A decoding method, electronic device and storage medium

Abstract

The embodiment of the present application relates to the field of network security communication technology, and discloses a decoding method, electronic device and storage medium. The method includes: obtaining coded data; determining the first decoding method and / or the second decoding method involved in the coded data by matching the preset coding features; the first decoding method is Base64 decoding; when the same part of the coded data involves both the first decoding method and the second decoding method, decoding the corresponding parts of the coded data respectively based on the second decoding method, and / or, when at least part of the coded data only involves the first decoding method, decoding attempts are made based on the first decoding method; updating the decoded data to the coded data, and returning to execute the step of determining the first decoding method and / or the second decoding method involved in the coded data until the match fails and / or the first decoding method is matched only for the target number of consecutive times. At least it is beneficial to improve the success rate and accuracy of decoding.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security communication technology, and in particular to a decoding method, an electronic device, and a storage medium. Background Art

[0002] With the rapid development of the Internet and mobile Internet, various network security scenarios emerge in an endless stream. In order to ensure network security, one of the commonly used strategies is to encode the request and / or response at the sender and decode it at the receiver, so as to securely transmit the request and / or response through encoding and decoding.

[0003] However, the current decoding method is prone to decoding failure, and even if the decoding is successful, the decoding accuracy is not high. Summary of the invention

[0004] The embodiments of the present application provide a decoding method, an electronic device, and a storage medium, which are at least helpful in improving the success rate and accuracy of decoding.

[0005] According to some embodiments of the present application, a first aspect of the embodiments of the present application provides a decoding method, including: obtaining encoded data; determining a first decoding method and / or a second decoding method involved in the encoded data by matching preset encoding features; wherein the first decoding method is Base64 decoding, and the second decoding method includes at least one decoding method other than Base64 decoding; when the same part of the encoded data involves both the first decoding method and the second decoding method, decoding the corresponding parts of the encoded data respectively based on the second decoding method, and / or, when at least part of the encoded data only involves the first decoding method, performing a decoding attempt based on the first decoding method; updating the decoded data to the encoded data, and returning to execute the step of determining the first decoding method and / or the second decoding method involved in the encoded data by matching preset encoding features, until the match fails and / or only the first decoding method is matched for the consecutive target number of times.

[0006] According to some embodiments of the present application, the second aspect of the embodiments of the present application also provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the decoding method as described in any embodiment of the present application.

[0007] According to some embodiments of the present application, a third aspect of the embodiments of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the decoding method as described in any embodiment of the present application.

[0008] The technical solution provided in the embodiment of the present application has at least the following advantages:

[0009] By cyclically matching coding features and performing corresponding decoding based on the decoding methods corresponding to the matched coding features, nested decoding of the coded data is achieved, and the decoding of each layer supports corresponding decoding of multiple decoding methods. In particular, the decoding method corresponding to the Base64 coding method, which has weaker coding features and is easy to identify errors, is processed independently from other decoding methods. At the same time, based on the weaker coding features of the Base64 coding method, when both the Base64 decoding method and other decoding methods are involved, other decoding methods are used for decoding, thereby avoiding the interference of the Base64 coding on other coding methods. In addition, when only the Base64 decoding method is involved, a decoding attempt is made, and the decoding can be fully completed. In particular, in the process of cyclic decoding, by setting the continuous target number of times to trigger the stop of the loop only when the first decoding method is matched, it can also avoid continuing to repeat the erroneous Base64 decoding, so that the coded data with multiple codings, nested codings, mixed codings and their fusions can be fully and correctly decoded, thereby improving the success rate and accuracy of decoding. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0011] Figure 1 This is the process of the decoding method provided in the embodiment of the present application Figure 1 ;

[0012] Figure 2 This is the process of the decoding method provided in the embodiment of the present application Figure 2 ;

[0013] Figure 3 This is the process of the decoding method provided in the embodiment of the present application Figure 3 ;

[0014] Figure 4 This is the process of the decoding method provided in the embodiment of the present application Figure 4 ;

[0015] Figure 5 It is a schematic diagram of an application scenario of the decoding method provided in an embodiment of the present application;

[0016] Figure 6 It is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] As can be seen from the background technology, the current decoding method has the problems of low decoding success rate and low accuracy rate.

