Security protection method and device, electronic equipment and storage medium

Abstract

The invention provides a security protection method and device, electronic equipment and a storage medium, and relates to the field of network security, and the method comprises the steps: carrying out the anomaly detection of a network request flow sent to a micro-service and the response information of the micro-service to the network request flow, and obtaining an abnormal request feature; dynamically updating the security protection information according to the abnormal request features; issuing the security protection information to a flow inlet component of the micro-service, and controlling the flow inlet component to perform protection detection on the network request flow according to the security protection information; according to the invention, abnormity detection can be carried out on the network request flow and response information of the micro-service to the network request flow to obtain abnormal request characteristics, and the security protection information can be dynamically updated according to the abnormal request characteristics, so that the security protection information can be issued to the flow entrance component of the micro-service. Therefore, the traffic entrance component is controlled to perform protection detection on the network request traffic according to the security protection information, so that each micro-service can be effectively protected.

Description

Technical Field

[0001] The present invention relates to the field of network security, and in particular to a security protection method, device, electronic equipment and storage medium. Background Art

[0002] With the continuous development of new energy technologies, the number of new energy vehicles is increasing, and the demand for charging new energy vehicles is also increasing. In order to provide high-quality charging services, the charging service network can use a large number of microservices to provide services to users. However, network attacks on the charging service network are endless, and these network attacks are complex and changeable, which not only seriously threatens the service quality of each microservice, but also cannot be protected by traditional static security protection methods. Summary of the invention

[0003] The purpose of the present invention is to provide a security protection method, device, electronic device and storage medium, which can dynamically detect anomalies of network request traffic and microservices, and perform dynamic protection detection on the network request traffic based on the obtained abnormal characteristic information, so as to effectively protect microservices.

[0004] In order to solve the above technical problems, the present invention provides a safety protection method, comprising:

[0005] Performing anomaly detection on network request traffic sent to the microservice and response information of the microservice to the network request traffic to obtain abnormal request features;

[0006] Dynamically updating security protection information according to the abnormal request characteristics;

[0007] The security protection information is sent to the traffic entry component of the microservice, and the traffic entry component is controlled to perform protection detection on the network request traffic according to the security protection information.

[0008] Optionally, the microservice performs anomaly detection on the response information of the network request traffic to obtain abnormal request features, including:

[0009] Obtain an exception log generated by the microservice processing the network request traffic;

[0010] The common features of the abnormal logs are extracted to obtain the abnormal request features.

[0011] Optionally, perform anomaly detection on the network request traffic sent to the microservice to obtain abnormal request features, including:

[0012] Determine the request processing frequency of the microservice in a preset time period according to the network request traffic, obtain the historical request processing frequency of the microservice in a historical time period, and determine whether the request processing frequency is abnormal according to the historical request processing frequency;

[0013] If it is determined that the request processing frequency is abnormal, extracting common features of the network request traffic within the preset time period to obtain the abnormal request features;

[0014] and / or, receiving the network request traffic, and determining a target microservice to which the network request traffic is sent;

[0015] Obtain a preset expired microservice list, and determine whether the target microservice is recorded in the preset expired microservice list;

[0016] If the target microservice is recorded in the preset expired microservice list, the network request traffic is determined to be abnormal network request traffic, and the abnormal request feature is extracted from the abnormal network request traffic.

[0017] Optionally, sending the security protection information to the traffic entry component of the microservice, and controlling the traffic entry component to perform protection detection on the network request traffic according to the security protection information, includes:

[0018] Send the security protection information to the main process of the traffic entry component so that the main process updates the security protection information to the shared memory of the traffic entry component;

[0019] Control multiple working processes in the traffic entry component to extract the security protection information from the shared memory to its own cache, and perform protection detection on the network request traffic based on the security protection information in the cache.

[0020] Optionally, dynamically updating the security protection information according to the abnormal request feature includes:

[0021] According to the preset feature type of the abnormal request feature, searching for security protection information corresponding to the preset feature type;

[0022] Determining whether the abnormal request feature is recorded in the security protection information;

[0023] If not recorded, the abnormal request feature is added to the security protection information.

