Malicious BOT identification method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to a malicious BOT recognition method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: receiving a client greeting message sent by a client, and obtaining first equipment information and key information corresponding to the client carried in the client greeting message; based on the key information, generating first JA4 fingerprint information corresponding to the client; and performing malicious BOT identification on the client based on the first JA4 fingerprint information and the first equipment information. By adopting the method, the identification accuracy of the malicious BOT can be improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, computer-readable storage medium and computer program product for identifying a malicious BOT. Background Art

[0002] In the field of network security, BOT (short for Robot) refers to an automated program that accesses Web (short for Internet) sites, APP (Application) applications, and API (Application Programming Interface) interfaces through tool scripts, crawlers, or simulators. Since malicious BOTs are often used to perform automated attacks, such as vulnerability scanning, DDoS (Distributed Denial of Service) attacks, data crawling, false advertising clicks, etc., identifying and blocking malicious BOT traffic is crucial to protecting network security.

[0003] At present, traditional WAF (Web Application Firewall) usually identifies malicious BOTs based on IP (Internet Protocol) addresses, User-Agent request headers, and behavior patterns. However, these identification methods can be easily bypassed by attackers by changing IP addresses, forging User-Agent request headers, and simulating normal user behavior patterns, resulting in low WAF recognition accuracy for malicious BOTs. Therefore, there is an urgent need for a malicious BOT identification method that can improve the recognition accuracy. Summary of the invention

[0004] Based on this, it is necessary to provide a malicious BOT identification method, device, computer equipment, computer-readable storage medium and computer program product that can improve the recognition accuracy of malicious BOTs in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for identifying a malicious BOT, the method comprising:

[0006] Receive a client hello message sent by a client, and obtain first device information and key information corresponding to the client carried in the client hello message;

[0007] Based on the key information, generating first JA4 fingerprint information corresponding to the client;

[0008] Based on the first JA4 fingerprint information and the first device information, malicious BOT is identified on the client.

[0009] In one embodiment, the obtaining key information carried in the client hello message includes:

[0010] Obtain the key fields carried in the client hello message through the OpenSSL library in the OpenResty platform;

[0011] The key information is obtained from the key field through the Nginx module in the OpenResty platform, and the key information is stored in a preset data structure.

[0012] In one embodiment, the identifying malicious BOT on the client based on the first JA4 fingerprint information and the first device information includes:

[0013] In a pre-stored good-intentioned BOT whitelist, determining whether there is second JA4 fingerprint information identical to the first JA4 fingerprint information, and whether the first device information is identical to the second device information; the good-intentioned BOT whitelist includes JA4 fingerprint information and device information corresponding to good-intentioned BOTs, and the second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the good-intentioned BOT whitelist;

[0014] If there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, then the client is determined to be a benign BOT; otherwise, the client is determined to be a malicious BOT.

[0015] In one embodiment, the obtaining the first device information corresponding to the client carried in the client hello message includes:

[0016] Obtaining a user-agent request header field carried in the client hello message;

[0017] The first device information corresponding to the client is obtained from the user agent request header field.

[0018] In one embodiment, the method further comprises:

[0019] In the case where the client is identified as a malicious BOT, the BOT traffic sent by the client is intercepted.

[0020] In one of the embodiments, before obtaining the first device information and key information corresponding to the client carried in the client hello message, the method further includes:

[0021] Obtaining the server domain name carried in the client hello message;

[0022] Determine whether the server domain name belongs to a protection domain name based on a pre-stored protection domain name library;

[0023] In the case where it is determined that the server domain name belongs to a protection domain name, the step of obtaining the first device information and key information corresponding to the client carried in the client hello message is performed.

[0024] In a second aspect, the present application provides a malicious BOT identification device, the device comprising:

[0025] A first acquisition module, configured to receive a client hello message sent by a client, and acquire first device information and key information corresponding to the client carried in the client hello message;

[0026] A generating module, configured to generate first JA4 fingerprint information corresponding to the client based on the key information;

[0027] An identification module is used to identify malicious BOT on the client based on the first JA4 fingerprint information and the first device information.

