the protection analysis result, and providing effective protection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a protection method, device, equipment and storage medium based on web applications. Background Art

[0002] In the modern Internet era, web applications have become an important part of people's daily life and work. Web application attack methods are endless, and web has become an urgent and important issue. At present, the general web application firewall has weak protection capabilities for application business logic. For example, in some business scenarios such as: over-issuance of goods, SMS bombing, payment loopholes, etc., it cannot adapt to effective protection in different business scenarios. Summary of the invention

[0003] The embodiments of the present application provide a web application-based protection method, apparatus, device, and storage medium to solve at least one problem existing in the related art. The technical solution is as follows:

[0004] In a first aspect, an embodiment of the present application provides a method for protecting a web application, including:

[0005] Collect business information of web applications;

[0006] Analyze the business information through a business indicator analyzer to obtain business configuration indicators, calculated business indicators and custom indicators;

[0007] Based on the protection rules, protection analysis is performed on the business configuration indicators, calculation business indicators and custom indicators respectively to obtain protection analysis results;

[0008] A protection action is executed according to the protection analysis result.

[0009] In one implementation, the analyzing the business information by a business indicator analyzer to obtain business configuration indicators, calculated business indicators, and custom indicators includes:

[0010] Through a business indicator analyzer, extract the user IP and user session ID from the user information of the business information, extract at least one URL address, URL parameter encoding, URL parameter value from the application information of the business information, and extract the custom indicator of the URL request of the business information based on the custom rules;

[0011] Determine the service configuration indicator according to the user IP, user session ID, URL address, URL parameter encoding, and URL parameter value;

[0012] The business indicator is determined and calculated according to the URL address, the user IP, and the user session ID.

[0013] In one implementation, determining and calculating the business indicator according to the URL address, the user IP, and the user session ID includes:

[0014] Determine the number of first requests for each URL address within a unit time according to the URL address;

[0015] According to the URL address and the user IP, determine a first time interval for requests of the same user IP to the same URL address and a second number of requests of each user IP to all URL addresses per unit time;

[0016] Determine, according to the URL address and the user session ID, a second time interval for requests to the same URL address by the same user session ID and a third number of requests per unit time for all URL addresses by each user session ID;

[0017] The computing service indicator is determined according to the first request number, the first time interval, the second request number, the second time interval, and the third request number.

[0018] In one implementation, the protection analysis result includes a first analysis result and a second analysis result; based on the protection rule, the protection analysis is performed on the business configuration indicator and the custom indicator, and the protection analysis result obtained includes:

[0019] Based on the protection rules, a first protection analysis is performed on the service configuration indicator to determine whether the user IP is in the IP blacklist, whether the user session ID is in the ID blacklist, whether the URL address is an illegal address, whether the URL parameter encoding is an illegal parameter encoding, and whether the URL parameter value is an illegal parameter value, to obtain a first analysis result;

[0020] Based on the protection rule, a second protection analysis is performed on the custom indicator to determine whether the custom indicator meets a specified range, and a second analysis result is obtained.

[0021] In one implementation, performing a protection action according to the protection analysis result includes:

[0022] By means of a protection interceptor, a request corresponding to a first indicator representing “yes” in the first analysis result is intercepted and a warning is sent, and a request corresponding to a second indicator representing “no” in the first analysis result is released;

[0023] When the custom indicator does not meet the specified range, the request corresponding to the custom indicator is intercepted by the protection interceptor and a warning is sent, or when the custom indicator meets the specified range, the request corresponding to the custom indicator is released.

[0024] In one implementation, the protection analysis result includes a third analysis result; based on the protection rule, the protection analysis is performed on the calculation service indicator, and the protection analysis result obtained includes:

[0025] Based on the protection rules, a third protection analysis is performed on the computing business indicators to respectively determine whether the first request times are greater than twice the historical access threshold per unit time, whether the first time intervals are less than the time threshold, whether the second request times are greater than twice the specified value, whether the second time intervals are less than the time threshold, and whether the third request times are greater than twice the specified value to obtain a third analysis result.

[0026] In one implementation, performing a protection action according to the protection analysis result includes:

[0027] Through the protection interceptor, the request corresponding to the third indicator representing "yes" in the third analysis result is intercepted and a warning is sent, and the request corresponding to the fourth indicator representing "no" in the third analysis result is released.