[0024] Optionally, controlling the traffic inlet component to perform protection detection on the network request traffic according to the security protection information includes:

[0025] Control the traffic inlet component to extract request features corresponding to various preset feature types from the network request traffic;

[0026] Verifying the request feature using the security protection information corresponding to the preset feature type, and determining whether the request feature passes the verification;

[0027] If passed, the network request traffic is sent to the microservice;

[0028] If it fails, the network request traffic is processed as an exception.

[0029] Optionally, performing exception processing on the network request traffic includes:

[0030] Control the traffic inlet component to determine whether to turn on the interception mode;

[0031] If enabled, the network request traffic is prohibited from being sent to the microservice;

[0032] If it is not enabled, the network request traffic continues to be sent to the microservice and abnormal alarm information is output.

[0033] The present invention also provides a safety protection device, comprising:

[0034] An anomaly detection module, used to perform anomaly detection on the network request traffic sent to the microservice and the response information of the microservice to the network request traffic, and obtain abnormal request characteristics;

[0035] An information updating module, used to dynamically update the security protection information according to the abnormal request characteristics;

[0036] The protection detection module is used to send the security protection information to the traffic entry component of the microservice, and control the traffic entry component to perform protection detection on the network request traffic according to the security protection information.

[0037] The present invention also provides an electronic device, comprising:

[0038] Memory for storing computer programs;

[0039] A processor is used to implement the security protection method as described above when executing the computer program.

[0040] The present invention also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are loaded and executed by a processor, the security protection method as described above is implemented.

[0041] The present invention also provides a computer program product, including a computer program or instructions, which implement the security protection method as described above when executed by a processor.

[0042] The present invention provides a security protection method, comprising: performing anomaly detection on network request traffic sent to a microservice and response information of the microservice to the network request traffic to obtain abnormal request characteristics; dynamically updating security protection information according to the abnormal request characteristics; sending the security protection information to a traffic entry component of the microservice, and controlling the traffic entry component to perform protection detection on the network request traffic according to the security protection information.

[0043] It can be seen that the present invention can first perform anomaly detection on the network request traffic sent to the microservice and the response information of the microservice to the network request traffic to obtain the abnormal request characteristics. In other words, the network request traffic itself can be detected to find the abnormalities in the traffic trend and traffic content of the network request traffic itself, and the response generated by the microservice processing the network request traffic can also be detected to find the abnormalities encountered by the microservice in the process of processing the network request traffic, thereby improving the comprehensiveness of the abnormal request characteristics. Subsequently, the security protection information can be dynamically updated according to the abnormal request characteristics, and the security protection information can be sent to the traffic entry component of the microservice, and finally the traffic entry component is controlled to perform protection detection on the network request traffic according to the security protection information, thereby ensuring the dynamic update of the security protection information and the dynamic protection of the traffic entry component, so as to effectively protect each microservice in the charging business network. The present invention also provides a safety protection device, an electronic device and a computer-readable storage medium, which have the above-mentioned beneficial effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flowchart of a security protection method provided by an embodiment of the present invention;

[0046] Figure 2 A structural block diagram of a network request flow protection system provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of an overall security protection framework provided by an embodiment of the present invention;

[0048] Figure 4 A flow chart of a dynamic security protection provided by an embodiment of the present invention;

[0049] Figure 5 A structural block diagram of a safety protection device provided by an embodiment of the present invention;

[0050] Figure 6 The present invention provides a structural block diagram of an electronic device. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] With the continuous development of new energy technologies, the number of new energy vehicles is increasing, and the demand for charging new energy vehicles is also increasing. In order to provide high-quality charging services, the charging service network can use a large number of microservices to provide services to users. However, network attacks on the charging service network are endless, and these network attacks are complex and changeable, which not only seriously threatens the service quality of each microservice, but also cannot be protected by traditional static security protection methods.

[0053] In view of this, in order to solve the technical problem of how to better perform security protection for microservices, the present invention can provide a security protection method that can dynamically detect anomalies in network request traffic and microservices, and perform dynamic protection detection on network request traffic based on the obtained abnormal feature information, thereby effectively protecting microservices.

