Attack detection method and device for webpage application and computer equipment

Abstract

The invention relates to an attack detection method and device for a webpage application and computer equipment. The method comprises the steps that when a user sends webpage access request information to the front end of a webpage application, client fingerprint information and operation behavior data of the user are collected, and potential attack behavior information of the user is recognized through an attack detection algorithm based on the operation behavior data and the webpage access request information; encrypting and transmitting the potential attack behavior information of the user, the client fingerprint information and the operation behavior data, and identifying an attack detection result of the user through an attack detection program of the server; and based on the attack detection result, generating attack protection information of the webpage application to the user, and based on the attack protection information, performing distributed attack protection processing on each browser node corresponding to the webpage application. By adopting the method, the efficiency of Web attack detection in a high-concurrency and low-delay environment can be improved.

Description

Technical Field

[0001] The present application relates to the field of application security technology, and in particular to a method, device and computer equipment for detecting attacks on web applications. Background Art

[0002] In the field of security protection of modern Web applications, Web attack detection is a crucial link. Existing Web attack detection technologies are mainly concentrated on the server side. Therefore, attack detection on the server side is the main method of current Web application attack detection technology. How to improve the accuracy of attack detection on the server side is the current research focus.

[0003] The existing attack detection method for Web applications is to perform all-round detection of server-side attacks through rule-based engine detection, semantic analysis, and machine learning detection engines. However, for Web attack detection in a high-concurrency and low-latency environment, the above technical solution puts a lot of pressure on the performance of the server, and due to the small amount of front-end data, the algorithm migration cost is high, which makes the efficiency of Web attack detection in a high-concurrency and low-latency environment low. Summary of the invention

[0004] Based on this, it is necessary to provide a web application attack detection method, device, computer equipment, computer readable storage medium and computer program product to address the above technical problems.

[0005] In a first aspect, the present application provides a method for detecting attacks on a web application, comprising:

[0006] When a user sends a webpage access request to the front end of a webpage application, the user's client fingerprint information and the user's operation behavior data are collected, and based on the operation behavior data and the user's webpage access request information, the user's potential attack behavior information is identified through an attack detection algorithm;

[0007] Encrypting and transmitting the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server of the web application, and identifying the attack detection result of the user through the attack detection program of the server based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user;

[0008] Based on the attack detection result, attack protection information of the webpage application on the user is generated, and based on the attack protection information, distributed attack protection processing is performed on each browser node corresponding to the webpage application.

[0009] Optionally, when the user sends a webpage access request to the front end of the webpage application, collecting the client fingerprint information of the user and the operation behavior data of the user includes:

[0010] When a user sends a web page access request to the front end of the web page application, a data collection and analysis script is deployed in the front end through a protection data collection program;

[0011] Based on the data collection and analysis script, collect the device configuration information of the client and the operation behavior record information of the user;

[0012] The device configuration information is used as the client fingerprint information of the user, and the operation behavior record information of the user is used as the operation behavior data of the user.

[0013] Optionally, identifying the user's potential attack behavior information through an attack detection algorithm based on the operation behavior data and the user's webpage access request information includes:

[0014] Based on the webpage access request information, querying the access database for a range of normal operation behavior data corresponding to the webpage access request information, and identifying abnormal operation behavior data of the user based on the operation behavior data and the range of normal operation behavior data;

[0015] The abnormal attack behavior type corresponding to the abnormal operation behavior data is identified through the attack detection algorithm, and the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data are used as potential attack behavior information of the user.

[0016] Optionally, the step of encrypting and transmitting the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server of the web application includes:

[0017] Packaging the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain a current behavior data packet of the user;

[0018] Performing data encryption processing on the current behavior data packet to obtain a current behavior data encryption packet, and querying a currently applicable target transmission channel in each of the transmission channels;

[0019] The current behavior data encrypted package is transmitted to the server side of the web application through the target transmission channel.

