Interface security protection method and device, storage medium and terminal
By determining the trusted parameter baseline based on the API's historical traffic behavior log and verifying the current access operation, the problem of API security risks is solved, and the accurate capture and processing of risk access is achieved, and the defense performance is improved.
Patent Information
- Application Number
- CN202411731018.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-28
- Publication Date
- 2025-02-28
AI Technical Summary
Existing APIs have security risks and are easily targeted by hackers, which may lead to user privacy leakage or affect the normal operation of critical services.
The trusted parameter baseline is determined based on the historical traffic behavior log of the target interface, and the current parameter information is obtained when monitoring the access operation, and compared it with the trusted parameter baseline, and preset processing is performed based on the results to intercept the risk access operation.
It realizes accurate capture and timely processing of risk access operations, maintains the interface's operating environment, and improves the attack defense performance of the interface.
Smart Images
Figure CN119544339A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to an interface security protection method, device, storage medium, and terminal. Background Art
[0002] In recent years, with the rapid development of Internet technology and the widespread promotion of enterprise applications, more and more application programming interfaces (APIs) have been used by developers and organizations in various scenarios to meet different needs. The existence of APIs allows applications to call each other's functional modules and data resources to achieve rapid iteration and innovation of functions. However, due to omissions in API design and implementation and some configuration issues, APIs are one of the common targets of hacker attacks, which may even leak user privacy or affect the normal operation of key services in serious cases. Summary of the invention
[0003] The embodiments of this specification provide an interface security protection method, device, storage medium and terminal, which can solve the technical problem of security risks in interfaces in related technologies.
[0004] In a first aspect, an embodiment of the present specification provides an interface security protection method, the method comprising:
[0005] Determine the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface;
[0006] When an access operation to the target interface is detected, current parameter information of the target interface is obtained;
[0007] The trusted parameter baseline is compared with the current parameter information to obtain a parameter filtering result, and the access operation is preset according to the parameter filtering result.
[0008] In a possible implementation, the above-mentioned trusted parameter baseline includes at least one of a trusted input parameter baseline and a trusted output parameter baseline; the above-mentioned obtaining of the current parameter information of the above-mentioned target interface includes: when the above-mentioned trusted parameter baseline includes the above-mentioned trusted input parameter baseline, obtaining the current input parameter information of the above-mentioned target interface; when the above-mentioned trusted parameter baseline includes the above-mentioned trusted output parameter baseline, obtaining the current output parameter information of the above-mentioned target interface.
[0009] In a possible implementation, the above-mentioned determination of the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface includes: collecting the historical traffic behavior log of the target interface, and parsing the historical traffic behavior log to obtain the historical parameter information of the target interface; and constructing the trusted parameter baseline corresponding to the target interface based on the historical parameter information.
[0010] In a possible implementation, the above-mentioned construction of a trusted parameter baseline corresponding to the above-mentioned target interface based on the above-mentioned historical parameter information includes: constructing at least one candidate parameter baseline corresponding to the above-mentioned target interface based on the above-mentioned historical parameter information, the above-mentioned candidate input parameter baseline being one of a parameter value baseline, a parameter type baseline, and a parameter quantity baseline; using each candidate parameter baseline to perform filtering accuracy verification on sample access data of the above-mentioned target interface, and determining that the candidate parameter baseline whose filtering accuracy meets the preset accuracy condition is a trusted parameter baseline.
[0011] In a possible implementation, the above-mentioned collection of historical traffic behavior logs of the target interface includes: determining a preset time window corresponding to a trusted parameter baseline based on a secure access time period of the target interface, and collecting the historical traffic behavior logs of the above-mentioned target interface within the above-mentioned preset time window.
[0012] In a possible implementation, the access operation is preset according to the parameter filtering result, including: if the access operation is a risky access operation, the risky access operation is intercepted; if the access operation is a safe access operation, the safe access operation is responded to normally.
[0013] In a second aspect, an embodiment of the present specification provides an interface security protection device, the device comprising:
[0014] A baseline acquisition module, used to determine a trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface;
[0015] An access monitoring module, used to obtain current parameter information of the target interface when an access operation to the target interface is detected;
[0016] The security verification module is used to compare the above-mentioned trusted parameter baseline with the above-mentioned current parameter information to obtain a parameter filtering result, and perform preset processing on the above-mentioned access operation according to the above-mentioned parameter filtering result.