[0054] For easier understanding, please refer to Figure 1 , Figure 1 A flowchart of a security protection method provided by an embodiment of the present invention, the method may include:

[0055] S101. Perform anomaly detection on network request traffic sent to a microservice and response information of the microservice to the network request traffic to obtain abnormal request features.

[0056] In this step, first, the network request traffic sent to the microservice can be detected for anomalies, and the response information of the microservice to the network request traffic can be detected for anomalies. In other words, this embodiment can start with the network request traffic itself, determine the abnormal access behavior of the external device to the microservice system, and thus filter the abnormal network request traffic; on the other hand, it can also start with the response of the microservice itself, and filter the abnormal network request traffic through the abnormal response generated by the microservice when processing the request, thereby improving the comprehensiveness and reliability of anomaly detection. Furthermore, after the abnormal network request traffic is screened, common features can be extracted, so that the patterns and features of abnormal requests can be dynamically identified.

[0057] It should be noted that this embodiment does not limit how to filter abnormal network request traffic based on the network request traffic's own information, and can be processed starting from the direction of abnormal access behavior of the network request traffic. For example, the request processing frequency of the microservice in a preset time period can be determined based on the network request traffic, that is, how much network request traffic is sent to the microservice for processing. Subsequently, the historical request processing frequency of the microservice in the historical time period can be obtained, and whether the current request processing frequency is abnormal can be determined based on the historical request processing frequency. For example, the judgment can be made based on whether the current request processing frequency exceeds the historical request processing frequency and the percentage by which the current request processing frequency exceeds the historical request processing frequency. If it is determined that the request processing frequency is abnormal, the network request traffic within the preset time period can be determined to be abnormal network request traffic.

[0058] For another example, the microservice accessed by the network request traffic can be determined, and it can be determined whether the microservice is saved in the preset expired microservice list. Among them, the preset expired microservice list is used to save the microservices that have expired and gone offline, and the expired offline means that the microservice has stopped providing services to the outside world. If the microservice accessed by the network request traffic is saved in the preset expired microservice list, it means that the network request traffic is detecting the vulnerability of the offline microservice, so this batch of network request traffic can be determined as abnormal network request traffic. Furthermore, after completing the traffic screening, the common features of the abnormal network request traffic can be extracted to obtain abnormal request features.

[0059] Based on this, the network request traffic sent to the microservice is detected for anomalies, and the abnormal request features are obtained, which may include:

[0060] Step 11: determining the request processing frequency of the microservice in a preset time period according to the network request traffic, obtaining the historical request processing frequency of the microservice in a historical time period, and judging whether the request processing frequency is abnormal according to the historical request processing frequency;

[0061] Step 12: If it is determined that the request processing frequency is abnormal, extracting common features of the network request traffic within the preset time period to obtain the abnormal request features;

[0062] Step 13: If it is determined that the request processing frequency is not abnormal, then determining that the network request traffic in the preset time period is normal.

[0063] Perform anomaly detection on the network request traffic sent to the microservice to obtain abnormal request features, which may also include:

[0064] Step 21: Receive the network request traffic, and determine the target microservice to which the network request traffic is sent;

[0065] Step 22: Obtain a preset expired microservice list, and determine whether the target microservice is recorded in the preset expired microservice list;

[0066] Step 23: If the target microservice is recorded in the preset expired microservice list, the network request traffic is determined to be abnormal network request traffic, and the abnormal request feature is extracted from the abnormal network request traffic.

[0067] Step 24: If the target microservice is not recorded in the preset expired microservice list, it is determined that the network request traffic is normal.

[0068] It should be pointed out that the above two methods can be used either alone or in combination.

[0069] Furthermore, this embodiment does not limit how to extract common features from abnormal network request traffic, and can be set according to actual application requirements. For example, for each preset feature type, the number of each preset feature type corresponding to the abnormal network request traffic can be determined. If the number exceeds the preset threshold, or if the ratio of the number to the number of abnormal network requests exceeds the preset threshold, the feature corresponding to the preset feature type can be determined as a common feature in the abnormal network request traffic. This embodiment also does not limit the specific preset feature type, for example, it can be the source device IP address, source device client type information, source device device information (such as device ID, device operating system, device hardware type, etc.), source device request data header (Header), source device local cache data (Cookie), target device IP address, target device ID, target microservice information, etc.