[0028] In a second aspect, an embodiment of the present application provides a protection device based on a web application, including:

[0029] The collection module is used to collect business information of web applications;

[0030] The indicator module is used to analyze the business information through a business indicator analyzer to obtain business configuration indicators, calculation business indicators and custom indicators;

[0031] An analysis module is used to perform protection analysis on the business configuration indicators, calculation business indicators and custom indicators based on protection rules to obtain protection analysis results;

[0032] The protection module is used to execute protection actions according to the protection analysis results.

[0033] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement a method in any one of the above-mentioned embodiments.

[0034] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed, the method in any one of the above-mentioned embodiments is implemented.

[0035] The beneficial effects of the above technical solution include at least:

[0036] By collecting business information of web applications and analyzing the business information through the business indicator analyzer, business configuration indicators, calculated business indicators and custom indicators are obtained. Based on the protection rules, protection analysis is performed on the business configuration indicators, calculated business indicators and custom indicators respectively to obtain protection analysis results. The system can automatically analyze business-related business configuration indicators and calculated business indicators, and can determine custom indicators and protection rules that reflect its own needs, so that the protection analysis results are more accurate, which is conducive to adapting to various business scenarios. According to the protection analysis results, protection actions are executed to provide effective protection.

[0037] The above summary is for illustrative purposes only and is not intended to be limiting in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features of the present application will be readily apparent by reference to the accompanying drawings and the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In the accompanying drawings, unless otherwise specified, the same reference numerals throughout the multiple drawings represent the same or similar parts or elements. These drawings are not necessarily drawn to scale. It should be understood that these drawings only depict some embodiments disclosed in the present application and should not be regarded as limiting the scope of the present application.

[0039] Figure 1 This is a schematic diagram of the steps of a protection method based on a web application according to an embodiment of the present application;

[0040] Figure 2 This is a flowchart of a protection method based on web applications according to an embodiment of the present application;

[0041] Figure 3 A schematic diagram of a robot setting for an alarm according to an embodiment of the present application;

[0042] Figure 4 A schematic diagram of returning abnormal information according to an embodiment of the present application;

[0043] Figure 5 This is a schematic diagram of warning information according to an embodiment of the present application;

[0044] Figure 6 This is a structural block diagram of a protection device based on a web application according to an embodiment of the present application;

[0045] Figure 7 This is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0046] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present application. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0047] Filter: There are two main techniques for web filters, URL filtering and mobile code filtering. URL filtering works by sending the user's web request to a URL filtering server, which checks each request against a database of allowed sites. Allowed requests allow the user to access the site directly, while prohibited requests either send the user a message prohibiting access or redirect the user to another site. The typical use of URL filtering is to ensure that users can only access appropriate sites.

[0048] Reference Figure 1 , a flowchart of a web application-based protection method according to an embodiment of the present application is shown. The web application-based protection method may at least include steps S100-S400:

[0049] S100: Collect business information of web applications.

[0050] S200: Analyze the business information through a business indicator analyzer to obtain business configuration indicators, calculation business indicators and user-defined indicators.

[0051] S300: Based on the protection rules, protection analysis is performed on the business configuration indicators, the calculation business indicators and the user-defined indicators respectively to obtain protection analysis results.

[0052] S400: Execute protection actions according to the protection analysis results.

[0053] The web application-based protection method of the embodiment of the present application can be executed through a firewall (WAF) in a terminal such as a computer, a mobile phone, a tablet, a car terminal, or a cloud server.

[0054] The technical solution of the embodiment of the present application collects business information of web applications, analyzes the business information through a business indicator analyzer, obtains business configuration indicators, calculated business indicators and custom indicators, and based on protection rules, performs protection analysis on the business configuration indicators, calculated business indicators and custom indicators respectively to obtain protection analysis results. It can automatically analyze business-related business configuration indicators and calculated business indicators, and can determine custom indicators and protection rules that reflect its own needs, so that the protection analysis results are more accurate, which is conducive to adapting to various business scenarios. According to the protection analysis results, protection actions are executed to provide effective protection.

[0055] In one implementation, the collector collects business information generated during the operation of the web application based on the Filter technology. The business information may include requests of various web applications, excluding static resources: pictures, JS, CSS formats, HTML static pages, videos, and audios. Optionally, the business information includes but is not limited to user information and application information.

