Webpage application attack detection method, device and computer equipment

Abstract

The application relates to a webpage application attack detection method, device and computer equipment. The method comprises the following steps: when a user sends webpage access request information to the front end of a webpage application, collecting client fingerprint information and operation behavior data of the user, and identifying potential attack behavior information of the user based on the operation behavior data and the webpage access request information through an attack detection algorithm; encrypting and transmitting the potential attack behavior information, the client fingerprint information and the operation behavior data of the user, and identifying attack detection results of the user through an attack detection program of the server end; generating attack protection information of the webpage application for the user based on the attack detection results, and performing distributed attack protection processing on each browser node corresponding to the webpage application based on the attack protection information. The method can improve the low efficiency of Web attack detection in a high-concurrency and low-latency environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of application security technology, in particular to a web application attack detection method and device and computer equipment. BACKGROUND

[0002] In the field of security protection of modern web applications, web attack detection is a crucial link. Existing web attack detection technologies mainly focus on the server side. Therefore, attack detection on the server side is the main way of current web application attack detection technology. How to improve the accuracy of server-side attack detection is the current research focus.

[0003] The existing web application attack detection method is to detect attacks on the server side through rule-based detection, semantic analysis, and machine learning detection engine, etc. However, in the high-concurrency and low-latency environment, the above technical solutions have a large performance pressure on the server side, and due to the lack of front-end data, the algorithm migration cost is high, thereby reducing the efficiency of web attack detection in high-concurrency and low-latency environments. SUMMARY

[0004] Therefore, it is necessary to provide a web application attack detection method, device, computer equipment, computer readable storage medium and computer program product to solve the above technical problems.

[0005] In a first aspect, the present application provides a web application attack detection method, comprising:

[0006] When a user sends a web access request information to the front end of a web application, collect the user's client fingerprint information and the user's operation behavior data, and based on the operation behavior data and the user's web access request information, identify the user's potential attack behavior information through an attack detection algorithm;

[0007] The user's potential attack behavior information, client fingerprint information, and operation behavior data are encrypted and transmitted to the server side of the web application, and based on the user's potential attack behavior information, client fingerprint information, and operation behavior data, the attack detection result of the user is identified through the attack detection program of the server side;

[0008] Based on the attack detection result, the attack protection information of the web application to the user is generated, and based on the attack protection information, distributed attack protection processing is performed on each browser node corresponding to the web application.

[0009] Optionally, the client fingerprint information of the user and the operation behavior data of the user are collected when the user sends a webpage access request information to a front end of a webpage application, and the collecting comprises:

[0010] The data collection analysis script is deployed in the front end of the webpage application through a protection data collection program when the user sends the webpage access request information to the front end of the webpage application.

[0011] The device configuration information of the client and the operation behavior record information of the user are collected based on the data collection analysis script.

[0012] The device configuration information is taken as the client fingerprint information of the user, and the operation behavior record information of the user is taken as the operation behavior data of the user.

[0013] Optionally, the potential attack behavior information of the user is identified based on the operation behavior data and the webpage access request information of the user by an attack detection algorithm, and the identifying comprises:

[0014] The normal operation behavior data range corresponding to the webpage access request information is queried in an access database based on the webpage access request information, and the abnormal operation behavior data of the user is identified based on the operation behavior data and the normal operation behavior data range.

[0015] The abnormal attack behavior type corresponding to the abnormal operation behavior data is identified by the attack detection algorithm, and the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data are taken as the potential attack behavior information of the user.

[0016] Optionally, the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user are encrypted and transmitted to a server end of the webpage application, and the transmitting comprises:

[0017] The potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user are subjected to data packaging processing to obtain a current behavior data package of the user.

[0018] The current behavior data package is subjected to data encryption processing to obtain a current behavior data encryption package, and a target transmission channel currently applicable is queried in each transmission channel.

[0019] The current behavior data encryption package is transmitted to the server end of the webpage application through the target transmission channel.

[0020] Optionally, the attack detection result of the user is identified based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user by the attack detection program on the server side, and the attack detection result of the user includes:

[0021] Based on the client fingerprint information, the client historical access information of the user is queried in a client database, and based on the client historical access information, each historical attack behavior data of the client and an attack behavior type corresponding to the historical attack behavior data are identified.