[0070] Furthermore, this embodiment does not limit how to filter abnormal network request traffic based on the response information of the microservice to the network request traffic. First, this embodiment needs to obtain the abnormal response information of the microservice to the network request traffic, which can be obtained from the abnormal log generated by the microservice when processing the network request traffic. Subsequently, common features can be extracted from the abnormal log to obtain abnormal request features. It should be pointed out here that the abnormal log here is thrown by the processing logic in the microservice, that is, the abnormal log generated by the microservice performing business processing on the request in the network request traffic.

[0071] Based on this, the microservice performs anomaly detection on the response information of the network request traffic to obtain abnormal request features, including:

[0072] Step 31: Obtain the abnormal log generated by the microservice processing the network request traffic;

[0073] Step 32: extract the common features of the abnormal logs to obtain the abnormal request features.

[0074] Furthermore, this embodiment does not limit how to extract common features from the exception log, and can be set according to actual application requirements. For example, for each preset feature type, the number of each preset feature type corresponding to the exception log can be determined. If the number exceeds the preset threshold, or if the ratio of the number to the number of exception logs exceeds the preset threshold, the feature corresponding to the preset feature type can be determined as a common feature in the exception log. This embodiment also does not limit the specific preset feature type, for example, it can be the source device IP address, source device client type information, source device device information (such as device ID, device operating system, device hardware type, etc.), source device request data header (Header), source device local cache data (Cookie), target device IP address, target device ID, target microservice information, request type, error type, etc.

[0075] Of course, the abnormal request features extracted from the abnormal network request traffic and the abnormal request features extracted from the abnormal logs can also be correlated and analyzed, for example, they can be correlated based on timestamps, thereby further improving the detection effect.

[0076] S102: Dynamically update security protection information according to the abnormal request characteristics.

[0077] In this step, after obtaining the abnormal request feature, the security protection information can be dynamically updated based on it, so as to perform protection detection on the network request traffic sent subsequently based on the security protection information. As described above, since the abnormal request feature can correspond to multiple preset feature types, corresponding security protection information can be created for each preset feature type. Furthermore, the newly added abnormal request feature can be added to the security protection information corresponding to its type.

[0078] Based on this, dynamically updating the security protection information according to the abnormal request characteristics may include:

[0079] Step 41: according to the preset feature type of the abnormal request feature, searching for security protection information corresponding to the preset feature type;

[0080] Step 42: Determine whether the abnormal request feature is recorded in the security protection information; if not, proceed to step 43; if recorded, proceed to step 44;

[0081] Step 43: Add the abnormal request feature to the security protection information;

[0082] Step 44: Ignore the abnormal request feature.

[0083] S103: Send the security protection information to the traffic entry component of the microservice, and control the traffic entry component to perform protection detection on the network request traffic according to the security protection information.

[0084] In this step, after obtaining the updated security protection information, it can be sent to the traffic entry component of each microservice, and the traffic entry component can be controlled to perform protection detection on the network request traffic according to the security protection information. For easy understanding, please refer to Figure 2 , Figure 2 A structural block diagram of a network request traffic protection system provided by an embodiment of the present invention. Among them, the traffic entry component is responsible for providing network request traffic protection services for multiple microservices. Security protection information can be sent and saved to the traffic entry component. In this way, when the traffic entry component receives network request traffic, it can extract request features corresponding to various preset feature types from the traffic, and compare and verify the request features with the security protection information corresponding to the various preset feature types. If the verification passes, it can be determined that the network request traffic is normal and can be forwarded to the microservice normally; if the verification fails, it can be determined that the network request traffic is abnormal and it can be handled abnormally.