[0056] In one implementation, step S200 includes steps S210-S230:

[0057] S210. Through a business indicator analyzer, extract the user IP and user session ID from the user information of the business information, extract at least one URL address, URL parameter encoding, URL parameter value from the application information of the business information, and extract custom indicators of the URL request of the business information based on custom rules.

[0058] S220: Determine the service configuration indicator according to the user IP, user session ID, URL address, URL parameter code, and URL parameter value.

[0059] In the embodiment of the present application, information in the business information is extracted by a business indicator analyzer, and then converted into application indicators. For example, the user IP and user session ID in the user information of the business information are extracted, at least one URL address, URL parameter encoding, and URL parameter value in the application information of the business information are extracted, and the custom indicator of the URL request of the business information is extracted based on the custom rules.

[0060] Optionally, application indicators and custom indicators are configuration indicators, that is, the indicators can be directly read. Configuration indicators can also include IP whitelist, IP blacklist, ID blacklist, ID whitelist, legal URL address list, legal URL parameter encoding list, legal URL parameter list, a legal list of a certain URL address and a certain message header value such as a specified range, a legal list of a certain cookie value (valid for cookies with fixed values), and a feature list of illegal access. If a request is in the feature list of illegal access, it is considered an illegal request, such as: javascript, alert, system, runtime, sensitive word feature list, etc.

[0061] For example, business information may include:

[0062] 1. User IP

[0063] IPV4: 132.122.*.*

[0064] IPV6:2001:0db8:85a3:0000:0000:8a2e:*:*

[0065] 2. User Session ID

[0066] Get the sessionId in the browser cookie. If the web application (hereinafter referred to as the application) does not use the sessionId, the collector will generate a long-term valid cookie (such as 30 days) with the name: cust_session_id and the value: using the unique identification code UUID, saved in the browser to identify the same browser user;

[0067] 3. User terminal information:

[0068] Read the request header User-Agent information and parse it out:

[0069] Browser type: IE, Chrome, Firefox, Safari, Opera, HttpClient client, Python script;

[0070] Device type: PC, Apple series mobile phones, Huawei series mobile phones, Xiaomi system mobile phones

[0071] Operating system type: WINDOW, Android, Apple.

[0072] Optionally, for example, the application information may include:

[0073] 1. Application URL

[0074] Record the URL addresses of all application requests: such as home / myUrl

[0075] 2. URL parameter encoding

[0076] Collect data by URL and record the parameter codes included in a single URL. For example, if you log in via mobile phone number, password and verification code, the login URL includes three parameters: mobile phone number, password and verification code. These three parameters are identified in the following parameter formats: mobile phone format, email format, ID card format, pure numbers, pure letters, numbers + letters, numbers + letters + special characters, and any characters.

[0077] Number of values: infinite list, fixed list, fixed value. For example:

[0078] Mobile phone number: mobile phone number format, infinite list

[0079] Password: Numbers + letters + special characters, infinite list

[0080] Verification code: numbers + letters, infinite list

[0081] 3. URL parameter values

[0082] Record according to the URL parameter code. If the value is an infinite list, set the maximum number of records for a single code, sample and record the parameter value. The number of records cannot be greater than the maximum number of records. Determine the URL parameter value.

[0083] 4. URL request header encoding

[0084] Collect data by URL and identify the URL request header format: mobile phone format, email format, ID card format, pure numbers, pure letters, numbers + letters, numbers + letters + special characters, any characters, and the number of values: infinite list, fixed list, fixed value.

[0085] User-Agent: This header field provides information about the application or user agent sending the request, and can include information such as the name and version of the browser, the operating system, etc. Any character, infinite list.

[0086] Referer: This header field provides the source URL of the requested page, used to track which page the user linked to the current page from, any character, infinite list.

[0087] Host: The header field specifies the host name and / or port number of the request. Because HTTP is a TCP / IP-based protocol, without the host name and port number, the server cannot know where the request comes from. Relying on Host, numbers + letters + special characters, an infinite list, determines the URL request header encoding.

[0088] Accept: The header field specifies what types of data the client accepts. For example, you can specify that you accept data in formats such as HTML, JSON, XML, numbers + letters + special characters, an infinite list.

[0089] Accept-Language: The header field specifies the client's preferred language, which is used to select the appropriate language version when obtaining content; numbers + letters + special characters, an infinite list.

[0090] Accept-Encoding: The header field specifies the compression encoding method supported by the web application client, such as gzip, deflate, etc. Numbers + letters + special characters, an infinite list.