[0022] Based on each historical attack behavior data corresponding to the attack behavior type and the operation behavior data of the user, a behavior data similarity identification program is used to identify first abnormal operation behavior data in the operation behavior data of the user, which has a similarity greater than a similarity threshold with the historical attack behavior data, and an attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data is taken as a first attack behavior type of the user.

[0023] Based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data are identified by the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are taken as the attack detection result of the user.

[0024] Optionally, the attack protection information of the web application to the user is generated based on the attack detection result, which includes:

[0025] For each attack behavior type, an attack protection strategy corresponding to the attack behavior type is queried in an attack protection database.

[0026] Based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, attack protection operation information of the attack behavior type is generated, and attack protection operation information of all attack behavior types is taken as the attack protection information of the web application to the user.

[0027] In a second aspect, the application further provides an attack detection device of a web application, which includes:

[0028] The collection module is configured to collect client fingerprint information of a user and operation behavior data of the user when the user sends web access request information to a front end of a web application, and identify potential attack behavior information of the user based on the operation behavior data and the web access request information of the user by an attack detection algorithm.

[0029] an identification module, configured to encrypt and transmit potential attack behavior information of the user, client fingerprint information of the user, and operation behavior data of the user to a server side of the web application, and identify an attack detection result of the user based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user by an attack detection program of the server side;

[0030] a generation module, configured to generate attack protection information of the web application for the user based on the attack detection result, and perform distributed attack protection processing on each browser node corresponding to the web application based on the attack protection information.

[0031] Optionally, the collection module is specifically configured to:

[0032] deploy a data collection and analysis script in the front end by a protection data collection program when the user sends web access request information to the front end of the web application;

[0033] collect device configuration information of the client and operation behavior record information of the user based on the data collection and analysis script;

[0034] use the device configuration information as the client fingerprint information of the user, and use the operation behavior record information of the user as the operation behavior data of the user.

[0035] Optionally, the collection module is specifically configured to:

[0036] query a regular operation behavior data range corresponding to the web access request information in an access database based on the web access request information, and identify abnormal operation behavior data of the user based on the operation behavior data and the regular operation behavior data range;

[0037] identify an abnormal attack behavior type corresponding to the abnormal operation behavior data by the attack detection algorithm, and use the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user.

[0038] Optionally, the identification module is specifically configured to:

[0039] perform data packaging processing on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain a current behavior data packet of the user;

[0040] performing data encryption on the current behavior data package to obtain a current behavior data encrypted package, and in each transmission channel, querying a target transmission channel currently applicable;

[0041] transmitting the current behavior data encrypted package to a server side of the web application through the target transmission channel.

[0042] Optionally, the identification module is specifically used for:

[0043] querying, based on the client fingerprint information, client historical access information of the user in a client database, and identifying, based on the client historical access information, each historical attack behavior data of the client and an attack behavior type corresponding to the historical attack behavior data;

[0044] identifying, based on each historical attack behavior data corresponding to the attack behavior type and the operation behavior data of the user, first abnormal operation behavior data in the operation behavior data of the user and the historical attack behavior data through a behavior data similarity identification program, and taking an attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as a first attack behavior type of the user;

[0045] identifying, based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data through an attack detection program of the server side, and taking the first attack behavior type of the user and the second attack behavior type of the user as an attack detection result of the user.

[0046] Optionally, the generation module is specifically used for:

[0047] querying, for each attack behavior type, an attack protection strategy corresponding to the attack behavior type in an attack protection database;

[0048] generating attack protection operation information of the attack behavior type based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, and taking attack protection operation information of all attack behavior types as attack protection information of the user for the web application.

[0049] In a third aspect, a computer device is provided. The computer device includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, steps of the method in any one of the first aspect are implemented.

[0050] In a fourth aspect, the present application provides a computer readable storage medium. A computer program is stored on the computer readable storage medium, and the computer program, when executed by a processor, implements the steps of the method of any one of the first aspect.

[0051] In a fifth aspect, the present application provides a computer program product. The computer program product comprises a computer program, and the computer program, when executed by a processor, implements the steps of the method of any one of the first aspect.