[0085] Based on this, controlling the traffic inlet component to perform protection detection on the network request traffic according to the security protection information includes:

[0086] Step 51: Control the traffic inlet component to extract request features corresponding to various preset feature types from the network request traffic;

[0087] Step 52: Verify the request feature using the security protection information corresponding to the preset feature type to determine whether the request feature passes the verification; if passed, proceed to step 53; if not, proceed to step 54;

[0088] Step 53: Send the network request traffic to the microservice;

[0089] Step 54: Perform exception processing on the network request traffic.

[0090] It should be noted that this embodiment does not limit how to perform verification. For example, the request characteristics can be compared with the security protection information, and whether the verification is passed can be determined based on the comparison result. The comparison method can be equal to, not equal to, contain, not contain, belong to, not belong to, etc., which can be set according to actual application requirements.

[0091] Furthermore, this embodiment does not limit how to handle exceptions to network request traffic. For example, the network request traffic can be blocked, and the network request traffic is prohibited from being sent to the microservice. For another example, if it is necessary to continue to perform abnormal analysis on the network request traffic, the network request traffic can continue to be sent to the microservice, and abnormal alarm information can be output to prompt the operation and maintenance personnel to perform on-site analysis. The above two methods can be switched through the interception mode. If the traffic entry component has the interception mode turned on, the network request traffic needs to be intercepted; if the traffic entry component does not have the interception mode turned on, an alarm needs to be issued for the network request traffic.

[0092] Based on this, the abnormal processing of the network request traffic may include:

[0093] Step 61: Control the traffic inlet component to determine whether the interception mode is turned on; if it is turned on, go to step 62; if it is not turned on, go to step 63;

[0094] Step 62: prohibiting the network request traffic from being sent to the microservice;

[0095] Step 63: Continue to send the network request traffic to the microservice and output abnormal alarm information.

[0096] Furthermore, to ensure the dynamic delivery of security protection information, the traffic entry component may include a main process, a working process, and a shared memory. The security protection information is received by the main process and saved to the shared memory; the working process extracts the security protection information from the shared memory to its own cache, and performs protection detection on the network request traffic based on the security protection information in its own cache.

[0097] Based on this, sending the security protection information to the traffic entry component of the microservice, and controlling the traffic entry component to perform protection detection on the network request traffic according to the security protection information may include:

[0098] Step 71: Send the security protection information to the main process of the traffic entry component, so that the main process updates the security protection information to the shared memory of the traffic entry component;

[0099] Step 72: Control multiple working processes in the traffic entry component to extract the security protection information from the shared memory to its own cache, and perform protection detection on the network request traffic based on the security protection information in the cache.

[0100] Based on the above embodiments, the present invention can first perform anomaly detection on the network request traffic sent to the microservice and the response information of the microservice to the network request traffic to obtain abnormal request characteristics. In other words, the network request traffic itself can be detected to find the abnormalities in the traffic trend and traffic content of the network request traffic itself, and the response generated by the microservice processing the network request traffic can also be detected to find the abnormalities encountered by the microservice in the process of processing the network request traffic, thereby improving the comprehensiveness of the abnormal request characteristics. Subsequently, the security protection information can be dynamically updated according to the abnormal request characteristics, and the security protection information can be sent to the traffic entry component of the microservice, and finally the traffic entry component is controlled to perform protection detection on the network request traffic according to the security protection information, thereby ensuring the dynamic update of the security protection information and the dynamic protection of the traffic entry component, so as to effectively protect each microservice in the charging business network.

[0101] Based on the above embodiments, the above security protection method will be fully introduced below in combination with specific schematic diagrams. The present invention provides a dynamic security protection method and device, which can analyze request traffic trends in real time, dynamically adjust security protection strategies, effectively implement security protection measures, and monitor and report to cope with ever-changing network security threats. This technical solution includes two parts: intelligent analysis of request traffic and dynamic security protection. For easy understanding, please refer to Figure 3 , Figure 3 This is a schematic diagram of an overall security protection framework provided by an embodiment of the present invention. The specific implementation details are described below.

[0102] 1. Request traffic intelligent analysis:

[0103] Intelligent analysis of request traffic includes two steps: traffic trend analysis and abnormal feature extraction.