[0028] In one embodiment, the first acquisition module is specifically used to:

[0029] Obtain the key fields carried in the client hello message through the OpenSSL library in the OpenResty platform;

[0030] The key information is obtained from the key field through the Nginx module in the OpenResty platform, and the key information is stored in a preset data structure.

[0031] In one embodiment, the identification module is specifically used to:

[0032] In a pre-stored good-intentioned BOT whitelist, determining whether there is second JA4 fingerprint information identical to the first JA4 fingerprint information, and whether the first device information is identical to the second device information; the good-intentioned BOT whitelist includes JA4 fingerprint information and device information corresponding to good-intentioned BOTs, and the second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the good-intentioned BOT whitelist;

[0033] If there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, then the client is determined to be a benign BOT; otherwise, the client is determined to be a malicious BOT.

[0034] In one embodiment, the first acquisition module is specifically used to:

[0035] Obtaining a user-agent request header field carried in the client hello message;

[0036] The first device information corresponding to the client is obtained from the user agent request header field.

[0037] In one embodiment, the device further comprises:

[0038] The interception module is used to intercept the BOT traffic sent by the client when the client is identified as a malicious BOT.

[0039] In one embodiment, the device further comprises:

[0040] A second acquisition module, used to acquire the server domain name carried in the client hello message;

[0041] A determination module, used to determine whether the server domain name belongs to a protection domain name based on a pre-stored protection domain name library;

[0042] The processing module is used to trigger the first acquisition module to execute the step of acquiring the first device information and key information corresponding to the client carried in the client hello message when it is determined that the server domain name belongs to the protection domain name.

[0043] In a third aspect, the present application provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any one of the methods described in the first aspect.

[0045] In a fifth aspect, the present application provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any one of the methods in the first aspect.

[0046] The above-mentioned malicious BOT identification method, device, computer equipment, computer-readable storage medium and computer program product. First, the WAF receives the client hello message sent by the client, and obtains the first device information and key information corresponding to the client carried in the client hello message. Then, the WAF generates the first JA4 fingerprint information corresponding to the client based on the key information, and identifies the malicious BOT on the client based on the first JA4 fingerprint information and the first device information. Because in SSL (Secure Sockets Layer, Secure Sockets Layer) / TLS (Transport Layer Security, Transport Layer Security Protocol), the key information carried by different clients in the client hello message is quite different, and these key information are relatively stable. Therefore, the JA4 fingerprint information generated by the WAF based on the key information corresponding to the client is difficult to be tampered with. In this way, compared with the traditional method based on IP address, User-Agent request header and behavior pattern, the WAF can improve the recognition accuracy of malicious BOT based on JA4 fingerprint information. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 is a schematic diagram of an application scenario in an embodiment;

[0049] Figure 2 A schematic diagram of a malicious BOT identification method in one embodiment;

[0050] Figure 3 A flowchart of an example of a method for identifying a malicious BOT in an embodiment;

[0051] Figure 4 A structural block diagram of a malicious BOT identification device in an embodiment;

[0052] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] In the field of network security, BOT refers to an automated program that accesses websites, apps, and API interfaces through tool scripts, crawlers, or simulators without manual operations. Malicious BOTs are often used to perform automated attacks, such as vulnerability scanning, DDoS attacks, data crawling, and false advertising clicks. Therefore, identifying and blocking malicious BOTs is crucial to protecting network security.

[0055] At present, traditional WAF usually identifies malicious BOTs based on IP addresses, User-Agent request headers, and behavior patterns. However, these identification methods can be easily bypassed by attackers by changing IP addresses, forging User-Agent request headers, and simulating normal user behavior patterns, resulting in low WAF recognition accuracy for malicious BOTs. Therefore, a malicious BOT identification method that can improve recognition accuracy is urgently needed.