[0052] The attack detection method, device and computer equipment of the webpage application, by collecting the client fingerprint information of the user and the operation behavior data of the user when the user sends webpage access request information to the front end of the webpage application, and based on the operation behavior data and the webpage access request information of the user, identifying the potential attack behavior information of the user through an attack detection algorithm; the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user are encrypted and transmitted to the server end of the webpage application, and based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user, the attack detection result of the user is identified through the attack detection program of the server end; based on the attack detection result, the attack protection information of the webpage application to the user is generated, and based on the attack protection information, distributed attack protection processing is performed on each browser node corresponding to the webpage application. The scheme, by collecting the fingerprint information of the user and the operation behavior data of the user at the client, and detecting the potential attack behavior information of the user in real time, reduces the data collection and potential attack behavior information monitoring process of the server end, reduces the computing burden of the server end due to the detection in the browser end, and improves the overall performance of the system, especially in a high-concurrency environment. And the detection is carried out in real time in the browser end, avoiding the delay of request to and fro the server, improving the timeliness of detection. And the scheme collects the fingerprint information of the user and the behavior data of the user at the same time, which can significantly improve the accuracy of detection and help identify complex attack behavior. Then, when the potential attack behavior information is monitored, the information is encrypted and transmitted to the server end for secondary detection, so that the browser end can still perform basic attack detection and protection even in the case of user offline or unstable network, ensuring the security is not affected by the network state. Improve the detection comprehensiveness and accuracy of abnormal behavior information of the user. In summary, the scheme realizes data collection and attack detection in the browser end, effectively solving the performance bottleneck and real-time problem of the existing server end detection technology. Combined with client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection technology, the security and protection capability of the Web application are significantly improved. Thus, the efficiency of Web attack detection in a high-concurrency and low-latency environment is improved. BRIEF DESCRIPTION OF DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or the related art description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0054] Figure 1 Flowchart of the attack detection method of the web application in one embodiment;

[0055] Figure 2 Flowchart of the attack detection example of the web application in one embodiment;

[0056] Figure 3 Block diagram of the attack detection device of the web application in one embodiment;

[0057] Figure 4 Internal structure diagram of the computer device in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purposes, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0059] The webpage application attack detection method provided by the embodiments of the present application can be applied to an application environment of webpage application attack detection. The method can be applied to a terminal, a server, or a system including a terminal and a server, and is implemented through interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, notebook computers, medium-sized computers, and the like. The terminal collects fingerprint information of a user and operation behavior data of the user on a client of the user, and detects potential attack behavior information of the user in real time, thereby reducing the processing of data collection and potential attack behavior information monitoring on the server side. Since the detection is performed on the browser side, the computing burden of the server side is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. Moreover, the detection is performed in real time on the browser side, avoiding the delay of request round trip to the server, and improving the timeliness of detection. In the present application, fingerprint information of the user and behavior data of the user are collected, and the client fingerprint and the behavior data can significantly improve the accuracy of detection and help to identify complex attack behavior. When potential attack behavior information is monitored, the information is encrypted and transmitted to the server side for secondary detection. Even in the case of user offline or unstable network, the browser side can still perform basic attack detection and protection, ensuring that the security is not affected by the network state. The detection of abnormal behavior information of the user is improved in comprehensiveness and accuracy. In summary, the present application realizes data collection and attack detection on the browser side, effectively solving the performance bottleneck and real-time problem of the existing server-side detection technology. In combination with the client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection, the security and protection capability of the Web application are significantly improved. The efficiency of Web attack detection in a high-concurrency and low-latency environment is improved.

[0060] In one exemplary embodiment, as shown in Figure 1 A webpage application attack detection method is provided. The method is applied to a terminal, and includes the following steps S101 to S103. In the steps,

[0061] In step S101, when a user sends webpage access request information to a front end of a webpage application, fingerprint information of the user and operation behavior data of the user are collected, and potential attack behavior information of the user is identified based on the operation behavior data and the webpage access request information of the user through an attack detection algorithm.

[0062] In this embodiment, when the terminal sends the webpage access request information in the presence of a user to the browser front end of the webpage application, the terminal obtains the client address of the user, and in the case of obtaining the authorization of the user, loads the WebAssembly file to the browser front end through JavaScript. Then, the terminal collects the client fingerprint information and the operation behavior data of the user through the fingerprint collection module and the behavior monitoring module of the browser front end. The client fingerprint information includes the hardware and software configuration information of the client, such as browser version, operating system, screen resolution, time zone, etc. The operation behavior data includes the operation behavior of the user, such as mouse movement, click, keyboard input, and generates behavior feature data. Then, the terminal analyzes the HTTP request and the user behavior data in real time through the detection algorithm loaded by WebAssembly, and detects the potential attack behavior. The specific collection process and analysis process will be described in detail later. The attack detection algorithm is a detection algorithm loaded by WebAssembly.