[0104] 1.1 Traffic trend analysis:

[0105] Traffic trend analysis includes two analysis methods:

[0106] A) Prediction and analysis based on the month-on-month deviation of request QPS: Real-time monitoring and analysis of changes in requests per second (QPS, Queries-per-second), and identification of abnormal traffic trends by month-on-month analysis with historical data;

[0107] B) Analysis based on microservice exception logs: Collect and analyze microservice exception logs to identify patterns and characteristics of abnormal requests.

[0108] 1.2. Abnormal feature extraction:

[0109] Extract key abnormal features from abnormal traffic and logs, such as source IP, UserAgent (client information), device ID and other information, to provide a basis for adjusting security protection strategies.

[0110] 2. Dynamic security protection:

[0111] Dynamic security protection is deployed at the Nginx level of the microservice traffic entrance, including security protection strategy update, dynamic security protection, and protection log monitoring and reporting.

[0112] 2.1. Security protection strategy update:

[0113] A) Based on the (key) abnormal features extracted by intelligent traffic analysis, the system automatically generates targeted security protection policies and calls the security protection management API (Application Programming Interface) deployed on the Nginx service to push new security policies to the Nginx service;

[0114] B) After receiving the policy update request, the Nginx service persists it to the local security protection policy configuration file, and updates the security protection policy list in the shared cache to add the new policy;

[0115] C) The Nginx working process periodically polls and compares the differences between the security protection objects in Lua_LRU_Cache (its own cache) and the policy list in the shared cache. If there are any changes, the Lua_LRU_Cache object is updated

[0116] 2.2 Dynamic security protection

[0117] For the dynamic security protection process, please refer to Figure 4 , Figure 4 A flow chart of a dynamic security protection provided by an embodiment of the present invention. This process includes:

[0118] A) When a new microservice request enters Nginx, the security protection function checks whether it is hit based on the policy definition, including the following:

[0119] 1) Whether the source IP of the request is in the security policy blacklist IP;

[0120] 2) Whether the source IP of the request is not in the whitelist IP of the security policy;

[0121] 3) Whether the requested UserAgent is in the security policy UA list;

[0122] 4) Whether the requested microservice is in the list of microservices with expired security policies;

[0123] 5) Whether the requested device ID is in the security policy blacklist device ID;

[0124] 6) Whether the requested device ID is in the security policy whitelist device ID;

[0125] 7) Whether the Key value specified in the requested Header is in the security policy value list;

[0126] 8) Whether the Key value specified in the requested Cookie is in the security policy value list;

[0127] 9) Whether other characteristics of the request are in the list of custom interception values ​​of the security policy.

[0128] Among them, the hit comparison comparison operators include equal to, not equal to, include, not include, belongs to, not belongs to, etc.

[0129] B) If the protection strategy is not hit, continue to execute the microservice;

[0130] C) If the protection strategy is hit, check whether the current strategy is observer mode or interception mode:

[0131] 1) Observer mode: record interception logs and report to monitoring, and then continue to execute microservices;

[0132] 2) Interception mode: record the interception log and report it to the monitoring, terminate the subsequent execution steps, and return the custom flow control information to the requester.

[0133] 2.3. Protection log monitoring and reporting:

[0134] The external monitoring reporting function periodically requests the monitoring interface of the Nginx management API. If intercepted data is collected, the monitoring data is reported to the system, and the system triggers an alarm to notify the administrator.

[0135] The security protection device, electronic device, computer program product, and computer-readable storage medium provided in the embodiments of the present invention are introduced below. The security protection device, electronic device, computer program product, and computer-readable storage medium described below can be referenced to the security protection method described above.

[0136] Please refer to Figure 5 , Figure 5 A structural block diagram of a safety protection device provided by an embodiment of the present invention, the device may include:

[0137] Anomaly detection module 501, used to perform anomaly detection on network request traffic sent to a microservice and response information of the microservice to the network request traffic, and obtain abnormal request features;

[0138] An information updating module 502, configured to dynamically update the security protection information according to the abnormal request characteristics;

[0139] The protection detection module 503 is used to send the security protection information to the traffic entry component of the microservice, and control the traffic entry component to perform protection detection on the network request traffic according to the security protection information.