[0091] Connection: This header field is used to manage HTTP connections, such as setting "keep-alive" to keep the connection active. Numbers + letters + special characters, an infinite list.

[0092] Cache-Control: This header field is used to specify cache mechanism instructions for requests or responses, such as maximum lifetime, whether to use cache, etc. Numbers + letters + special characters, an infinite list.

[0093] Access-Control-Request-Headers: Specifies the actual request headers in the preflight request, which is used in cross-origin resource sharing (CORS) scenarios.

[0094] 5. URL request header value

[0095] The request header determines the value range by the amount of data collected, sets the maximum number of records for a single request header code, and samples the record parameter value. The number of records cannot be greater than the maximum number of records.

[0096] 6. Application cookie encoding

[0097] Collect data according to the entire application and record all cookies of the application. Identification format: mobile phone format, email format, ID card format, pure numbers, pure letters, numbers + letters, numbers + letters + special characters, any characters. Number of values: infinite list, fixed list, fixed value.

[0098] sessionId: The default session ID in the http request. Numbers + letters + special characters, infinite list.

[0099] CUST_SESSOIN_ID: The browser customer ID automatically generated by the security filter to identify the same browser user. Numbers + letters + special characters, an infinite list.

[0100] Apply custom cookies: Use regular expression matching to identify the format and determine the value range based on the amount of data collected.

[0101] 7. Application cookie value

[0102] The cookie value is determined by the amount of data collected. The maximum number of records for a single cookie code is set, and the sampling record parameter value is set. The number of records cannot be greater than the maximum number of records.

[0103] 8. URL returns the result

[0104] Sample the returned results of the URL, set the maximum number of records for a single request, sample the parameter value, and the number of records cannot be greater than the maximum number of records.

[0105] In addition, users can customize rules based on actual needs, such as customizing the request header of the URL request, by matching the regular recognition format, and determining the value by the amount of data collected, such as the URL for ordering products, buy? prodcode=abc&num=10 (prodcode product code, num order quantity). prodcode order quantity indicator definition: address: buy, source: request parameter num, for example, the order quantity can be used as the custom indicator mentioned; or, define whether there is a sensitive mobile phone number in the return result of the page, sensitive mobile phone number indicator definition: address: all, source: return result configure the regular expression of the mobile phone number, result: match returns true, mismatch returns false.

[0106] S230: Determine and calculate the service indicator according to the URL address, the user IP address, and the user session ID.

[0107] Optionally, according to the URL address, determine the first number of requests for each URL address within a unit time; according to the URL address and the user IP, determine the first time interval for the same user IP to request the same URL address and the second number of requests for all URL addresses by each user IP within a unit time; according to the URL address and the user session ID, determine the second time interval for the same user session ID to request the same URL address and the third number of requests for all URL addresses by each user session ID within a unit time. Then, determine and calculate the business indicator based on the first number of requests, the first time interval, the second number of requests, the second time interval and the third number of requests.

[0108] Optionally, in addition to the above indicators, the calculated business indicators may also include the last access time of the URL address, the number of all URL addresses requested by a certain user session ID in a certain time period, the total number of application requests, the similarity of a single URL request (used to compare the distance between two requests, the greater the distance, the less similarity), etc.; URL distance = the number of different letters of the parameters encoded in the same parameter in the request parameter:

[0109] For example: / hom / getInfo?name=chen2024&cardid=440782198506171320

[0110] / hom / getInfo? cardid=440782198506171331&name=chen2024

[0111] URL distance: 2.

[0112] In one implementation, a rule base is set in advance, and the rule base contains protection rules corresponding to various indicators. The rules may be composed of a judgment entity, an indicator (or a method for obtaining an indicator), and an operation.

[0113] like:

[0114] curUrl include list_legal_url

[0115] illustrate:

[0116] curUrl current URL, determine the entity

[0117] include includes operations, operations

[0118] list_legal_url Get the legal request address index of the application

[0119] Indicator calculation:

[0120] Different indicator types support different operations

[0121] List indicators:

[0122] Included in the list

[0123] Match any one in the list

[0124] Match List All

[0125] Incrementing numeric indicators:

[0126] Average over a period of time (for example, a period of time is a specified time)

[0127] Sum up for a period of time

[0128] Maximum in a period of time

[0129] Minimum for a period of time

[0130] Equal to / greater than / less than / greater than or equal to / less than or equal to /

[0131] Constant numeric indicators:

[0132] Average over a period of time

[0133] Sum up for a period of time

[0134] Maximum in a period of time

[0135] Minimum for a period of time

[0136] Equal to / greater than / less than / greater than or equal to / less than or equal to /

[0137] Constant character indicators: equals, contains, matches.