[0063] Step S102, the potential attack behavior information of the user, and the client fingerprint information of the user, and the operation behavior data of the user are encrypted and transmitted to the server end of the webpage application, and based on the potential attack behavior information of the user, and the client fingerprint information of the user, and the operation behavior data of the user, the attack detection result of the user is identified through the attack detection program of the server end.

[0064] In this embodiment, the terminal encrypts and transmits the potential attack behavior information of the user, and the client fingerprint information of the user, and the operation behavior data of the user to the server end of the webpage application. The encryption method can be, but is not limited to, any encryption method that can encrypt data packets corresponding to multiple data.

[0065] Then, the terminal identifies the attack detection result of the user based on the potential attack behavior information of the user, and the client fingerprint information of the user, and the operation behavior data of the user through the attack detection program of the server end. The attack detection result includes each attack behavior type contained in each operation behavior data of the user.

[0066] Step S103, based on the attack detection result, the attack protection information of the webpage application to the user is generated, and based on the attack protection information, distributed attack protection processing is performed on each browser node corresponding to the webpage application.

[0067] In this embodiment, the terminal generates the attack protection information of the webpage application to the user based on the attack detection result, and performs distributed attack protection processing on each browser node corresponding to the webpage application based on the attack protection information. The specific generation process will be described in detail later, and the generated attack protection information includes protection information for protecting each attack behavior type.

[0068] Based on the above scheme, by collecting the user's fingerprint information and the user's operation behavior data on the user's client, and detecting the user's potential attack behavior information in real time, the data collection and potential attack behavior information monitoring process of the server side is reduced. Since the detection is performed on the browser side, the computational burden of the server side is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. And the detection is performed in real time on the browser side, avoiding the delay of request to and fro the server, improving the timeliness of detection. And the present scheme collects data, that is, collects the user's fingerprint information and the user's behavior data. Among them, the client fingerprint and behavior data can significantly improve the accuracy of detection, helping to identify complex attack behavior. Then, when the potential attack behavior information is monitored, the above information is transmitted to the server side for secondary detection, even in the case of user offline or unstable network, the browser side can still perform basic attack detection and protection, ensuring the security is not affected by the network state. Improve the detection comprehensiveness and accuracy of abnormal behavior information of users. In summary, the present scheme realizes data collection and attack detection on the browser side, effectively solving the performance bottleneck and real-time problem of the existing server-side detection technology. Combined with client fingerprint collection, user behavior data collection, encrypted data transmission, front-end caching and offline protection, and distributed collaborative detection and other technical means, the security and protection capability of the Web application are significantly improved. Thus, the efficiency of Web attack detection in a high-concurrency and low-latency environment is improved.

[0069] Optionally, when the user sends a web access request information to the front end of the web application, the client fingerprint information of the user and the operation behavior data of the user are collected, including: when the user sends a web access request information to the front end of the web application, deploying a data collection and analysis script in the front end through a protection data collection program; based on the data collection and analysis script, collecting device configuration information of the client and operation behavior record information of the user; the device configuration information is used as the client fingerprint information of the user, and the operation behavior record information of the user is used as the operation behavior data of the user.

[0070] In this embodiment, when the terminal sends the webpage access request information to the front end of the webpage application, the data collection and analysis script is deployed in the browser front end through the protection data collection program. Specifically, when the user accesses the Web application, the browser loads and initializes the protection module. The module loads the WebAssembly file into the browser through JavaScript. The fingerprint collection module: collects the hardware and software configuration information of the client, including browser version, operating system, screen resolution, time zone, etc. The behavior monitoring module: monitors the user's operation behavior, such as mouse movement, click, keyboard input, and generates behavior feature data. The collection and analysis script includes collecting device configuration information of the client and operation behavior record information of the user based on the data collection and analysis script. Among them, the device configuration information includes hardware configuration information and software configuration information. Then, the terminal takes the device configuration information as the client fingerprint information of the user, and takes the operation behavior record information of the user as the operation behavior data of the user.

[0071] Based on the above scheme, by deploying the data collection and analysis script in the front end, since the detection is performed in the browser end, the computational burden of the server end is reduced, thereby improving the overall performance of the system, especially in a high-concurrency environment. Moreover, the detection is performed in real time in the browser end, avoiding the delay of request to and fro the server, and improving the timeliness of detection. Finally, using the WebAssembly technology can migrate the existing efficient detection algorithms implemented in non-JavaScript languages to the browser end, reducing the development and maintenance costs.