[0140] Optionally, the anomaly detection module 501 may include:

[0141] The abnormal log acquisition submodule is used to obtain the abnormal log generated by the microservice processing the network request traffic;

[0142] The abnormal log feature extraction submodule is used to extract the common features of the abnormal log to obtain the abnormal request features.

[0143] Optionally, the anomaly detection module 501 may include:

[0144] A request frequency anomaly detection submodule, used to determine the request processing frequency of the microservice in a preset time period according to the network request traffic, obtain the historical request processing frequency of the microservice in a historical time period, and determine whether the request processing frequency is abnormal according to the historical request processing frequency;

[0145] A first abnormal request feature extraction submodule is used to extract common features of network request traffic within the preset time period to obtain the abnormal request feature if it is determined that the request processing frequency is abnormal;

[0146] and / or, receiving the network request traffic, and determining a target microservice to which the network request traffic is sent;

[0147] The abnormal access detection submodule is used to obtain a preset expired microservice list and determine whether the target microservice is recorded in the preset expired microservice list;

[0148] The second abnormal request feature extraction submodule is used to determine that the network request traffic is abnormal network request traffic if the target microservice is recorded in the preset expired microservice list, and extract the abnormal request feature from the abnormal network request traffic.

[0149] Optionally, the protection detection module 503 may include:

[0150] A sending submodule, used for sending the security protection information to the main process of the traffic entry component, so that the main process updates the security protection information to the shared memory of the traffic entry component;

[0151] The detection control submodule is used to control the multiple working processes in the traffic entry component to extract the security protection information from the shared memory to its own cache, and perform protection detection on the network request traffic based on the security protection information in the cache.

[0152] Optionally, the information updating module 502 may include:

[0153] A search submodule, used to search for security protection information corresponding to the preset feature type according to the preset feature type of the abnormal request feature;

[0154] A judgment submodule, used to judge whether the abnormal request feature is recorded in the security protection information;

[0155] The updating submodule is used to add the abnormal request feature to the security protection information if it is not recorded.

[0156] Optionally, the protection detection module 503 may include:

[0157] A request feature extraction submodule, used to control the traffic inlet component to extract request features corresponding to various preset feature types from the network request traffic;

[0158] A verification submodule, used to verify the request feature using the security protection information corresponding to the preset feature type, and determine whether the request feature passes the verification;

[0159] A release submodule, used for sending the network request traffic to the microservice if it passes;

[0160] The exception handling submodule is used to perform exception handling on the network request traffic if it fails.

[0161] Optionally, the exception handling submodule may include:

[0162] A mode activation judgment unit, used to control the traffic inlet component to determine whether to activate the interception mode;

[0163] An interception unit, which, if enabled, prohibits the network request traffic from being sent to the microservice;

[0164] The alarm unit is used to continue sending the network request traffic to the microservice and output abnormal alarm information if it is not enabled.

[0165] Please refer to Figure 6 , Figure 6 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. The embodiment of the present invention provides an electronic device 10, including a processor 11 and a memory 12; wherein the memory 12 is used to store a computer program; and the processor 11 is used to execute the security protection method provided in the aforementioned embodiment when executing the computer program.

[0166] For the specific process of the above-mentioned security protection method, please refer to the corresponding content provided in the above-mentioned embodiment, which will not be repeated here.

[0167] Furthermore, the memory 12 as a carrier for storing resources may be a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., and the storage method may be temporary storage or permanent storage.

[0168] In addition, the electronic device 10 also includes a power supply 13, a communication interface 14, an input / output interface 15 and a communication bus 16; wherein the power supply 13 is used to provide working voltage for each hardware device on the electronic device 10; the communication interface 14 can create a data transmission channel between the electronic device 10 and an external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present invention, and is not specifically limited here; the input / output interface 15 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0169] An embodiment of the present invention further provides a computer program product, including a computer program / instruction, which implements the security protection method described in the above embodiment when executed by a processor.

[0170] Since the embodiments of the computer program product part correspond to the embodiments of the security protection method part, please refer to the description of the embodiments of the security protection method part for the embodiments of the computer program product part, and will not be repeated here.