[0020] Optionally, the identifying the attack detection result of the user through the attack detection program on the server side based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user includes:

[0021] Based on the client fingerprint information, query the client history access information of the user in the client database, and based on the client history access information, identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data;

[0022] Based on the historical attack behavior data corresponding to each of the attack behavior types and the operation behavior data of the user, identifying, through a behavior data similarity identification program, first abnormal operation behavior data in the operation behavior data of the user whose similarity to the historical attack behavior data is greater than a similarity threshold, and using the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the first attack behavior type of the user;

[0023] Based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data are identified through the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are used as the attack detection result of the user.

[0024] Optionally, generating attack protection information of the web application on the user based on the attack detection result includes:

[0025] For each attack behavior type, query the attack protection strategy corresponding to the attack behavior type in the attack protection database;

[0026] Based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, attack protection operation information of the attack behavior type is generated, and the attack protection operation information of all attack behavior types is used as the attack protection information of the web application to the user.

[0027] In a second aspect, the present application also provides an attack detection device for a web application, comprising:

[0028] A collection module, used to collect the client fingerprint information of the user and the operation behavior data of the user when the user sends a web page access request information to the front end of the web page application, and identify the potential attack behavior information of the user through an attack detection algorithm based on the operation behavior data and the web page access request information of the user;

[0029] an identification module, used to encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server side of the web application, and identify the attack detection result of the user through the attack detection program of the server side based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user;

[0030] A generation module is used to generate attack protection information of the web application to the user based on the attack detection result, and based on the attack protection information, perform distributed attack protection processing in each browser node corresponding to the web application.

[0031] Optionally, the acquisition module is specifically used to:

[0032] When a user sends a web page access request to the front end of the web page application, a data collection and analysis script is deployed in the front end through a protection data collection program;

[0033] Based on the data collection and analysis script, collect the device configuration information of the client and the operation behavior record information of the user;

[0034] The device configuration information is used as the client fingerprint information of the user, and the operation behavior record information of the user is used as the operation behavior data of the user.

[0035] Optionally, the acquisition module is specifically used to:

[0036] Based on the webpage access request information, querying the access database for a range of normal operation behavior data corresponding to the webpage access request information, and identifying abnormal operation behavior data of the user based on the operation behavior data and the range of normal operation behavior data;

[0037] The abnormal attack behavior type corresponding to the abnormal operation behavior data is identified through the attack detection algorithm, and the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data are used as potential attack behavior information of the user.

[0038] Optionally, the identification module is specifically used to:

[0039] Packaging the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain a current behavior data packet of the user;

[0040] Performing data encryption processing on the current behavior data packet to obtain a current behavior data encryption packet, and querying a currently applicable target transmission channel in each of the transmission channels;

[0041] The current behavior data encrypted package is transmitted to the server side of the web application through the target transmission channel.

[0042] Optionally, the identification module is specifically used to:

[0043] Based on the client fingerprint information, query the client history access information of the user in the client database, and based on the client history access information, identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data;

[0044] Based on the historical attack behavior data corresponding to each of the attack behavior types and the operation behavior data of the user, identifying, through a behavior data similarity identification program, first abnormal operation behavior data in the operation behavior data of the user whose similarity to the historical attack behavior data is greater than a similarity threshold, and using the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the first attack behavior type of the user;

[0045] Based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data are identified through the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are used as the attack detection result of the user.

[0046] Optionally, the generating module is specifically used for:

[0047] For each attack behavior type, query the attack protection strategy corresponding to the attack behavior type in the attack protection database;

[0048] Based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, attack protection operation information of the attack behavior type is generated, and the attack protection operation information of all attack behavior types is used as the attack protection information of the web application to the user.

[0049] In a third aspect, the present application provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods in the first aspect are implemented.

[0050] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0051] In a fifth aspect, the present application provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of any one of the methods in the first aspect are implemented.