[0072] Optionally, based on the operation behavior data and the webpage access request information of the user, the potential attack behavior information of the user is identified through the attack detection algorithm, including: based on the webpage access request information, querying the regular operation behavior data range corresponding to the webpage access request information in the access database, and based on the operation behavior data and the regular operation behavior data range, identifying the abnormal operation behavior data of the user; through the attack detection algorithm, identifying the abnormal attack behavior type corresponding to the abnormal operation behavior data, and taking the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user.

[0073] In this embodiment, the terminal queries the range of regular operation behavior data corresponding to the webpage access request information in the access database based on the webpage access request information, and identifies the abnormal operation behavior data of the user based on the operation behavior data and the range of regular operation behavior data. The abnormal operation behavior data is operation behavior data that does not belong to the range of regular operation behavior data. Then, the terminal identifies the abnormal attack behavior type corresponding to the abnormal operation behavior data through an attack detection algorithm, and takes the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user.

[0074] Based on the above scheme, by first screening abnormal operation behavior data and then identifying abnormal attack behavior types, the comprehensiveness and efficiency of identifying the potential attack behavior information of the user are improved.

[0075] Optionally, the potential attack behavior information of the user, and the client fingerprint information of the user and the operation behavior data of the user are encrypted and transmitted to the server side of the webpage application, including: performing data packaging processing on the potential attack behavior information of the user, and the client fingerprint information of the user and the operation behavior data of the user to obtain a current behavior data package of the user; performing data encryption processing on the current behavior data package to obtain a current behavior data encryption package, and querying a target transmission channel currently applicable in each transmission channel; and transmitting the current behavior data encryption package to the server side of the webpage application through the target transmission channel.

[0076] In this embodiment, the terminal performs data packaging processing on the potential attack behavior information of the user, and the client fingerprint information of the user and the operation behavior data of the user to obtain a current behavior data package of the user; performs data encryption processing on the current behavior data package to obtain a current behavior data encryption package, and queries a target transmission channel currently applicable in each transmission channel. The target transmission channel can be, but is not limited to, an HTTP / HTTPS channel.

[0077] Finally, the terminal transmits the current behavior data encryption package to the server side of the webpage application through the target transmission channel.

[0078] Based on the above scheme, by performing applicable channel screening after data encryption and then performing data transmission, the data transmission efficiency and data transmission security are improved.

[0079] Optionally, based on the potential attack behavior information of the user, and the client fingerprint information of the user, and the operation behavior data of the user, the attack detection result of the user is identified through the attack detection program on the server side, including: based on the client fingerprint information, the client historical access information of the user is queried in the client database, and based on the client historical access information, each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data are identified; based on each historical attack behavior data corresponding to the attack behavior type and the operation behavior data of the user, the similarity between the operation behavior data of the user and the historical attack behavior data is identified through the behavior data similarity identification program, and the first abnormal operation behavior data with a similarity greater than a similarity threshold is identified in the operation behavior data of the user, and the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data is taken as the first attack behavior type of the user; based on each non-first abnormal operation behavior data in the operation behavior data, each second abnormal operation behavior data in the operation behavior data and the second attack behavior type corresponding to each second abnormal operation behavior data are identified through the attack detection program on the server side, and the first attack behavior type of the user and the second attack behavior type of the user are taken as the attack detection result of the user.

[0080] In this embodiment, the terminal queries the client historical access information of the user in the client database based on the client fingerprint information, and identifies each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data based on the client historical access information. The historical access information includes access record information of the client at each access, and the access record information includes each historical attack behavior data and attack behavior type obtained by detecting the behavior data of each access by the staff or the server side. The attack behavior type includes but is not limited to: SQL injection attack, cross-site scripting (XSS), cross-site request forgery (CSRF), distributed denial of service attack (DDoS), 、 server-side request forgery (SSRF), and the like.

[0081] Then, the terminal identifies the first abnormal operation behavior data with a similarity greater than a similarity threshold in the operation behavior data of the user through the behavior data similarity identification program based on each historical attack behavior data corresponding to the attack behavior type and the operation behavior data of the user, and takes the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as the first attack behavior type of the user. The data similarity identification program is a program script preset on the server side by the staff for identifying the data similarity between two behavior data.

[0082] Then, the terminal identifies each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data based on each non-first abnormal operation behavior data in the operation behavior data through the server-side attack detection program, and takes the first attack behavior type of the user and the second attack behavior type of the user as an attack detection result of the user.