[0017] In a third aspect, an embodiment of the present specification provides a computer program product comprising instructions, which, when executed on a computer or a processor, enables the computer or the processor to execute the steps of the above method.
[0018] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the above method.
[0019] In a fifth aspect, an embodiment of the present specification provides a terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is suitable for being loaded by the processor and executing the steps of the above method.
[0020] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:
[0021] The embodiment of this specification provides an interface security protection method, which determines the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface; when the access operation to the target interface is monitored, the current parameter information of the target interface is obtained; the trusted parameter baseline is compared with the current parameter information to obtain the parameter filtering result, and the access operation is preset according to the parameter filtering result. Since most of the accesses to the target interface by users in the system are reliable and secure accesses, the trusted parameter baseline of the input and / or output parameters of the interface that meet the expectations under normal circumstances can be determined according to the historical behavior log of the target interface; then when a new access operation occurs on the target interface, the parameter information of this access operation can be verified according to the trusted parameter baseline, and whether the parameter information belongs to the trusted parameter baseline and meets the expectations also indicates whether this access is a normal access, and further, the access is processed accordingly according to the risk level of this access, so as to accurately capture the risk access operation, timely and quickly process the risk access, maintain the operating environment of the target interface, and improve the attack defense performance against the interface. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.
[0023] Figure 1 An exemplary system architecture diagram of an interface security protection method provided in an embodiment of this specification;
[0024] Figure 2 A flowchart of an interface security protection method provided in an embodiment of this specification;
[0025] Figure 3 A flowchart of an interface security protection method provided in an embodiment of this specification;
[0026] Figure 4 A flow chart of strategy generation of an interface security protection method provided in an embodiment of this specification;
[0027] Figure 5 A structural block diagram of an interface security protection device provided in an embodiment of this specification;
[0028] Figure 6 A schematic diagram of the structure of a terminal provided in an embodiment of this specification. DETAILED DESCRIPTION
[0029] In order to make the features and advantages of the embodiments of this specification more obvious and easy to understand, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the embodiments of this specification.
[0030] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of this specification. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of this specification as detailed in the appended claims. And in the description of the embodiments of this specification, unless otherwise indicated, " / " means or, for example, A / B can mean A or B: "and / or" in the text is only a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of this specification, "multiple" refers to two or more than two.
[0031] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features.
[0032] In recent years, with the rapid development of Internet technology and the widespread popularity of enterprise applications, developers from all walks of life have used the powerful tool of Application Programming Interface (API) to seamlessly integrate their services and functions into a variety of application scenarios, so as to flexibly and efficiently meet the increasingly complex and changing needs of users. As a bridge for communication between software systems, the core function of API is to achieve mutual access and information exchange between different systems. As a sharing door for functional modules and data resources between applications, it enables developers to easily call required functions between different platforms, greatly promoting the rapid iteration and technological innovation of applications. For example, a social application can share location by calling the map API, while an e-commerce platform can provide users with a smooth online shopping experience with the help of the payment API.
[0033] However, while APIs bring many conveniences, their security issues are becoming increasingly prominent, and they have become one of the key targets of hacker attacks. For example, a common interface attack method is a database collision attack, which is a network attack that uses an automatic mechanism. Since people often reuse the same password for multiple accounts, the success rate of such attacks is very high. After attackers find a set of valid credentials, they may use these credentials to illegally access other websites and interfaces, or sell verified credentials to other criminals for data theft, account takeover (ATO), and other fraudulent activities. Database collision attacks have no rules, so they are not easy to identify and prevent, and they are also very difficult to intercept. Once an API is attacked, it may not only lead to the leakage of user privacy, but also have a serious impact on the normal operation of key services, and even cause systemic security risks.
[0034] Therefore, the embodiments of the present specification provide an interface security protection method, which can determine the trusted parameter baseline of the interface that meets the expected input parameters and / or output parameters under normal circumstances based on the historical behavior log of the target interface; then when a new access operation occurs on the target interface, the parameter information of this access operation can be verified according to the trusted parameter baseline, and whether the parameter information is in line with expectations in the trusted parameter baseline indicates whether this access is a normal access, and further, the access is processed accordingly based on the risk level of this access to solve the technical problem of security risks in the above-mentioned interface.