[0052] The above-mentioned attack detection method, device and computer equipment of the web application collect the user's client fingerprint information and the user's operation behavior data when the user sends a web page access request information to the front end of the web application, and identify the user's potential attack behavior information through an attack detection algorithm based on the operation behavior data and the user's web page access request information; encrypt and transmit the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to the server side of the web application, and identify the user's attack detection result through the attack detection program on the server side based on the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data; generate the web application's attack protection information on the user based on the attack detection result, and perform distributed attack protection processing on each browser node corresponding to the web application based on the attack protection information. This solution collects the user's fingerprint information and the user's operation behavior data on the user's client, and detects the user's potential attack behavior information in real time, thereby reducing the data collection on the server side and the processing process of potential attack behavior information monitoring. Since the detection is performed on the browser side, the computing burden on the server side is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. In addition, the detection is performed in real time on the browser side, avoiding the delay of the request to and from the server, and improving the timeliness of the detection. When collecting data, this solution collects the user's fingerprint information and the user's behavior data, wherein the client fingerprint and behavior data can significantly improve the accuracy of the detection and help identify complex attack behaviors. Afterwards, when the potential attack behavior information is monitored, the solution encrypts and transmits the above information to the server side for secondary detection. Even when the user is offline or the network is unstable, the browser side can still perform basic attack detection and protection to ensure that security is not affected by the network status. Improve the comprehensiveness and accuracy of the detection of abnormal behavior information of users. In summary, this solution effectively solves the performance bottleneck and real-time problems faced by existing server-side detection technology by realizing data collection and attack detection on the browser side. Combining client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection and other technical means, the security and protection capabilities of Web applications have been significantly improved, thereby comprehensively improving the efficiency of Web attack detection in high-concurrency and low-latency environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 A schematic diagram of a flow chart of a method for detecting attacks on a web application in one embodiment;

[0055] Figure 2 A schematic diagram of a flow chart of an example of attack detection of a web application in an embodiment;

[0056] Figure 3 is a structural block diagram of an attack detection device for a web application in one embodiment;

[0057] Figure 4 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] The attack detection method for web applications provided in the embodiment of the present application can be applied to the application environment of attack detection of web applications. Among them, the method can be applied to a terminal, can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the terminal can be, but is not limited to, various personal computers, laptops, medium-sized computers, etc. Among them, the terminal collects the user's fingerprint information and the user's operation behavior data on the user's client, and detects the user's potential attack behavior information in real time, thereby reducing the data collection on the server side and the processing process of monitoring the potential attack behavior information. Since the detection is performed on the browser side, the calculation burden on the server side is reduced, thereby improving the overall performance of the system, especially in a high concurrency environment. And the detection is performed in real time on the browser side, avoiding the delay of the request to and from the server, and improving the timeliness of the detection. When collecting data, this solution collects the user's fingerprint information and the user's behavior data, wherein the client fingerprint and behavior data can significantly improve the accuracy of the detection and help identify complex attack behaviors. Afterwards, when this solution detects potential attack behavior information, it will encrypt and transmit the above information to the server for secondary detection. Even when the user is offline or the network is unstable, the browser can still perform basic attack detection and protection to ensure that security is not affected by the network status. The comprehensiveness and accuracy of the detection of abnormal user behavior information are improved. In summary, this solution effectively solves the performance bottleneck and real-time problems faced by existing server-side detection technologies by implementing data collection and attack detection on the browser side. Combined with technical means such as client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection, the security and protection capabilities of Web applications have been significantly improved. Thereby comprehensively improving the low efficiency of Web attack detection in high-concurrency and low-latency environments.

[0060] In an exemplary embodiment, Figure 1 As shown, a web application attack detection method is provided, which is described by taking the method applied to a terminal as an example, and includes the following steps S101 to S103. Among them:

[0061] Step S101, when a user sends a web page access request information to the front end of a web application, the user's client fingerprint information and the user's operation behavior data are collected, and based on the operation behavior data and the user's web page access request information, the user's potential attack behavior information is identified through an attack detection algorithm.