[0083] Based on the above scheme, by identifying the first attack behavior type from the historical attack behavior data and re-identifying the second attack behavior type of the user, the comprehensiveness of identifying the attack behavior type is improved.

[0084] Optionally, based on the attack detection result, attack protection information of the web application to the user is generated, including: for each attack behavior type, querying an attack protection strategy corresponding to the attack behavior type in an attack protection database; based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, generating attack protection operation information of the attack behavior type, and taking all attack protection operation information of all attack behavior types as the attack protection information of the web application to the user.

[0085] In this embodiment, the terminal queries an attack protection strategy corresponding to each attack behavior type in the attack protection database. The attack protection database includes a corresponding relationship between each attack behavior type and the attack protection strategy. Each attack protection strategy includes attack protection operation information corresponding to different operation behavior data.

[0086] Then, the terminal queries attack protection operation information of each attack behavior type in the attack protection strategy corresponding to each attack behavior type based on abnormal operation behavior data corresponding to each attack behavior type, and takes all attack protection operation information of all attack behavior types as attack protection information of the web application to the user.

[0087] Based on the above scheme, by querying each attack behavior type through the database, attack protection operation information corresponding to abnormal operation behavior data of each attack behavior type is identified, and the comprehensiveness and accuracy of identifying the attack protection operation information are improved.

[0088] The application also provides an attack detection example of a web application, as shown in Figure 2 The specific processing process includes the following steps:

[0089] Step S201, when the user sends web access request information to the front end of the web application, a data collection and analysis script is deployed in the front end through a protection data collection program.

[0090] Step S202, based on the data collection analysis script, collect the device configuration information of the client and the operation behavior record information of the user.

[0091] Step S203, take the device configuration information as the client fingerprint information of the user, and take the operation behavior record information of the user as the operation behavior data of the user.

[0092] Step S204, based on the web access request information, query the normal operation behavior data range corresponding to the web access request information in the access database, and identify the abnormal operation behavior data of the user based on the operation behavior data and the normal operation behavior data range.

[0093] Step S205, identify the abnormal attack behavior type corresponding to the abnormal operation behavior data through the attack detection algorithm, and take the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user.

[0094] Step S206, perform data packaging processing on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain the current behavior data package of the user.

[0095] Step S207, perform data encryption processing on the current behavior data package to obtain the current behavior data encryption package, and query the target transmission channel currently applicable in each transmission channel.

[0096] Step S208, transmit the current behavior data encryption package to the server side of the web application through the target transmission channel.

[0097] Step S209, based on the client fingerprint information, query the client historical access information of the user in the client database, and based on the client historical access information, identify each historical attack behavior data of the client and the attack behavior type corresponding to the historical attack behavior data.

[0098] Step S210, based on the historical attack behavior data corresponding to each attack behavior type and the operation behavior data of the user, identify the first abnormal operation behavior data in the operation behavior data of the user through the behavior data similarity identification program, and the similarity between the historical attack behavior data and the operation behavior data is greater than the similarity threshold, and the attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data is taken as the first attack behavior type of the user.

[0099] Step S211, based on each non-first abnormal operation behavior data in the operation behavior data, identifying each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data by the attack detection program on the server side, and taking the first attack behavior type of the user and the second attack behavior type of the user as the attack detection result of the user.

[0100] Step S212, for each attack behavior type, querying the attack protection strategy corresponding to the attack behavior type in the attack protection database.

[0101] Step S213, based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, generating attack protection operation information of the attack behavior type, and taking the attack protection operation information of all attack behavior types as the attack protection information of the web application to the user.

[0102] Step S214, based on the attack protection information, performing distributed attack protection processing on each browser node corresponding to the web application.

[0103] It should be understood that, although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise stated herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps.

[0104] Based on the same inventive concept, the embodiments of the present application also provide an attack detection device of a web application for implementing the attack detection method of the web application as described above. The problem-solving implementation scheme provided by the device is similar to the implementation scheme described in the above method, so the specific limitations in one or more attack detection device embodiments of the web application provided below can refer to the limitations of the attack detection method of the web application in the above text, and will not be repeated here.

[0105] In one exemplary embodiment, as shown in Figure 3 a web application attack detection device is provided, comprising: a collection module 310, an identification module 320 and a generation module 330, wherein:

[0106] The collection module 310 is configured to collect client fingerprint information of a user and operation behavior data of the user when the user sends web access request information to a front end of a web application, and identify potential attack behavior information of the user by using an attack detection algorithm based on the operation behavior data and the web access request information of the user.