[0138] Optionally, the protection analysis result in step S300 includes a first analysis result, a second analysis result, and a third analysis result; step S300 includes steps S310-S330:

[0139] S310. Based on the protection rules, a first protection analysis is performed on the business configuration indicators to determine whether the user IP is on the IP blacklist, whether the user session ID is on the ID blacklist, whether the URL address is an illegal address, whether the URL parameter encoding is an illegal parameter encoding, and whether the URL parameter value is an illegal parameter value, to obtain a first analysis result.

[0140] Optionally, taking the specified time of 30 minutes and the number threshold of 30 times as an example, based on the protection rules, a first protection analysis is performed on the business configuration indicators to determine whether the user IP is on the IP blacklist (if a user IP is judged to need to be blocked for more than 30 visits within 30 minutes, it is included in the IP blacklist), and whether the user session ID is on the ID blacklist (the construction of the ID blacklist is the same); determine whether the URL address is an illegal address (if it is not in the legal URL address list, it is illegal, the rule expression: curUrl include list_legal_url, description: curUrl current browser accesses the URL, include contains the operator, list_legal_url takes the application legal URL address list, and returns: list), determine whether the URL parameter encoding is an illegal parameter encoding (if it is not in the legal parameter encoding list, it is illegal), and determine whether the URL parameter value is an illegal parameter value (if it is not in the legal parameter value list, it is illegal), and finally obtain the first analysis result. In some embodiments, it may also include abandoning URL access: judging whether the last access time of the currently accessed URL address is less than the current time + 1 month, the rule expression: time_last_access(curUrl) is less than (now() + 1 month), description: curUrl is the current browser accessing UR, time_last_access takes the last access time to access, and returns: the constant number now() current time.

[0141] S320: Based on the protection rule, perform a second protection analysis on the custom indicator to determine whether the custom indicator meets a specified range, and obtain a second analysis result.

[0142] For example, the custom indicator is the quantity of purchased goods, and the specified range is the inventory of goods. It is determined whether the quantity of purchased goods is within the range of the inventory of goods to obtain the second analysis result.

[0143] S330. Based on the protection rules, a third protection analysis is performed on the calculation business indicators to respectively determine whether each first request number is greater than twice the historical access threshold per unit time, whether each first time interval is less than the time threshold, whether each second request number is greater than twice the specified value, whether each second time interval is less than the time threshold, and whether each third request number is greater than twice the specified value to obtain a third analysis result.

[0144] Exemplarily, taking 30 minutes as an example for the unit time and 1 minute as an example for the time threshold; then, based on the protection rules, a third protection analysis is performed on the calculated service metrics to respectively determine whether each first request count is greater than twice the historical access threshold (obtained based on the average value of historical data) within 30 minutes; respectively determine whether each first time interval is less than 1 minute, respectively determine whether each second request count is greater than twice the specified value, respectively determine whether each second time interval is less than 1 minute, respectively determine whether each third request count is greater than twice the specified value, and obtain the third analysis result.

[0145] In some embodiments, it is also possible to detect that a certain user IP frequently accesses a preset number of URL addresses, whether the number of times a single user IP requests these URL addresses within 30 minutes is greater than 100 and the number of requested URLs < 10, or detect that a certain session ID frequently accesses a preset number of URL addresses, whether the number of times a single session ID requests these URL addresses within 30 minutes is greater than 100 and the number of requested URLs < 10; or, detect the brute-force cracking risk of a certain URL, detect that a certain user IP or a certain session ID frequently only accesses a certain URL address, and the difference in the same URL parameters is not significant, such as: using a username to match an ID card, the username remains unchanged, and the ID card keeps changing:

[0146] (1) The number of times a single IP requests a URL within 30 minutes > 100 and the distance between two adjacent requests for this URL by the IP < the average URL distance

[0147] (2) The number of times a session ID requests a URL within 30 minutes > 100 and the distance between two adjacent requests for this URL by the session ID < the average URL distance