[0035] See also Figure 1 , Figure 1 An exemplary system architecture diagram of an interface security protection method provided in an embodiment of this specification.
[0036] like Figure 1As shown, the system architecture may include a terminal 101, a network 102, and a server 103. The network 102 is used to provide a medium for a communication link between the terminal 101 and the server 103. The network 102 may include various types of wired communication links or wireless communication links, for example, the wired communication link includes an optical fiber, a twisted pair, or a coaxial cable, and the wireless communication link includes a Bluetooth communication link, a Wireless-Fidelity (Wi-Fi) communication link, or a microwave communication link.
[0037] The terminal 101 can interact with the server 103 through the network 102 to receive messages from the server 103 or send messages to the server 103, or the terminal 101 can interact with the server 103 through the network 102 to receive messages or data sent by other users to the server 103. The terminal 101 can be hardware or software. When the terminal 101 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 101 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.
[0038] In the embodiments of the present specification, first, the terminal 101 determines the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface; when the terminal 101 detects an access operation to the target interface, the current parameter information of the target interface is obtained; finally, the terminal 101 compares the trusted parameter baseline with the current parameter information to obtain a parameter filtering result, and performs preset processing on the access operation according to the parameter filtering result.
[0039] The server 103 may be a business server that provides various services. It should be noted that the server 103 may be hardware or software. When the server 103 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 103 is software, it may be implemented as multiple software or software modules (for example, for providing distributed services), or it may be implemented as a single software or software module, which is not specifically limited here.
[0040] Alternatively, the system architecture may not include the server 103. In other words, the server 103 may be an optional device in the embodiments of this specification. That is, the method provided in the embodiments of this specification may be applied to a system structure that only includes the terminal 101, and the embodiments of this specification do not limit this.
[0041] It should be understood that Figure 1The number of terminals, networks and servers in the figure is only for illustration and any number of terminals, networks and servers may be used according to implementation requirements.
[0042] See also Figure 2 , Figure 2 A flowchart of an interface security protection method provided for an embodiment of this specification. The execution subject of the embodiment of this specification can be a terminal that executes interface security protection, or a processor in the terminal that executes the interface security protection method, or an interface security protection service in the terminal that executes the interface security protection method. For the convenience of description, the specific execution process of the interface security protection method is introduced below by taking the execution subject being the processor in the terminal as an example.
[0043] like Figure 2 As shown, the interface security protection method may at least include:
[0044] S202: Determine a trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface.
[0045] Optionally, in order to effectively supervise the user's access operations to the interface, a series of strict security control measures and verification mechanisms are usually adopted. These measures may include but are not limited to user identity authentication, authority management, data encryption transmission, and real-time monitoring and analysis of access logs. Through these means, all users in the system can access the target interface after security verification and normal behavior, so that most of the access to the target interface can be determined to be reliable and secure access. In other words, the historical traffic behavior log of the target interface can explain the normal access operations performed by the user on the target interface in the past, so a large amount of reliable access operation information can be obtained from the historical traffic behavior log.
[0046] Optionally, among these reliable access operation information, information such as user identification and access operation timestamp is real-time information, which will change with the user and time of the operation, while information such as parameter type, parameter value, and total amount of parameters within a period of time are relatively fixed information because the interface is always used to implement a fixed function. Therefore, based on these parameter-related information in the historical traffic behavior log of the target interface, the trusted parameter baseline of the target interface can be determined, which is used to verify the parameter information in the access operation corresponding to the target interface.
[0047] Specifically, the historical traffic behavior log of the target interface includes the input parameters (i.e., the request parameters sent by the user to the interface) and the output parameters (i.e., the response data returned by the interface to the user) for each access. These historical data constitute a comprehensive and detailed portrait of the interface behavior. On this basis, through in-depth mining and analysis of these historical data, the specific behavior patterns of the interface under normal circumstances can be further identified, including but not limited to: which input parameter combinations are common, which output parameter formats are standard, and the response speed of the interface under different time periods or different loads, etc. These statistical data can build an effective and trusted baseline for the target interface.