[0062] In this embodiment, when a user sends a web page access request information to the browser front end of the web application, the terminal obtains the client address of the user, and loads the WebAssembly file to the browser front end through JavaScript after obtaining the user's authorization. Then, the terminal collects the user's client fingerprint information and operation behavior data through the fingerprint collection module and behavior monitoring module of the browser front end. Among them, the client fingerprint information includes the hardware and software configuration information of the client, such as browser version, operating system, screen resolution, time zone, etc. The operation behavior data includes the user's operation behavior, such as mouse movement, clicks, keyboard input, and generates behavior feature data. Then, the terminal analyzes HTTP requests and user behavior data in real time through the detection algorithm loaded by WebAssembly to detect potential attack behaviors. The specific collection process and analysis process will be described in detail later. Among them, the attack detection algorithm is the detection algorithm loaded by WebAssembly.

[0063] In step S102, the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data are encrypted and transmitted to the server side of the web application, and based on the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data, the user's attack detection result is identified through the attack detection program on the server side.

[0064] In this embodiment, the terminal encrypts and transmits the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to the server of the web application. The encryption method can be but is not limited to any encryption method that can encrypt data packets corresponding to multiple data.

[0065] Then, the terminal identifies the user's attack detection result through the attack detection program on the server side based on the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data. The attack detection result includes each attack behavior type contained in each operation behavior data of the user.

[0066] Step S103, based on the attack detection result, generate attack protection information of the web application to the user, and based on the attack protection information, perform distributed attack protection processing in each browser node corresponding to the web application.

[0067] In this embodiment, the terminal generates attack protection information of the web application on the user based on the attack detection result, and performs distributed attack protection processing in each browser node corresponding to the web application based on the attack protection information. The specific generation process will be described in detail later, and the generated attack protection information includes protection information for attack protection of each attack behavior type.

[0068] Based on the above scheme, by collecting the user's fingerprint information and the user's operation behavior data on the user's client, and detecting the user's potential attack behavior information in real time, the data collection on the server side and the processing process of monitoring the potential attack behavior information are reduced. Since the detection is performed on the browser side, the computing burden on the server side is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. And the detection is performed in real time on the browser side, avoiding the delay of the request to and from the server, and improving the timeliness of the detection. When collecting data, this scheme collects the user's fingerprint information and the user's behavior data, wherein the client fingerprint and behavior data can significantly improve the accuracy of the detection and help identify complex attack behaviors. Afterwards, when the potential attack behavior information is monitored, the scheme encrypts and transmits the above information to the server side for secondary detection. Even when the user is offline or the network is unstable, the browser side can still perform basic attack detection and protection to ensure that security is not affected by the network status. Improve the comprehensiveness and accuracy of the detection of abnormal behavior information of users. In summary, this scheme effectively solves the performance bottleneck and real-time problems faced by existing server-side detection technology by realizing data collection and attack detection on the browser side. Combining client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection and other technical means, the security and protection capabilities of Web applications have been significantly improved, thereby comprehensively improving the efficiency of Web attack detection in high-concurrency and low-latency environments.

[0069] Optionally, when a user sends a web page access request to the front end of a web application, the user's client fingerprint information and the user's operation behavior data are collected, including: when a user sends a web page access request to the front end of a web application, a data collection and analysis script is deployed in the front end through a protection data collection program; based on the data collection and analysis script, the client's device configuration information and the user's operation behavior record information are collected; the device configuration information is used as the user's client fingerprint information, and the user's operation behavior record information is used as the user's operation behavior data.