[0148] URL distance = the number of different letters of the same parameter encoding in the request parameters

[0149] Such as:

[0150] / hom / getInfo?name=chen2024&cardid=440782198506171320

[0151] / hom / getInfo?cardid=440782198506171331&name=chen2024

[0152] URL distance: 2

[0153] Rule expression:

[0154] count_access_url(curIp / curSid, curUrl, 30 minutes)>100and distance_url(curIp / curSid) <avg(distance_url_history(url))

[0155] illustrate:

[0156] count_access_url The number of times a single IP or single session ID requests a certain URL per unit time. Returns: constant number

[0157] distance_url calculates the distance between two adjacent URLs of IP, returns: constant number

[0158] distance_url_history gets the historical URL distance, returns: list

[0159] avg calculates the average of a list.

[0160] Alternatively, analyze whether the number of times an account (number) requests a certain URL exceeds the limit rule.

[0161] In one implementation, the protection actions in step S400 include interception, release, recording, and blacklisting. Step S400 includes steps S410-S430:

[0162] S410. Through a protection interceptor, a request corresponding to a first indicator representing “yes” in the first analysis result is intercepted and a warning is sent, and a request corresponding to a second indicator representing “no” in the first analysis result is released.

[0163] S420: When the custom indicator does not meet the specified range, the protection interceptor intercepts the request corresponding to the custom indicator and sends a warning; or, when the custom indicator meets the specified range, the request corresponding to the custom indicator is released.

[0164] Optionally, as in the above example, if the quantity of purchased goods is within the range of the goods inventory, the request corresponding to the custom indicator is released, indicating that the purchase is successful, and the text returned in the request includes the characters "order successful". When the custom indicator does not meet the specified range, the request corresponding to the custom indicator is intercepted by the protection interceptor and a warning is sent, indicating that the inventory is insufficient.

[0165] S430. Through the protection interceptor, the request corresponding to the third indicator representing "yes" in the third analysis result is intercepted and a warning is sent, and the request corresponding to the fourth indicator representing "no" in the third analysis result is released.

[0166] Optionally, the interception can be recorded and added to the corresponding blacklist at the same time, and the results of interception and release will be returned to the client; among them, there may be problems with the request during recording, the request information will be recorded, and a warning will be issued, but the request will be transferred to the application for processing and the result will be returned to the user.

[0167] like Figure 2 As shown, the following is a specific example to illustrate the deployment of collectors and protection interceptors on the application side:

[0168] The collection and protection interceptor intercepts all dynamic requests of the application and is implemented in the application as follows:

[0169] Collector: com.myfilter.CollectFiler

[0170] Protection interceptor: com.myfilter.ProtectFiler

[0171] Configure collectors and protection interceptors in web.xml applications

[0172] Collector:

[0173]

[0174]

[0175] Protection Interceptor:

[0176]

[0177] Configure collector and protection interceptor in springboot project

[0178] Collector:

[0179]

[0180] Protection Interceptor:

[0181]

[0182] After deploying the collector, collect business information of the application for a period of time (one week). Table 1 User session ID information

[0183]

[0184] Table 2 IP blacklist

[0185] serial number IP time 1 132.122.1.10 2024 / 8 / 20 15:46:30 2 132.122.1.11 2024 / 8 / 20 15:46:30 3 132.122.1.12 2024 / 8 / 20 15:46:30

[0186] Table 3 All URL information

[0187]

[0188] Table 4 URL parameter information

[0189]

[0190]

[0191] Table 5 URL parameter value information (sample record)

[0192]

[0193] Application running statistics are recorded according to the specified time statistics (currently 10 minutes).

[0194] Table 6 URL access times

[0195]

[0196]

[0197] Table 7 IP access times

[0198]

[0199]

[0200] Table 8 Session ID access times

[0201]

[0202] Table 9 Number of times IP accesses URL

[0203]

[0204]

[0205] Table 10 Number of times a session ID accesses a URL

[0206]

[0207] like Figure 2As shown, then, based on the business information, corresponding indicators such as business configuration indicators, calculated business indicators and custom indicators are generated, and an indicator database can be formed. The protection rules are configured, including protection targets and actions such as IP blacklists, illegal URL address lists, and subsequent protection actions such as interception, recording, release, and blacklisting based on the protection rules to form a rule base (rule database). Finally, when entering the actual protection, the preliminary interception is analyzed, the corresponding rules in the rule base are taken out, and all relevant rules are calculated and calculated directly. All relevant rules are determined to be satisfied, and whether the protection action is released (released). If it is not released, it is the final interception. At this time, the alarm, release and alarm will eventually return the result to the web application.