[0048] It should be noted that the target interface can be an interface that needs risk identification determined from all interfaces, such as a payment interface, an information call interface, etc. For some interfaces with routine functions, baseline construction and risk mining may not be performed.
[0049] S204: When an access operation to a target interface is detected, current parameter information of the target interface is obtained.
[0050] Optionally, for the target interface, the access operation of the target interface is monitored in the embodiments of this specification to timely capture all access operations occurring to the target interface. When a new access request arrives at the target interface, the current parameter information of the target interface is immediately obtained, and the input parameters in the request or the response output parameters of the interface are promptly checked to see if there is a significant deviation from the expected input parameter and output parameter baseline, thereby achieving real-time monitoring and dynamic adjustment of the target interface access and ensuring the security and stability of the interface.
[0051] Optionally, for an interface, both the input parameters in an access request and the output parameters after its own response can be used to construct a trusted baseline, that is, the trusted parameter baseline includes at least one of the trusted input parameter baseline and the trusted output parameter baseline. Then in the verification scenario, when the trusted parameter baseline includes a trusted input parameter baseline, it is necessary to obtain the current input parameter information of the target interface during the access operation, so that the current input parameter information can be verified through the trusted input parameter baseline later; and when the trusted parameter baseline includes a trusted output parameter baseline, it is necessary to obtain the current output parameter information of the target interface, so that the current output parameter information can be verified through the trusted output parameter baseline later.
[0052] S206: Compare the trusted parameter baseline with the current parameter information to obtain a parameter filtering result, and perform preset processing on the access operation according to the parameter filtering result.
[0053] Optionally, the trusted parameter baseline is compared with the current parameter information to obtain a parameter filtering result. The parameter filtering result can illustrate the similarities and differences between the trusted parameter baseline and the current parameter information. Then, the degree of conformity between the current parameter information and the trusted parameter baseline in the parameter filtering result can be used to illustrate whether the access operation is a risky access operation or a safe access operation. Further, according to the final risk verification result of the access operation, corresponding and appropriate preset processing can be performed. Among them, the preset processing is different under different parameter filtering results. The preset processing is used to prevent the risky access operation from causing illegal access and operation to the target interface, and to enable the safe access operation to obtain a normal response from the target interface. The specific content of the preset processing is not limited in the embodiments of this specification.
[0054] In an embodiment of the present specification, an interface security protection method is provided, which determines the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface; when an access operation to the target interface is monitored, the current parameter information of the target interface is obtained; the trusted parameter baseline is compared with the current parameter information to obtain a parameter filtering result, and the access operation is preset according to the parameter filtering result. Since most of the accesses to the target interface by users in the system are reliable and secure accesses, the trusted parameter baseline of the input and / or output parameters of the interface that meet the expectations under normal circumstances can be determined according to the historical behavior log of the target interface; then when a new access operation occurs on the target interface, the parameter information of this access operation can be verified according to the trusted parameter baseline, and whether the parameter information belongs to the trusted parameter baseline and meets the expectations also indicates whether this access is a normal access, and further, the access is processed accordingly according to the risk level of this access, thereby accurately capturing the risk access operation, processing the risk access in a timely and rapid manner, maintaining the operating environment of the target interface, and improving the attack defense performance against the interface.
[0055] See also Figure 3 , Figure 3 A flowchart of an interface security protection method provided in an embodiment of this specification.
[0056] like Figure 3 As shown, the interface security protection method may at least include:
[0057] S302: Collect historical traffic behavior logs of the target interface, and parse the historical traffic behavior logs to obtain historical parameter information of the target interface.
[0058] Optionally, see Figure 4 , Figure 4 This is a flow chart of a strategy generation method for an interface security protection method provided in an embodiment of this specification. Figure 4As shown in the figure, under normal circumstances, the user initiates an access request to the target interface, and the access request includes specific input parameters. After the access request reaches the target interface, it will be responded to by the target interface, and then the target interface will generate and return the corresponding output parameters to the user end. The exchange of these parameters will be recorded and stored in the traffic behavior log. In order to build a trusted parameter baseline, it is necessary to parse the historical traffic behavior log to obtain the historical parameter information corresponding to the target interface.