[0070] In this embodiment, when the user sends a web page access request information to the front end of the web application, the terminal deploys a data collection and analysis script in the browser front end through the protection data collection program. Specifically, when the user accesses the web application, the browser loads and initializes the protection module. The module loads the WebAssembly file into the browser through JavaScript. Fingerprint collection module: collects the hardware and software configuration information of the client, including the browser version, operating system, screen resolution, time zone, etc. Behavior monitoring module: monitors the user's operation behavior, such as mouse movement, clicks, keyboard input, and generates behavior feature data. The collection and analysis script includes collecting the client's device configuration information and the user's operation behavior record information based on the data collection and analysis script. Among them, the device configuration information includes hardware configuration information and software configuration information. Then, the terminal uses the device configuration information as the user's client fingerprint information, and uses the user's operation behavior record information as the user's operation behavior data.

[0071] Based on the above solution, by deploying data collection and analysis scripts on the front end, since the detection is performed on the browser side, the computing burden on the server side is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. In addition, the detection is performed in real time on the browser side, avoiding the delay of requesting round trips to the server and improving the timeliness of the detection. Finally, using WebAssembly technology, the existing efficient detection algorithms implemented in non-JavaScript languages ​​can be migrated to the browser side, reducing development and maintenance costs.

[0072] Optionally, based on the operation behavior data and the user's web page access request information, an attack detection algorithm is used to identify the user's potential attack behavior information, including: based on the web page access request information, querying the access database for a range of regular operation behavior data corresponding to the web page access request information, and identifying the user's abnormal operation behavior data based on the operation behavior data and the range of regular operation behavior data; identifying the abnormal attack behavior type corresponding to the abnormal operation behavior data through an attack detection algorithm, and using the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the user's potential attack behavior information.

[0073] In this embodiment, the terminal queries the access database for the range of normal operation behavior data corresponding to the web page access request information based on the web page access request information, and identifies the abnormal operation behavior data of the user based on the operation behavior data and the range of normal operation behavior data. The abnormal operation behavior data is operation behavior data that does not belong to the range of normal operation behavior data. Then, the terminal identifies the abnormal attack behavior type corresponding to the abnormal operation behavior data through the attack detection algorithm, and uses the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the user's potential attack behavior information.

[0074] Based on the above solution, by first screening abnormal operation behavior data and then identifying the abnormal attack behavior type, the comprehensiveness and efficiency of identifying the user's potential attack behavior information are improved.

[0075] Optionally, the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data are encrypted and transmitted to the server side of the web application, including: packaging the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to obtain the user's current behavior data packet; encrypting the current behavior data packet to obtain a current behavior data encrypted packet, and querying the currently applicable target transmission channel in each transmission channel; transmitting the current behavior data encrypted packet to the server side of the web application through the target transmission channel.

[0076] In this embodiment, the terminal packages the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to obtain the user's current behavior data packet; encrypts the current behavior data packet to obtain a current behavior data encryption packet, and queries the currently applicable target transmission channel in each transmission channel. The target transmission channel can be, but is not limited to, an HTTP / HTTPS channel.

[0077] Finally, the terminal transmits the encrypted package of current behavior data to the server of the web application through the target transmission channel.

[0078] Based on the above solution, after data encryption, suitable channels are screened and then data is transmitted, which improves data transmission efficiency and data transmission security.

[0079] Optionally, based on the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data, the attack detection result of the user is identified through an attack detection program on the server side, including: based on the client fingerprint information, querying the user's client historical access information in the client database, and based on the client historical access information, identifying each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data; based on the historical attack behavior data corresponding to each attack behavior type and the user's operation behavior data, identifying through a behavior data similarity identification program first abnormal operation behavior data in the user's operation behavior data whose similarity with the historical attack behavior data is greater than a similarity threshold, and using the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the user's first attack behavior type; based on each non-first abnormal operation behavior data in the operation behavior data, identifying through an attack detection program on the server side each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data, and using the user's first attack behavior type and the user's second attack behavior type as the user's attack detection result.