[0208] Among them, Figure 3 As shown, you can configure the DingTalk webhook robot to send an alert notification. If the current user IP (132.122.1.98) is in the IP blacklist, when accessing the application, an exception message can be returned, such as Figure 4 , and the warning notification of the operation manager can receive warning information such as Figure 5 As shown, the access principles of other illegal URL address lists are similar and will not be repeated here.

[0209] The method of the embodiment of the present application collects business information about the operation of the application, performs screening and analysis, generates corresponding indicators, and can formulate protection rules based on actual needs. It detects system risks through automatic calculation of indicators and protection rules, thereby more accurately detecting risks and more secure protection.

[0210] Reference Figure 6 , shows a structural block diagram of a protection device based on a web application according to an embodiment of the present application, and the device may include:

[0211] The collection module is used to collect business information of web applications;

[0212] The indicator module is used to analyze business information through the business indicator analyzer to obtain business configuration indicators, calculated business indicators and custom indicators;

[0213] The analysis module is used to perform protection analysis on business configuration indicators, calculation business indicators and custom indicators based on protection rules to obtain protection analysis results;

[0214] The protection module is used to execute protection actions according to the protection analysis results.

[0215] The functions of each module in each device in the embodiments of the present application can be found in the corresponding description in the above method, and will not be repeated here.

[0216] Reference Figure 7, shows a structural block diagram of an electronic device according to an embodiment of the present application, the electronic device includes: a memory 310 and a processor 320, the memory 310 stores instructions that can be run on the processor 320, and the processor 320 loads and executes the instructions to implement the web application-based protection method in the above embodiment. The number of the memory 310 and the processor 320 can be one or more.

[0217] In one embodiment, the electronic device also includes a communication interface 330 for communicating with external devices and performing data exchange transmission. If the memory 310, the processor 320 and the communication interface 330 are implemented independently, the memory 310, the processor 320 and the communication interface 330 can be interconnected through a bus and complete mutual communication. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0218] Optionally, in a specific implementation, if the memory 310, the processor 320 and the communication interface 330 are integrated on a chip, the memory 310, the processor 320 and the communication interface 330 can communicate with each other through an internal interface.

[0219] An embodiment of the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the web application-based protection method provided in the above embodiment.

[0220] An embodiment of the present application also provides a chip, which includes a processor for calling and executing instructions stored in the memory from the memory, so that a communication device equipped with the chip executes the method provided by the embodiment of the present application.

[0221] An embodiment of the present application also provides a chip, including: an input interface, an output interface, a processor and a memory, wherein the input interface, the output interface, the processor and the memory are connected via an internal connection path, and the processor is used to execute the code in the memory. When the code is executed, the processor is used to execute the method provided in the embodiment of the application.

[0222] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. It is worth noting that the processor may be a processor supporting the advanced RISC machines (ARM) architecture.

[0223] Further, optionally, the above-mentioned memory may include a read-only memory and a random access memory, and may also include a non-volatile random access memory. The memory may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may include a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may include a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available. For example, static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct rambus RAM (DR RAM).

[0224] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function according to the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0225] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. Moreover, the described specific features, structures, materials or characteristics may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine different embodiments or examples described in this specification and the features of different embodiments or examples, unless they are contradictory.

[0226] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0227] Any process or method description in the flow chart or otherwise described herein can be understood to represent a module, fragment or portion of a code including one or more executable instructions for implementing the steps of a specific logical function or process. And the scope of the preferred embodiment of the present application includes other implementations, in which the functions may not be performed in the order shown or discussed, including in a substantially simultaneous manner or in a reverse order according to the functions involved.

[0228] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, which can be embodied in any computer-readable medium for use by an instruction execution system, apparatus or device (such as a computer-based system, a system including a processor or other system that can fetch instructions from an instruction execution system, apparatus or device and execute instructions), or used in combination with these instruction execution systems, apparatuses or devices.

[0229] It should be understood that the various parts of the present application can be implemented with hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented with software or firmware stored in a memory and executed by a suitable instruction execution system. All or part of the steps of the above embodiment method can be completed by instructing the relevant hardware through a program, which can be stored in a computer-readable storage medium, and when the program is executed, it includes one of the steps of the method embodiment or a combination thereof.