[0056] The embodiment of the present application provides a malicious BOT identification method, which can be applied to a data security system, and specifically can be applied to a WAF in the data security system. Figure 1 FIG. 1 is a schematic diagram of an application scenario in an embodiment. Figure 1 As shown, the data security system includes a client 110, a WAF 120 and a server 130. The client 110 is connected to the server 130 through the WAF 120. The SSL / TLS handshake message between the client 110 and the server 130 passes through the WAF 120, and the WAF 120 performs malicious BOT identification on the client 110 based on the handshake message. Figure 1 , WAF120 at least includes the OpenResty platform, the Agent configuration synchronization component and the management platform. The OpenResty platform supports the BOT protection function, which is used to identify malicious BOTs on the client 110. The management platform is used to send the user's configuration to the Agent configuration synchronization component, and the Agent configuration synchronization component is used to call the API interface of the OpenResty platform to synchronize the configuration to the OpenResty platform. Among them, the configuration may include protection domain name configuration, HTTPS (HyperText Transfer Protocol Secure) related configuration, SSL / TLS certificate configuration, BOT protection function configuration, etc.

[0057] The malicious BOT identification method provided by this application will be described in detail below in conjunction with specific implementation methods. Figure 2 As shown, the method comprises the following steps:

[0058] Step 201: Receive a client hello message sent by a client, and obtain first device information and key information corresponding to the client carried in the client hello message.

[0059] In one implementation, when WAF receives an HTTPS message sent by a client to a server, it can analyze whether the HTTPS message is a client hello message (ClientHello) for an SSL / TLS handshake between the client and the server. If the HTTPS message is a client hello message, WAF can obtain the first device information and key information corresponding to the client carried in the client hello message.

[0060] Step 202: Generate first JA4 fingerprint information corresponding to the client based on the key information.

[0061] In one implementation, after the WAF obtains the key information carried in the client hello message, it can further generate first JA4 fingerprint information corresponding to the client based on the key information, wherein the JA4 fingerprint information is unique fingerprint information used to identify and classify SSL / TLS connections.

[0062] Step 203: Based on the first JA4 fingerprint information and the first device information, malicious BOT is identified on the client.

[0063] In one embodiment, after the WAF generates the first JA4 fingerprint information corresponding to the client, it can further identify malicious BOTs on the client based on the first JA4 fingerprint information and the first device information. Because in SSL / TLS, the key information carried by different clients in the client hello message is quite different, and this key information is relatively stable. Therefore, the JA4 fingerprint information generated by the WAF based on the key information corresponding to the client is difficult to be tampered with. In this way, compared with the traditional method based on IP address, User-Agent request header and behavior pattern, the WAF can improve the recognition accuracy of malicious BOTs based on JA4 fingerprint information.

[0064] In some embodiments, the process of WAF obtaining key information carried in the client hello message is as follows:

[0065] Step 1: Get the key fields carried in the client hello message through the OpenSSL library in the OpenResty platform.

[0066] In one implementation, WAF can obtain key fields carried in the client hello message through the OpenSSL library in the OpenResty platform. Key fields may include request protocol field, TLS version field, cipher suite field, extension field, etc. Among them, WAF can add the SSL_client_hello_getall_extensions_present() function in the OpenSSL library of the OpenResty platform to obtain all extension fields carried in the client hello message.

[0067] Step 2: Obtain key information from key fields through the Nginx module in the OpenResty platform and store the key information in a preset data structure.

[0068] In one implementation, the WAF may store key information through the ngx_ssl_connection_s structure in the Nginx module of the OpenResty platform, which is used to subsequently generate the client's JA4 fingerprint information. Specifically, the WAF may add a new ngx_SSL_early_cb_fn() function in the Nginx module of the OpenResty platform, and call the SSL_client_hello_getall_extensions_present() function through the above function to store all the extension fields in the client hello message in the ngx_ssl_connection_s structure. The WAF may add a new ngx_SSL_client_features() function in the Nginx module of the OpenResty platform to obtain the signature algorithm information (Signature Algorithms) from the client hello message, and store the signature algorithm information in the ngx_ssl_connection_s structure. WAF can add the ngx_http_ssl_alpn_select() function in the Nginx module of the OpenResty platform to obtain the first and last characters of the first value of the ALPN (Application-Layer Protocol Negotiation) extension field in the client hello message and store it in the ngx_ssl_connection_s structure.