[0080] In this embodiment, the terminal queries the user's client historical access information in the client database based on the client fingerprint information, and identifies the client's historical attack behavior data and the attack behavior type corresponding to the historical attack behavior data based on the client's historical access information. The historical access information includes the access record information of the client at each visit, and the access record information includes the historical attack behavior data and attack behavior type obtained after the staff or the server detects the behavior data of each visit. The attack behavior type includes but is not limited to: SQL injection attack, cross-site scripting attack (XSS), cross-site request forgery (CSRF), distributed denial of service attack (DDoS), , , Server-Side Request Forgery (SSRF)‌, And other types.

[0081] Then, based on the historical attack behavior data corresponding to each attack behavior type and the user's operation behavior data, the terminal identifies the first abnormal operation behavior data in the user's operation behavior data whose similarity with the historical attack behavior data is greater than the similarity threshold through the behavior data similarity recognition program, and uses the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the user's first attack behavior type. The data similarity recognition program is a program script preset by the staff on the server side for identifying the data similarity between two behavior data.

[0082] Afterwards, the terminal identifies each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data based on each non-first abnormal operation behavior data in the operation behavior data through the attack detection program on the server side, and uses the user's first attack behavior type and the user's second attack behavior type as the user's attack detection result.

[0083] Based on the above solution, by identifying the first attack behavior type from the historical attack behavior data and re-identifying the second attack behavior type of the user, the comprehensiveness of the identification of the attack behavior type is improved.

[0084] Optionally, based on the attack detection results, attack protection information of the web application for the user is generated, including: for each attack behavior type, querying the attack protection strategy corresponding to the attack behavior type in the attack protection database; based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, generating attack protection operation information of the attack behavior type, and using the attack protection operation information of all attack behavior types as the attack protection information of the web application for the user.

[0085] In this embodiment, the terminal queries the attack protection strategy corresponding to each attack behavior type in the attack protection database. The attack protection database includes the corresponding relationship between each attack behavior type and the attack protection strategy. Each attack protection strategy includes attack protection operation information corresponding to different operation behavior data.

[0086] Then, based on the abnormal operation behavior data corresponding to each attack behavior type, the terminal queries the attack protection operation information of each attack behavior type in the attack protection strategy corresponding to each attack behavior type, and uses the attack protection operation information of all attack behavior types as the attack protection information of the web application to the user.

[0087] Based on the above scheme, the attack protection operation information corresponding to the abnormal operation behavior data of each attack behavior type is identified by means of database query, thereby improving the comprehensiveness and accuracy of the identification of the attack protection operation information.

[0088] This application also provides an example of attack detection for a web application, such as Figure 2 As shown, the specific processing process includes the following steps:

[0089] Step S201, when a user sends a web page access request to the front end of a web page application, a data collection and analysis script is deployed in the front end through a protection data collection program.

[0090] Step S202: Based on the data collection and analysis script, the device configuration information of the client and the user's operation behavior record information are collected.

[0091] Step S203: Use the device configuration information as the user's client fingerprint information, and use the user's operation behavior record information as the user's operation behavior data.

[0092] Step S204, based on the webpage access request information, query the access database for the normal operation behavior data range corresponding to the webpage access request information, and identify the user's abnormal operation behavior data based on the operation behavior data and the normal operation behavior data range.

[0093] Step S205, identifying the abnormal attack behavior type corresponding to the abnormal operation behavior data through an attack detection algorithm, and using the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as potential attack behavior information of the user.

[0094] Step S206 , data packaging is performed on the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to obtain the user's current behavior data packet.

[0095] Step S207, encrypting the current behavior data packet to obtain a current behavior data encryption packet, and querying the currently applicable target transmission channel in each transmission channel.

[0096] Step S208, transmitting the current behavior data encrypted package to the server side of the web application through the target transmission channel.

[0097] Step S209, based on the client fingerprint information, query the user's client historical access information in the client database, and identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data based on the client historical access information.

[0098] Step S210, based on the historical attack behavior data corresponding to each attack behavior type and the user's operation behavior data, a behavior data similarity identification program is used to identify the first abnormal operation behavior data in the user's operation behavior data, whose similarity with the historical attack behavior data is greater than a similarity threshold, and the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data is used as the user's first attack behavior type.