[0107] The identification module 320 is configured to encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to a server end of the web application, and identify an attack detection result of the user by using an attack detection program of the server end based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user.

[0108] The generation module 330 is configured to generate attack protection information of the web application for the user based on the attack detection result, and perform distributed attack protection processing on each browser node corresponding to the web application based on the attack protection information.

[0109] Optionally, the collection module 310 is specifically configured to:

[0110] deploy a data collection and analysis script in the front end by using a protection data collection program when the user sends the web access request information to the front end of the web application.

[0111] collect device configuration information of the client and operation behavior record information of the user based on the data collection and analysis script.

[0112] use the device configuration information as the client fingerprint information of the user, and use the operation behavior record information of the user as the operation behavior data of the user.

[0113] Optionally, the collection module 310 is specifically configured to:

[0114] query a regular operation behavior data range corresponding to the web access request information in an access database based on the web access request information, and identify abnormal operation behavior data of the user based on the operation behavior data and the regular operation behavior data range.

[0115] identify an abnormal attack behavior type corresponding to the abnormal operation behavior data by using the attack detection algorithm, and use the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user.

[0116] Optionally, the identification module 320 is specifically configured to:

[0117] packaging the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain current behavior data package of the user;

[0118] encrypting the current behavior data package to obtain current behavior data encryption package, and querying a target transmission channel currently applicable in each transmission channel;

[0119] transmitting the current behavior data encryption package to the server side of the web application through the target transmission channel.

[0120] Optionally, the identification module 320 is specifically configured to:

[0121] querying client historical access information of the user in a client database based on the client fingerprint information, and identifying historical attack behavior data of the client and an attack behavior type corresponding to the historical attack behavior data based on the client historical access information;

[0122] identifying first abnormal operation behavior data in the operation behavior data of the user and having a similarity greater than a similarity threshold value with the historical attack behavior data based on the historical attack behavior data corresponding to each attack behavior type and the operation behavior data of the user through a behavior data similarity identification program, and taking an attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as a first attack behavior type of the user;

[0123] identifying each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data based on each non-first abnormal operation behavior data in the operation behavior data through an attack detection program of the server side, and taking the first attack behavior type of the user and the second attack behavior type of the user as an attack detection result of the user.

[0124] Optionally, the generation module 330 is specifically configured to:

[0125] querying an attack protection strategy corresponding to each attack behavior type in an attack protection database;

[0126] generating attack protection operation information of the attack behavior type based on the abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, and taking attack protection operation information of all attack behavior types as attack protection information of the user for the web application.

[0127] Each module in the attack detection apparatus of the webpage application can be implemented by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in hardware form, or stored in a memory in a computer device in software form, so as to be called and executed by a processor to perform operations corresponding to each module.

[0128] In an exemplary embodiment, a computer device, which can be a terminal, has an internal structure diagram as shown in Figure 4 The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. The processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is configured to exchange information between the processor and external devices. The communication interface of the computer device is configured to perform wired or wireless communication with external terminals. The wireless communication can be achieved through WIFI, mobile cellular network, NFC (Near Field Communication), or other technologies. The computer program is executed by the processor to implement an attack detection method for a webpage application. The display unit of the computer device is configured to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer overlaid on the display screen, or a key, trackball, or touchpad arranged on the housing of the computer device, or an external keyboard, touchpad, or mouse, etc.

[0129] Those skilled in the art can understand that Figure 4 The structure shown in the above description is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the diagram, or combine certain components, or have a different arrangement of components.

[0130] In an exemplary embodiment, a computer device is provided, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the attack detection method for a webpage application.

[0131] In one embodiment, a computer readable storage medium is provided, and a computer program is stored on the computer readable storage medium, and the computer program is executed by a processor to implement the steps of the attack detection method of the web application.

[0132] In one embodiment, a computer program product is provided, and the computer program product comprises a computer program, and the computer program is executed by a processor to implement the steps of the attack detection method of the web application.

[0133] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with the relevant provisions.

[0134] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0135] Any combination of the technical features of the above embodiments can be made. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the present application.