[0069] Accordingly, based on the key information, the WAF generates the first JA4 fingerprint information corresponding to the client in the following process: WAF first calculates the information in the JA4_a part. The JA4_a part consists of six parts: {request protocol}, {TLS version}, {SNI (Server Name Indication), {number of encryption suites}, {number of extension fields}, and {first and last characters of the first value of the ALPN field}. Among them, the value of the request protocol is q (QUIC (Quick UDP Internet Connections) protocol) or t (TCP (Transmission Control Protocol) protocol); the TLS version takes the highest TLS version; the GREASE (Generate Random Extensions And Sustain Extensibility) field should be ignored when counting the number of encryption suites; the GREASE field, SNI and ALPN field should be ignored when counting the number of extension fields, and 00 should be used to fill if there is no ALPN field. Then WAF calculates the JA4_b part. WAF concatenates the encryption suite field values ​​in hexadecimal format with commas "," (ignoring the GREASE value). Then WAF sorts them from small to large (for example, 1303, 1302, c02b, 0035 are sorted from small to large to 0035, 1302, 1303, c02b), encrypts the sorted data with SHA256, and intercepts the first 12 bits of the encrypted string. Then WAF calculates the JA4_c part. WAF concatenates the extension type (Extensions-Type) value in hexadecimal format with commas "," (ignoring the GREASE value, SNI, ALPN), and then WAF sorts them from small to large. Then WAF reads the value of the signature algorithm, also using commas "," as delimiters. Here, the signature algorithm uses the default sorting. WAF then combines the two strings into one, separating them with "_", with the sorted extension type in the front and the unsorted signature algorithm in the back, encrypts the string with SHA256, and extracts the first 12 bits of the encrypted string. WAF concatenates JA4_a, JA4_b, and JA4_c with an underscore "_" to form the final JA4 fingerprint.

[0070] In some embodiments, the WAF performs the following process on the client to identify the malicious BOT based on the first JA4 fingerprint information and the first device information:

[0071] Step 1: Determine whether there is a second JA4 fingerprint information identical to the first JA4 fingerprint information in the pre-stored good-intentioned BOT whitelist, and whether the first device information is identical to the second device information. The good-intentioned BOT whitelist includes the JA4 fingerprint information and device information corresponding to the good-intentioned BOT, and the second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the good-intentioned BOT whitelist.

[0072] In one implementation, a whitelist of good-intentioned BOTs may be pre-stored in the WAF. The whitelist of good-intentioned BOTs includes JA4 fingerprint information and device information corresponding to the good-intentioned BOTs. After the WAF generates the first JA4 fingerprint information corresponding to the client, it may determine whether there is a second JA4 fingerprint information identical to the first JA4 fingerprint information in the whitelist of good-intentioned BOTs. If there is a second JA4 fingerprint information identical to the first JA4 fingerprint information in the whitelist of good-intentioned BOTs, the WAF may further determine whether the first device information is identical to the second device information. The second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the whitelist of good-intentioned BOTs.

[0073] Step 2: If there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, then the client is determined to be a good BOT; otherwise, then the client is determined to be a malicious BOT.

[0074] In one implementation, if there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, the WAF can determine that the client is a benign BOT. Otherwise, the WAF can determine that the client is a malicious BOT.

[0075] In some embodiments, the process of the WAF obtaining the first device information corresponding to the client carried in the client hello message is as follows:

[0076] Step 1: Get the user-agent request header field carried in the client hello message.

[0077] In one implementation, the WAF may obtain a user agent request header field carried in the client hello message, that is, a User-Agent request header field.

[0078] Step 2: Obtain the first device information corresponding to the client from the user agent request header field.

[0079] In one implementation, after the WAF obtains the User-Agent request header field, it can obtain the first device information corresponding to the client from the User-Agent request header field, wherein the first device information may include an operating system, a browser type, a version number, and the like.

[0080] In some embodiments, the client further performs the following steps: when the client is identified as a malicious BOT, intercepting and processing the BOT traffic sent by the client.

[0081] In one implementation, when the client is identified as a malicious BOT, the WAF may intercept and process the BOT traffic sent by the client.

[0082] In some embodiments, before the WAF obtains the first device information and key information corresponding to the client carried in the client hello message, the WAF may further perform the following steps:

[0083] Step 1: Get the server domain name carried in the client hello message.