[0099] Step S211, based on each non-first abnormal operation behavior data in the operation behavior data, through the attack detection program on the server side, identify each second abnormal operation behavior data in the operation behavior data, and the second attack behavior type corresponding to each second abnormal operation behavior data, and use the user's first attack behavior type and the user's second attack behavior type as the user's attack detection result.

[0100] Step S212: for each attack behavior type, query the attack protection strategy corresponding to the attack behavior type in the attack protection database.

[0101] Step S213, based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, generate attack protection operation information of the attack behavior type, and use the attack protection operation information of all attack behavior types as the attack protection information of the web application to the user.

[0102] Step S214: Based on the attack protection information, distributed attack protection processing is performed in each browser node corresponding to the web application.

[0103] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiment of the present application also provides a web application attack detection device for implementing the above-mentioned web application attack detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of one or more web application attack detection devices provided below can refer to the limitations of the web application attack detection method above, and will not be repeated here.

[0105] In an exemplary embodiment, Figure 3 As shown, a web application attack detection device is provided, including: a collection module 310, an identification module 320 and a generation module 330, wherein:

[0106] The collection module 310 is used to collect the client fingerprint information of the user and the operation behavior data of the user when the user sends the webpage access request information to the front end of the webpage application, and identify the potential attack behavior information of the user through the attack detection algorithm based on the operation behavior data and the webpage access request information of the user;

[0107] The identification module 320 is used to encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server of the web application, and identify the attack detection result of the user through the attack detection program of the server based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user;

[0108] The generation module 330 is used to generate attack protection information of the web application to the user based on the attack detection result, and perform distributed attack protection processing on each browser node corresponding to the web application based on the attack protection information.

[0109] Optionally, the acquisition module 310 is specifically used for:

[0110] When a user sends a web page access request to the front end of the web page application, a data collection and analysis script is deployed in the front end through a protection data collection program;

[0111] Based on the data collection and analysis script, collect the device configuration information of the client and the operation behavior record information of the user;

[0112] The device configuration information is used as the client fingerprint information of the user, and the operation behavior record information of the user is used as the operation behavior data of the user.

[0113] Optionally, the acquisition module 310 is specifically used for:

[0114] Based on the webpage access request information, querying the access database for a range of normal operation behavior data corresponding to the webpage access request information, and identifying abnormal operation behavior data of the user based on the operation behavior data and the range of normal operation behavior data;

[0115] The abnormal attack behavior type corresponding to the abnormal operation behavior data is identified through the attack detection algorithm, and the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data are used as potential attack behavior information of the user.

[0116] Optionally, the identification module 320 is specifically configured to:

[0117] Packaging the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to obtain the user's current behavior data packet;

[0118] Performing data encryption processing on the current behavior data packet to obtain a current behavior data encryption packet, and querying a currently applicable target transmission channel in each of the transmission channels;

[0119] The current behavior data encrypted package is transmitted to the server side of the web application through the target transmission channel.

[0120] Optionally, the identification module 320 is specifically configured to:

[0121] Based on the client fingerprint information, query the client history access information of the user in the client database, and based on the client history access information, identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data;

[0122] Based on the historical attack behavior data corresponding to each of the attack behavior types and the operation behavior data of the user, identifying, through a behavior data similarity identification program, first abnormal operation behavior data in the operation behavior data of the user whose similarity to the historical attack behavior data is greater than a similarity threshold, and using the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the first attack behavior type of the user;

[0123] Based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data are identified through the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are used as the attack detection result of the user.

[0124] Optionally, the generating module 330 is specifically configured to:

[0125] For each attack behavior type, query the attack protection strategy corresponding to the attack behavior type in the attack protection database;

[0126] Based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, attack protection operation information of the attack behavior type is generated, and the attack protection operation information of all attack behavior types is used as the attack protection information of the web application to the user.