[0230] In addition, each functional unit in each embodiment of the present application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the above-mentioned integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a disk or an optical disk, etc.

[0231] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A protection method based on web applications, characterized in that: include: Collect business information of web applications; Analyze the business information through a business indicator analyzer to obtain business configuration indicators, calculated business indicators and custom indicators; Based on the protection rules, protection analysis is performed on the business configuration indicators, calculation business indicators and custom indicators respectively to obtain protection analysis results; A protection action is executed according to the protection analysis result.

2. The web application-based protection method according to claim 1, characterized in that: The business information is analyzed by a business indicator analyzer to obtain business configuration indicators, calculated business indicators and custom indicators, including: Through a business indicator analyzer, extract the user IP and user session ID from the user information of the business information, extract at least one URL address, URL parameter encoding, URL parameter value from the application information of the business information, and extract the custom indicator of the URL request of the business information based on the custom rules; Determine the service configuration indicator according to the user IP, user session ID, URL address, URL parameter encoding, and URL parameter value; The business indicator is determined and calculated according to the URL address, the user IP, and the user session ID.

3. The web application-based protection method according to claim 2, characterized in that: The determining and calculating the business indicator according to the URL address, the user IP, and the user session ID includes: Determine the number of first requests for each URL address within a unit time according to the URL address; According to the URL address and the user IP, determine a first time interval for requesting the same URL address by the same user IP and a second number of requests per unit time for all URL addresses by each user IP; Determine, according to the URL address and the user session ID, a second time interval for requests to the same URL address by the same user session ID and a third number of requests per unit time for all URL addresses by each user session ID; The computing service indicator is determined according to the first request number, the first time interval, the second request number, the second time interval, and the third request number.

4. The web application-based protection method according to claim 2, characterized in that: The protection analysis result includes a first analysis result and a second analysis result; Based on the protection rules, a protection analysis is performed on the business configuration indicators and the custom indicators, and the protection analysis results include: Based on the protection rules, a first protection analysis is performed on the service configuration indicator to determine whether the user IP is in the IP blacklist, whether the user session ID is in the ID blacklist, whether the URL address is an illegal address, whether the URL parameter encoding is an illegal parameter encoding, and whether the URL parameter value is an illegal parameter value, to obtain a first analysis result; Based on the protection rule, a second protection analysis is performed on the custom indicator to determine whether the custom indicator meets a specified range, and a second analysis result is obtained.

5. The web application-based protection method according to claim 4, characterized in that: The performing of a protection action according to the protection analysis result includes: By means of a protection interceptor, a request corresponding to a first indicator representing "yes" in the first analysis result is intercepted and a warning is sent, and a request corresponding to a second indicator representing "no" in the first analysis result is released; When the custom indicator does not meet the specified range, the request corresponding to the custom indicator is intercepted by the protection interceptor and a warning is sent, or when the custom indicator meets the specified range, the request corresponding to the custom indicator is released.

6. The web application-based protection method according to claim 3, characterized in that: The protection analysis result includes a third analysis result; based on the protection rule, the protection analysis is performed on the calculation business indicator, and the protection analysis result obtained includes: Based on the protection rules, a third protection analysis is performed on the computing business indicators to respectively determine whether the first request times are greater than twice the historical access threshold per unit time, whether the first time intervals are less than the time threshold, whether the second request times are greater than twice the specified value, whether the second time intervals are less than the time threshold, and whether the third request times are greater than twice the specified value to obtain a third analysis result.

7. The web application-based protection method according to claim 6, characterized in that: The performing of a protection action according to the protection analysis result includes: Through the protection interceptor, the request corresponding to the third indicator representing "yes" in the third analysis result is intercepted and a warning is sent, and the request corresponding to the fourth indicator representing "no" in the third analysis result is released.

8. A protection device based on web application, characterized in that: include: The collection module is used to collect business information of web applications; The indicator module is used to analyze the business information through a business indicator analyzer to obtain business configuration indicators, calculation business indicators and custom indicators; An analysis module, used to perform protection analysis on the business configuration indicators, calculation business indicators and custom indicators respectively based on the protection rules to obtain protection analysis results; The protection module is used to execute protection actions according to the protection analysis results.

9. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

Images