[0084] In one implementation, after receiving the client hello message sent by the client, the WAF may obtain the server domain name (server_name) carried in the client hello message.

[0085] Step 2: Determine whether the server domain name belongs to the protection domain name based on the pre-stored protection domain name library.

[0086] In one implementation, a protection domain name library may be pre-stored in the WAF. After the WAF obtains the server domain name carried in the client hello message, it may query whether the server domain name carried in the client hello message exists in the pre-stored protection domain name library.

[0087] Step three, when it is determined that the server domain name belongs to the protection domain name, execute the step of obtaining the first device information and key information corresponding to the client carried in the client hello message.

[0088] In one implementation, when it is determined that the server domain name belongs to the protection domain name, the WAF can further obtain the first device information and key information corresponding to the client carried in the client hello message. When it is determined that the server domain name does not belong to the protection domain name, the BOT traffic sent by the client can be intercepted.

[0089] like Figure 3 As shown, the embodiment of the present application provides an example of a malicious BOT identification method, including the following steps:

[0090] Step 301: Receive a client hello message sent by a client.

[0091] Step 302: Obtain the server domain name carried in the client hello message.

[0092] Step 303: Based on the pre-stored protection domain name library, determine whether the server domain name belongs to the protection domain name. If yes, execute step 304. If not, execute step 309.

[0093] Step 304: Acquire the first device information and key information corresponding to the client carried in the client hello message.

[0094] Step 305: Generate first JA4 fingerprint information corresponding to the client based on the key information.

[0095] Step 306: In the pre-stored goodwill BOT whitelist, determine whether there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information. If yes, execute step 307. If no, execute step 309.

[0096] Step 307: In the pre-stored goodwill BOT whitelist, determine whether the first device information is the same as the second device information. If yes, execute step 308. If not, execute step 309.

[0097] Step 308: Release the BOT traffic sent by the client.

[0098] Step 309: intercept and process the BOT traffic sent by the client.

[0099] In the embodiment of the present application, first, the WAF receives a client hello message sent by the client, and obtains the first device information and key information corresponding to the client carried in the client hello message. Then, based on the key information, the WAF generates the first JA4 fingerprint information corresponding to the client, and based on the first JA4 fingerprint information and the first device information, identifies the malicious BOT of the client. Because in SSL (Secure Sockets Layer) / TLS (Transport Layer Security), the key information carried by different clients in the client hello message is quite different, and these key information are relatively stable. Therefore, the JA4 fingerprint information generated by the WAF based on the key information corresponding to the client is difficult to be tampered with. In this way, compared with the traditional method based on IP address, User-Agent request header and behavior pattern, the WAF can improve the recognition accuracy of malicious BOT based on JA4 fingerprint information, thereby improving the reliability of WAF's BOT protection.

[0100] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0101] Based on the same inventive concept, the embodiment of the present application also provides a malicious BOT identification device for implementing the malicious BOT identification method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more malicious BOT identification device embodiments provided below can refer to the limitations of the malicious BOT identification method above, and will not be repeated here.

[0102] In one embodiment, Figure 4 As shown, a malicious BOT identification device is provided, the device includes: a first acquisition module 410, a generation module 420 and an identification module 430; wherein,

[0103] A first acquisition module 410 is configured to receive a client hello message sent by a client, and acquire first device information and key information corresponding to the client carried in the client hello message;

[0104] A generating module 420, configured to generate first JA4 fingerprint information corresponding to the client based on the key information;

[0105] The identification module 430 is used to identify malicious BOT on the client based on the first JA4 fingerprint information and the first device information.

[0106] In one embodiment, the first acquisition module 410 is specifically configured to:

[0107] Obtain the key fields carried in the client hello message through the OpenSSL library in the OpenResty platform;

[0108] The key information is obtained from the key field through the Nginx module in the OpenResty platform, and the key information is stored in a preset data structure.