[0127] Each module in the above-mentioned attack detection device for web applications can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0128] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for detecting attacks on a web application is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0129] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0130] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of a method for detecting attacks on a webpage application when executing the computer program.

[0131] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the attack detection method for a web application are implemented.

[0132] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of the attack detection method for a web application when executed by a processor.

[0133] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0134] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0135] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0136] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A web application attack detection method, characterized in that: The method comprises: When a user sends a webpage access request to the front end of a webpage application, the user's client fingerprint information and the user's operation behavior data are collected, and based on the operation behavior data and the user's webpage access request information, the user's potential attack behavior information is identified through an attack detection algorithm; Encrypting and transmitting the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server of the web application, and identifying the attack detection result of the user through the attack detection program of the server based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user; Based on the attack detection result, attack protection information of the webpage application on the user is generated, and based on the attack protection information, distributed attack protection processing is performed on each browser node corresponding to the webpage application.

2. The method according to claim 1, characterized in that When the user sends a webpage access request to the front end of the webpage application, the client fingerprint information of the user and the operation behavior data of the user are collected, including: When a user sends a web page access request to the front end of the web page application, a data collection and analysis script is deployed in the front end through a protection data collection program; Based on the data collection and analysis script, collect the device configuration information of the client and the operation behavior record information of the user; The device configuration information is used as the client fingerprint information of the user, and the operation behavior record information of the user is used as the operation behavior data of the user.

3. The method according to claim 2, characterized in that The identifying the potential attack behavior information of the user through an attack detection algorithm based on the operation behavior data and the webpage access request information of the user includes: Based on the webpage access request information, querying the access database for a range of normal operation behavior data corresponding to the webpage access request information, and identifying abnormal operation behavior data of the user based on the operation behavior data and the range of normal operation behavior data; The abnormal attack behavior type corresponding to the abnormal operation behavior data is identified through the attack detection algorithm, and the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data are used as potential attack behavior information of the user.

4. The method according to claim 1, characterized in that The step of encrypting and transmitting the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to the server of the web application includes: Packaging the user's potential attack behavior information, the user's client fingerprint information, and the user's operation behavior data to obtain the user's current behavior data packet; Performing data encryption processing on the current behavior data packet to obtain a current behavior data encryption packet, and querying a currently applicable target transmission channel in each transmission channel; The current behavior data encrypted package is transmitted to the server side of the web application through the target transmission channel.

5. The method according to claim 1, characterized in that The identifying the attack detection result of the user through the attack detection program on the server side based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user includes: Based on the client fingerprint information, query the client history access information of the user in the client database, and based on the client history access information, identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data; Based on the historical attack behavior data corresponding to each of the attack behavior types and the operation behavior data of the user, identifying, through a behavior data similarity identification program, first abnormal operation behavior data in the operation behavior data of the user whose similarity to the historical attack behavior data is greater than a similarity threshold, and using the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the first attack behavior type of the user; Based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data are identified through the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are used as the attack detection result of the user.

6. The method according to claim 5, characterized in that The generating, based on the attack detection result, attack protection information of the web application on the user includes: For each attack behavior type, query the attack protection strategy corresponding to the attack behavior type in the attack protection database; Based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, attack protection operation information of the attack behavior type is generated, and the attack protection operation information of all attack behavior types is used as the attack protection information of the web application to the user.

7. A web application attack detection device, characterized in that: The device comprises: A collection module, used to collect the client fingerprint information of the user and the operation behavior data of the user when the user sends a web page access request information to the front end of the web page application, and identify the potential attack behavior information of the user through an attack detection algorithm based on the operation behavior data and the web page access request information of the user; an identification module, used to encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server side of the web application, and identify the attack detection result of the user through the attack detection program of the server side based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user; A generation module is used to generate attack protection information of the web application to the user based on the attack detection result, and based on the attack protection information, perform distributed attack protection processing in each browser node corresponding to the web application.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images