[0171] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the security protection method described in the above embodiment is implemented.

[0172] Since the embodiments of the computer-readable storage medium part correspond to the embodiments of the security protection method part, please refer to the description of the embodiments of the security protection method part for the embodiments of the storage medium part, which will not be repeated here.

[0173] The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0174] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0175] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0176] The above is a detailed introduction to a security protection method, device, electronic device and storage medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present invention, several improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the scope of protection of the present invention.

Claims

1. A safety protection method, characterized in that: include: Performing anomaly detection on network request traffic sent to the microservice and response information of the microservice to the network request traffic to obtain abnormal request features; Dynamically updating security protection information according to the abnormal request characteristics; The security protection information is sent to the traffic entry component of the microservice, and the traffic entry component is controlled to perform protection detection on the network request traffic according to the security protection information.

2. The safety protection method according to claim 1, characterized in that: Anomaly detection is performed on the response information of the microservice to the network request traffic to obtain abnormal request features, including: Obtain an exception log generated by the microservice processing the network request traffic; The common features of the abnormal logs are extracted to obtain the abnormal request features.

3. The safety protection method according to claim 1, characterized in that: Perform anomaly detection on the network request traffic sent to the microservices to obtain abnormal request features, including: Determine the request processing frequency of the microservice in a preset time period according to the network request traffic, obtain the historical request processing frequency of the microservice in a historical time period, and determine whether the request processing frequency is abnormal according to the historical request processing frequency; If it is determined that the request processing frequency is abnormal, extracting common features of the network request traffic within the preset time period to obtain the abnormal request features; and / or, receiving the network request traffic, and determining a target microservice to which the network request traffic is sent; Obtain a preset expired microservice list, and determine whether the target microservice is recorded in the preset expired microservice list; If the target microservice is recorded in the preset expired microservice list, the network request traffic is determined to be abnormal network request traffic, and the abnormal request feature is extracted from the abnormal network request traffic.

4. The safety protection method according to claim 1, characterized in that: Sending the security protection information to the traffic entry component of the microservice, and controlling the traffic entry component to perform protection detection on the network request traffic according to the security protection information, including: Send the security protection information to the main process of the traffic entry component so that the main process updates the security protection information to the shared memory of the traffic entry component; Control multiple working processes in the traffic entry component to extract the security protection information from the shared memory to its own cache, and perform protection detection on the network request traffic based on the security protection information in the cache.

5. The safety protection method according to any one of claims 1 to 4, characterized in that: Dynamically updating the security protection information according to the abnormal request characteristics, including: According to the preset feature type of the abnormal request feature, searching for security protection information corresponding to the preset feature type; Determining whether the abnormal request feature is recorded in the security protection information; If not recorded, the abnormal request feature is added to the security protection information.

6. The safety protection method according to claim 5, characterized in that: Controlling the traffic inlet component to perform protection detection on the network request traffic according to the security protection information includes: Control the traffic inlet component to extract request features corresponding to various preset feature types from the network request traffic; Verifying the request feature using the security protection information corresponding to the preset feature type, and determining whether the request feature passes the verification; If passed, the network request traffic is sent to the microservice; If it fails, the network request traffic is processed as an exception.

7. The safety protection method according to claim 6, characterized in that: Performing abnormal processing on the network request traffic, including: Control the traffic inlet component to determine whether to turn on the interception mode; If enabled, the network request traffic is prohibited from being sent to the microservice; If it is not enabled, the network request traffic continues to be sent to the microservice and abnormal alarm information is output.

8. A safety protection device, characterized in that: include: An anomaly detection module, used to perform anomaly detection on the network request traffic sent to the microservice and the response information of the microservice to the network request traffic, and obtain abnormal request characteristics; An information updating module, used to dynamically update the security protection information according to the abnormal request characteristics; The protection detection module is used to send the security protection information to the traffic entry component of the microservice, and control the traffic entry component to perform protection detection on the network request traffic according to the security protection information.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, used to implement the security protection method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are loaded and executed by the processor, the security protection method according to any one of claims 1 to 7 is implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the security protection method as described in any one of claims 1 to 7 is implemented.

Images