[0109] In one embodiment, the identification module 430 is specifically used to:

[0110] In a pre-stored good-intentioned BOT whitelist, determining whether there is second JA4 fingerprint information identical to the first JA4 fingerprint information, and whether the first device information is identical to the second device information; the good-intentioned BOT whitelist includes JA4 fingerprint information and device information corresponding to good-intentioned BOTs, and the second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the good-intentioned BOT whitelist;

[0111] If there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, then the client is determined to be a benign BOT; otherwise, the client is determined to be a malicious BOT.

[0112] In one embodiment, the first acquisition module 410 is specifically configured to:

[0113] Obtaining a user-agent request header field carried in the client hello message;

[0114] The first device information corresponding to the client is obtained from the user agent request header field.

[0115] In one embodiment, the device further comprises:

[0116] The interception module is used to intercept the BOT traffic sent by the client when the client is identified as a malicious BOT.

[0117] In one embodiment, the device further comprises:

[0118] A second acquisition module, used to acquire the server domain name carried in the client hello message;

[0119] A determination module, used to determine whether the server domain name belongs to a protection domain name based on a pre-stored protection domain name library;

[0120] The processing module is used to trigger the first acquisition module 410 to execute the step of acquiring the first device information and key information corresponding to the client carried in the client hello message when it is determined that the server domain name belongs to the protection domain name.

[0121] Each module in the above malicious BOT identification device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0122] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, near field communication (NFC) or other technologies. When the computer program is executed by the processor, a malicious BOT identification method is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0123] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0124] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned malicious BOT identification method when executing the computer program.

[0125] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned malicious BOT identification method are implemented.

[0126] In one embodiment, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the steps of the above-mentioned malicious BOT identification method are implemented.

[0127] It should be noted that the user information (including but not limited to user device identification, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0128] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0129] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0130] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for identifying malicious BOT, characterized in that: The method comprises: Receive a client hello message sent by a client, and obtain first device information and key information corresponding to the client carried in the client hello message; Based on the key information, generating first JA4 fingerprint information corresponding to the client; Based on the first JA4 fingerprint information and the first device information, malicious BOT is identified on the client.

2. The method according to claim 1, characterized in that The obtaining of key information carried in the client hello message includes: Obtain the key fields carried in the client hello message through the OpenSSL library in the OpenResty platform; The key information is obtained from the key field through the Nginx module in the OpenResty platform, and the key information is stored in a preset data structure.

3. The method according to claim 1, characterized in that: The identifying malicious BOT on the client based on the first JA4 fingerprint information and the first device information includes: In a pre-stored good-intentioned BOT whitelist, determining whether there is second JA4 fingerprint information identical to the first JA4 fingerprint information, and whether the first device information is identical to the second device information; the good-intentioned BOT whitelist includes JA4 fingerprint information and device information corresponding to good-intentioned BOTs, and the second device information is the device information corresponding to the good-intentioned BOT to which the first JA4 fingerprint information belongs in the good-intentioned BOT whitelist; If there is second JA4 fingerprint information that is the same as the first JA4 fingerprint information, and the first device information is the same as the second device information, then the client is determined to be a benign BOT; otherwise, the client is determined to be a malicious BOT.

4. The method according to claim 1, characterized in that: The acquiring the first device information corresponding to the client carried in the client hello message includes: Obtaining a user-agent request header field carried in the client hello message; The first device information corresponding to the client is obtained from the user agent request header field.

5. The method according to claim 1 or 3, characterized in that: The method further comprises: In the case where the client is identified as a malicious BOT, the BOT traffic sent by the client is intercepted.

6. The method according to claim 1, characterized in that Before obtaining the first device information and key information corresponding to the client carried in the client hello message, the method further includes: Obtaining the server domain name carried in the client hello message; Determine whether the server domain name belongs to a protection domain name based on a pre-stored protection domain name library; In the case where it is determined that the server domain name belongs to a protection domain name, the step of obtaining the first device information and key information corresponding to the client carried in the client hello message is performed.

7. A malicious BOT identification device, characterized in that: The device comprises: A first acquisition module, configured to receive a client hello message sent by a client, and acquire first device information and key information corresponding to the client carried in the client hello message; A generating module, configured to generate first JA4 fingerprint information corresponding to the client based on the key information; An identification module is used to identify malicious BOT on the client based on the first JA4 fingerprint information and the first device information.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images