[0059] In a possible embodiment, as the target interface is used for a longer time, the timeline of the full historical traffic behavior log may reach several years, during which the target interface may undergo several iterations, and its input and output parameters may also change accordingly. Therefore, for the access operation that needs to be verified, the traffic behavior logs in the recent period will be more valuable for reference than the data from several years or months ago. If a trusted parameter baseline is constructed based on all historical traffic behavior logs, it is easy to make the final baseline unreliable and consume a lot of computing resources.
[0060] Furthermore, the preset time window corresponding to the trusted parameter baseline can be determined based on the secure access time period of the target interface, and the historical traffic behavior logs of the target interface within the preset time window can be collected, and the historical parameter information of the target interface can be obtained through this part of the historical traffic behavior logs. The secure access time period can be obtained by technical personnel through statistics and research, such as 30 days, 60 days, etc. This can save computing resources while obtaining reliable historical email data.
[0061] S304: Construct a trusted parameter baseline corresponding to the target interface based on the historical parameter information.
[0062] Optionally, see Figure 4 When building a trusted input parameter baseline and a trusted output parameter baseline, it is necessary to parse both the input and output parameters (specifically parse parameter types, parameter values, etc.) through the interface asset profile in the linkage system, and then calculate parameter statistical indicators, including but not limited to: which parameter types are legal, which parameter types are illegal, which input parameter combinations are common, which output parameter formats are standard, and the response speed of the interface under different time periods or different loads, etc. Finally, at least one candidate parameter baseline corresponding to the target interface is constructed based on the historical parameter information. The candidate input parameter baseline is one of the parameter value baseline, parameter type baseline, and parameter quantity baseline.
[0063] Furthermore, after constructing multiple candidate parameter baselines according to different statistical indicators, all of them can be used as trusted parameter baselines, that is, all parameter baselines are used in turn for verification of each access operation. However, these indicators will inevitably have a few false positives in actual verification scenarios. Therefore, in order to select baselines with fewer false positives to improve the reliability and accuracy of the verification results, each candidate parameter baseline can be used to verify the filtering accuracy of the sample access data of the target interface, and the candidate parameter baseline whose filtering accuracy meets the preset accuracy conditions can be determined as a trusted parameter baseline. The preset accuracy conditions can specify a false positive ratio threshold, and the false positive ratio of each candidate parameter baseline after verifying the sample access data is compared with the false positive ratio threshold. If it exceeds the false positive ratio threshold, it means that the false positive rate of the candidate parameter baseline is high; if it does not exceed the false positive ratio threshold, it means that the false positive rate of the candidate parameter baseline is low, which is suitable as a trusted parameter baseline and participates in the access risk judgment in the actual verification scenario.
[0064] S306: When an access operation to a target interface is detected, current parameter information of the target interface is obtained.
[0065] Regarding step S306, please refer to the detailed description in step S204, which will not be repeated here.
[0066] S308. Compare the trusted parameter baseline with the current parameter information to obtain parameter filtering results; if the access operation is a risky access operation, intercept the risky access operation; if the access operation is a safe access operation, respond normally to the safe access operation.
[0067] Optionally, see Figure 4 When verifying the current parameter information, each trusted parameter baseline is compared with the current parameter information. If the current parameter information does not match the trusted parameter baseline, the access operation can be determined to be a risky access operation. Otherwise, the access operation is a safe access operation.
[0068] Optionally, when encountering a risky access operation, it is necessary to respond to the risky access operation in a timely manner, such as interception processing. The interception processing is to first intercept the risky access operation itself, interrupt the target interface's receiving response to it, and at the same time, conduct a judgment and verification of the risky access operation based on the current parameter information corresponding to the risky access operation, and verify the security of the risky access operation again to avoid the impact of risk misjudgment on normal access operations.