[0136] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of protection of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A method for detecting attacks on a web application, characterized in that, The method comprises: When a user sends a webpage access request information to the front end of a webpage application, collect the client fingerprint information of the user and the operation behavior data of the user; Based on the webpage access request information, query the corresponding normal operation behavior data range in the access database, and identify the abnormal operation behavior data of the user based on the operation behavior data and the normal operation behavior data range; Identify the abnormal attack behavior type corresponding to the abnormal operation behavior data through the attack detection algorithm, and take the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as the potential attack behavior information of the user; Encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server end of the webpage application, and identify the attack detection result of the user through the attack detection program of the server end based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user; Based on the attack detection result, generate the attack protection information of the webpage application to the user, and perform distributed attack protection processing on each browser node corresponding to the webpage application based on the attack protection information.

2. The method of claim 1, wherein, When a user sends a webpage access request information to the front end of a webpage application, collect the client fingerprint information of the user and the operation behavior data of the user, comprising: When a user sends a webpage access request information to the front end of a webpage application, deploy a data collection and analysis script in the front end through a protection data collection program; Collect the device configuration information of the client and the operation behavior record information of the user based on the data collection and analysis script; Take the device configuration information as the client fingerprint information of the user, and take the operation behavior record information of the user as the operation behavior data of the user.

3. The method of claim 1, wherein, Encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to the server end of the webpage application, comprising: Data packaging processing is performed on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to obtain the current behavior data packet of the user; Data encryption processing is performed on the current behavior data packet to obtain a current behavior data encryption packet, and a target transmission channel currently applicable is queried in each transmission channel; The current behavior data encryption packet is transmitted to the server end of the webpage application through the target transmission channel.

4. The method of claim 1, wherein, Based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user, the attack detection result of the user is identified through the attack detection program of the server end, comprising: query, in a client database, client historical access information of the user based on the client fingerprint information, and identify historical attack behavior data of the client and an attack behavior type corresponding to the historical attack behavior data based on the client historical access information; identify, by a behavior data similarity identification program, first abnormal operation behavior data in operation behavior data of the user, based on the historical attack behavior data corresponding to each attack behavior type and the operation behavior data of the user, and the similarity between the historical attack behavior data and the operation behavior data of the user is greater than a similarity threshold, and take an attack behavior type of the historical attack behavior data corresponding to the first abnormal operation behavior data as a first attack behavior type of the user; identify, by an attack detection program of the server side, each second abnormal operation behavior data in the operation behavior data and a second attack behavior type corresponding to each second abnormal operation behavior data based on each non-first abnormal operation behavior data in the operation behavior data, and take the first attack behavior type of the user and the second attack behavior type of the user as an attack detection result of the user.

5. The method of claim 4, wherein, The attack detection result is used to generate attack protection information of the web application for the user, which includes: query, in an attack protection database, an attack protection strategy corresponding to each attack behavior type; generate attack protection operation information of each attack behavior type based on abnormal operation behavior data corresponding to the attack behavior type and the attack protection strategy corresponding to the attack behavior type, and take attack protection operation information of all attack behavior types as attack protection information of the web application for the user.

6. An attack detection apparatus for a web application, characterized by comprising: The device includes: The acquisition module is configured to acquire client fingerprint information of a user and operation behavior data of the user when the user sends web access request information to a front end of a web application, query, in an access database, a normal operation behavior data range corresponding to the web access request information based on the web access request information, identify abnormal operation behavior data of the user based on the operation behavior data and the normal operation behavior data range, identify an abnormal attack behavior type corresponding to the abnormal operation behavior data by using the attack detection algorithm, and take the abnormal operation behavior data and the abnormal attack behavior type corresponding to the abnormal operation behavior data as potential attack behavior information of the user; The identification module is configured to encrypt and transmit the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user to a server side of the web application, and identify an attack detection result of the user by using an attack detection program of the server side based on the potential attack behavior information of the user, the client fingerprint information of the user, and the operation behavior data of the user. The generating module is configured to generate attack protection information of the web application to the user based on the attack detection result, and perform distributed attack protection processing on each browser node corresponding to the web application based on the attack protection information.

7. The apparatus of claim 6, wherein, The collecting module is specifically configured to: when a user sends web access request information to a front end of a web application, deploy a data collection and analysis script in the front end through a protection data collection program; collect device configuration information of the client and operation behavior record information of the user based on the data collection and analysis script; use the device configuration information as client fingerprint information of the user, and use the operation behavior record information of the user as operation behavior data of the user.

8. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the steps of the method in any one of claims 1 to 5.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 5.

Images