[0069] Specifically, in order to conduct research and judgment on risky access operations, an audit terminal can be set up to conduct secondary research and judgment on intercepted risky access operations. Then, after intercepting the risky access operation, a risk report corresponding to the risky access operation is obtained, and the risk report is sent to the audit terminal, wherein the risk report is a report further generated based on the current parameter information and parameter filtering results, which can be submitted in a form such as a table or form that is convenient for the audit terminal to identify and view. The audit terminal outputs a research and judgment report for the risk report, mainly to judge the true source of the risky access operation based on the specific information in the risk report, such as by initiating a verification operation to the user himself to confirm whether it is the operation by himself, etc. Specifically, it can be a method of instructing the user himself to enter a verification code, perform a verification operation, etc. If the verification passes, the access operation is determined to be a safe access operation, and if the verification fails, the access operation is confirmed to be an abnormal access operation. Then, the corresponding response measures can be further determined according to the research and judgment results. If it is an abnormal access operation, the access operation is directly terminated and the user is warned to change the password and other security operations to ensure the security of the user account.
[0070] Optionally, if the access operation is a secure access operation, the normal response can continue, and all interaction information between the secure access operation and the target interface will be recorded and stored in the form of a traffic behavior log for subsequent iteration and update of the trusted parameter baseline.
[0071] In an embodiment of the present specification, an interface security protection method is provided, which determines a preset time window corresponding to a trusted parameter baseline based on a secure access time period of a target interface, collects historical traffic behavior logs of the target interface within the preset time window, and parses the historical traffic behavior logs to obtain historical parameter information of the target interface, thereby saving computing resources while obtaining reliable historical email data; uses each candidate parameter baseline to perform filtering accuracy verification on sample access data of the target interface, and determines that a candidate parameter baseline whose filtering accuracy meets a preset accuracy condition is a trusted parameter baseline, thereby improving the reliability and accuracy of the verification result; compares the trusted parameter baseline with the current parameter information to obtain a parameter filtering result; if the access operation is a risky access operation, intercepts the risky access operation; if the access operation is a secure access operation, responds normally to the secure access operation, promptly and quickly handles risky access, maintains the operating environment of the target interface, and improves the attack defense performance against the interface.
[0072] See also Figure 5 , Figure 5 This is a structural block diagram of an interface security protection device provided in an embodiment of this specification. Figure 5 As shown, the interface security protection device 500 includes:
[0073] A baseline acquisition module 510 is used to determine a trusted parameter baseline corresponding to a target interface based on a historical traffic behavior log of the target interface;
[0074] The access monitoring module 520 is used to obtain the current parameter information of the target interface when an access operation to the target interface is detected;
[0075] The security verification module 530 is used to compare the trusted parameter baseline with the current parameter information to obtain a parameter filtering result, and perform preset processing on the access operation according to the parameter filtering result.
[0076] Optionally, the trusted parameter baseline includes at least one of a trusted input parameter baseline and a trusted output parameter baseline; the access monitoring module 520 is also used to obtain the current input parameter information of the target interface when the trusted parameter baseline includes a trusted input parameter baseline; and to obtain the current output parameter information of the target interface when the trusted parameter baseline includes a trusted output parameter baseline.
[0077] Optionally, the baseline acquisition module 510 is further used to collect historical traffic behavior logs of the target interface, and parse the historical traffic behavior logs to obtain historical parameter information of the target interface; and construct a trusted parameter baseline corresponding to the target interface based on the historical parameter information.
[0078] Optionally, the baseline acquisition module 510 is also used to construct at least one candidate parameter baseline corresponding to the target interface based on historical parameter information, where the candidate input parameter baseline is one of a parameter value baseline, a parameter type baseline, and a parameter quantity baseline; each candidate parameter baseline is used to verify the filtering accuracy of sample access data of the target interface, and determine that the candidate parameter baseline whose filtering accuracy meets the preset accuracy condition is a trusted parameter baseline.
[0079] Optionally, the baseline acquisition module 510 is further used to determine a preset time window corresponding to the trusted parameter baseline based on the security access time period of the target interface, and collect historical traffic behavior logs of the target interface within the preset time window.
[0080] Optionally, the security verification module 530 is further configured to intercept the risky access operation if the access operation is a risky access operation; and perform normal response processing on the safe access operation if the access operation is a safe access operation.
[0081] In an embodiment of the present specification, an interface security protection device is provided, wherein a baseline acquisition module is used to determine a trusted parameter baseline corresponding to a target interface based on a historical traffic behavior log of the target interface; an access monitoring module is used to obtain current parameter information of the target interface when an access operation to the target interface is monitored; and a security verification module is used to compare the trusted parameter baseline with the current parameter information to obtain a parameter filtering result, and to perform preset processing on the access operation according to the parameter filtering result. Since most of the accesses to the target interface by users in the system are reliable and secure accesses, the trusted parameter baseline of the input and / or output parameters of the interface that meets the expected conditions under normal circumstances can be determined according to the historical behavior log of the target interface; then when a new access operation occurs on the target interface, the parameter information of this access operation can be verified according to the trusted parameter baseline, and whether the parameter information belongs to the trusted parameter baseline and meets the expectations also indicates whether this access is a normal access, and further, the access is processed accordingly according to the risk level of this access, thereby accurately capturing risky access operations, processing risky accesses in a timely and rapid manner, maintaining the operating environment of the target interface, and improving the attack defense performance against the interface.
[0082] The embodiments of this specification provide a computer program product including instructions. When the computer program product is executed on a computer or a processor, the computer or the processor executes the steps of any one of the methods in the above embodiments.
[0083] The embodiments of this specification also provide a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded by a processor and executing the steps of any method in the above embodiments.
[0084] See also Figure 6 , Figure 6 This is a schematic diagram of the structure of a terminal provided in an embodiment of this specification. Figure 6 As shown, the terminal 600 may include: at least one terminal processor 601 , at least one network interface 604 , a user interface 603 , a memory 605 , and at least one communication bus 602 .
[0085] The communication bus 602 is used to realize the connection and communication between these components.
[0086] The user interface 603 may include a display screen (Display) and a camera (Camera), and the optional user interface 603 may also include a standard wired interface and a wireless interface.
[0087] The network interface 604 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).
[0088] Among them, the terminal processor 601 may include one or more processing cores. The terminal processor 601 uses various interfaces and lines to connect various parts in the entire terminal 600, and executes various functions and processes data of the terminal 600 by running or executing instructions, programs, code sets or instruction sets stored in the memory 605, and calling data stored in the memory 605. Optionally, the terminal processor 601 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The terminal processor 601 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the terminal processor 601, and it can be implemented separately through a chip.
[0089] Among them, the memory 605 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 605 includes a non-transitory computer-readable storage medium. The memory 605 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 605 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 605 may also be optionally at least one storage device located away from the aforementioned terminal processor 601. As Figure 6 As shown, the memory 605 as a computer storage medium may include an operating system, a network communication module, a user interface module, and an interface security protection program.
[0090] exist Figure 6In the terminal 600 shown, the user interface 603 is mainly used to provide an input interface for the user and obtain the data input by the user; and the terminal processor 601 can be used to call the interface security protection program stored in the memory 605, and specifically perform the following operations:
[0091] Determine the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface;
[0092] When an access operation to a target interface is detected, current parameter information of the target interface is obtained;
[0093] The trusted parameter baseline is compared with the current parameter information to obtain the parameter filtering result, and the access operation is preset according to the parameter filtering result.
[0094] In some embodiments, the trusted parameter baseline includes at least one of a trusted input parameter baseline and a trusted output parameter baseline; when the terminal processor 601 executes the acquisition of current parameter information of the target interface, it specifically performs the following steps: when the trusted parameter baseline includes a trusted input parameter baseline, the current input parameter information of the target interface is acquired; when the trusted parameter baseline includes a trusted output parameter baseline, the current output parameter information of the target interface is acquired.
[0095] In some embodiments, when the terminal processor 601 determines the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface, it specifically performs the following steps: collecting the historical traffic behavior log of the target interface, and parsing the historical traffic behavior log to obtain the historical parameter information of the target interface; and constructing the trusted parameter baseline corresponding to the target interface based on the historical parameter information.
[0096] In some embodiments, when the terminal processor 601 executes the construction of a trusted parameter baseline corresponding to the target interface based on historical parameter information, it specifically performs the following steps: constructing at least one candidate parameter baseline corresponding to the target interface based on the historical parameter information, the candidate input parameter baseline being one of a parameter value baseline, a parameter type baseline, and a parameter quantity baseline; using each candidate parameter baseline to verify the filtering accuracy of sample access data of the target interface, and determining that the candidate parameter baseline whose filtering accuracy meets the preset accuracy condition is a trusted parameter baseline.
[0097] In some embodiments, when the terminal processor 601 executes the collection of historical traffic behavior logs of the target interface, it specifically performs the following steps: determining a preset time window corresponding to a trusted parameter baseline based on a secure access time period of the target interface, and collecting the historical traffic behavior logs of the target interface within the preset time window.
[0098] In some embodiments, when the terminal processor 601 performs preset processing on the access operation according to the parameter filtering result, it specifically performs the following steps: if the access operation is a risky access operation, the risky access operation is intercepted; if the access operation is a safe access operation, the safe access operation is responded to normally.
[0099] In the several embodiments provided in this specification, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.
[0100] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0101] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of this specification is generated in whole or in part. The above computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The above computer instructions can be stored in a computer-readable storage medium or transmitted by the above computer-readable storage medium. The above computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (Digital Subscriber Line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The above computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The above-mentioned available media can be magnetic media (for example, floppy disks, hard disks, tapes), optical media (for example, digital versatile discs (DVD)), or semiconductor media (for example, solid state drives (SSD)), etc.
[0102] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.
[0103] In addition, it should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the historical traffic behavior logs, access operations, current parameter information, etc. involved in this specification are all obtained with full authorization.
[0104] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0105] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.
[0106] The above is a description of an interface security protection method, device, storage medium and terminal provided in the embodiments of this specification. For technical personnel in this field, based on the ideas of the embodiments of this specification, there may be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on the embodiments of this specification.
Claims
1. An interface security protection method, the method comprising: Determine a trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface; When an access operation to the target interface is detected, current parameter information of the target interface is obtained; The trusted parameter baseline is compared with the current parameter information to obtain a parameter filtering result, and the access operation is preset according to the parameter filtering result.
2. According to the method of claim 1, the trusted parameter baseline includes at least one of a trusted input parameter baseline and a trusted output parameter baseline; The obtaining of current parameter information of the target interface includes: When the trusted parameter baseline includes the trusted input parameter baseline, obtaining current input parameter information of the target interface; When the trusted parameter baseline includes the trusted output parameter baseline, current output parameter information of the target interface is obtained.
3. The method according to claim 1, wherein determining the trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface comprises: Collecting historical traffic behavior logs of the target interface, and parsing the historical traffic behavior logs to obtain historical parameter information of the target interface; A trusted parameter baseline corresponding to the target interface is constructed based on the historical parameter information.
4. The method according to claim 3, wherein the step of constructing a trusted parameter baseline corresponding to the target interface based on the historical parameter information comprises: Constructing at least one candidate parameter baseline corresponding to the target interface based on the historical parameter information, wherein the candidate input parameter baseline is one of a parameter value baseline, a parameter type baseline, and a parameter quantity baseline; The sample access data of the target interface is verified for filtering accuracy using each candidate parameter baseline, and the candidate parameter baseline whose filtering accuracy meets a preset accuracy condition is determined as a credible parameter baseline.
5. According to the method of claim 3, the collecting of historical traffic behavior logs of the target interface comprises: A preset time window corresponding to a trusted parameter baseline is determined based on a secure access time period of a target interface, and a historical traffic behavior log of the target interface within the preset time window is collected.
6. The method according to claim 1, wherein the step of performing preset processing on the access operation according to the parameter filtering result comprises: If the access operation is a risky access operation, intercepting the risky access operation; If the access operation is a security access operation, a normal response process is performed on the security access operation.
7. An interface security protection device, the device comprising: A baseline acquisition module, used to determine a trusted parameter baseline corresponding to the target interface based on the historical traffic behavior log of the target interface; An access monitoring module, configured to obtain current parameter information of the target interface when an access operation to the target interface is detected; The security verification module is used to compare the trusted parameter baseline with the current parameter information to obtain a parameter filtering result, and perform preset processing on the access operation according to the parameter filtering result.
8. A computer program product comprising instructions, which, when executed on a computer or a processor, causes the computer or the processor to execute the steps of the method according to any one of claims 1 to 6.
9. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the steps of the method according to any one of claims 1 to 6.
10. A terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 6 when executing the computer program.