[0018] After analysis, it is found that the reason for the above problems is at least that: with the improvement of various attack and defense means, the structure and encoding methods of the Hypertext Transfer Protocol (HTTP) request and other messages have become more and more diverse and complicated. For example, there is the possibility of multiple encodings, that is, in some complex security scenarios, HTTP request messages may be encoded multiple times, that is, the same encoding type is repeatedly applied. However, the existing decoding technology can usually only handle a single level of encoding, and it is difficult to effectively deal with the scenario of multiple encodings, resulting in decoding failure and affecting the content detection of the original content. For example, in some security applications, data may be encoded with Uniform Resource Locator (URL) multiple times. When dealing with this situation, the existing conventional website application-level intrusion prevention system (WAF) or other security modules often only decode one or two layers and cannot decode the real original content. For another example, there is the possibility of nested encoding, that is, there may be superposition and nesting of different types of encodings in the HTTP request message, that is, some fields themselves contain data encoded in different ways. However, the existing decoding technology is usually unable to automatically identify and process such nested structures, resulting in a complex decoding process and a high error rate. For example, in some security scenarios, the Base64-encoded data will be nested with a layer of Unicode encoding, and then URL encoding will be performed, which further increases the difficulty of decoding. For another example, there is the possibility of mixed encoding, that is, in some cases, the content may be segmented and encoded using different encoding methods. However, existing decoding technologies often require feature search and processing for each encoding method separately, which is inefficient and not easy to decode completely. For example, some security scenarios may use URL encoding, Base64 encoding, and Unicode encoding for a certain application programming interface (Application Programming Interface, API) at the same time, and it is difficult for existing decoders to automatically identify and process these mixed encoding methods. For another example, there is the possibility of fusion encoding, that is, in some security vulnerability scenarios, if the first three encoding strategies are used to fuse the HTTP request message, it will make it difficult for some existing general decoding technologies to fully handle it. For example, some attack and defense enthusiasts may fuse multiple encoding methods together, resulting in the inability of existing WAF-type decoding technology to correctly parse the decoded message content, thereby affecting the engine's detection of the message content. That is to say, in the existing web page security protection, HTTP request decoding technology has significant deficiencies due to its single decoding process when facing multiple, nested, mixed and fused encoding scenarios, and it is difficult to meet the needs of some current special security detection scenarios.

[0019] Based on this, the embodiments of the present application provide a decoding method, an electronic device and a storage medium. By cyclically matching coding features and performing corresponding decoding, even if the encoded data adopts multiple, nested, mixed and fused encodings, it is possible to fully and completely identify the encoding methods that may be used for the encoded data and perform corresponding decoding to obtain correct results. There will be no decoding failure, and no repeated erroneous Base64 decoding due to being trapped in the encoding features of Base64.

[0020] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. However, it will be appreciated by those skilled in the art that in the embodiments of the present application, many technical details are provided in order to enable the reader to better understand the present application. However, even without these technical details and various changes and modifications based on the following embodiments, the technical scheme claimed in the present application can be implemented.

[0021] The division of the following embodiments is for the convenience of description and shall not constitute any limitation on the specific implementation of the present application. The embodiments may be combined with each other and referenced to each other without contradiction.

[0022] The present application embodiment provides a decoding method, which is applicable to any electronic device with computing and processing capabilities, such as a server, a security device, etc., which will not be listed here one by one. Figures 1 to 4 The flowchart shown is used for explanation.

[0023] In some embodiments, Figure 1 As shown, the decoding method process includes the following steps:

[0024] Step 101, obtaining encoded data.

[0025] Step 102, by matching preset coding features, determine the first decoding method and / or the second decoding method involved in the coded data; wherein the first decoding method is Base64 decoding, and the second decoding method includes at least one decoding method other than Base64 decoding.

[0026] Step 103, when the same part of the encoded data involves both the first decoding method and the second decoding method, the corresponding parts of the encoded data are decoded based on the second decoding method, and / or, when at least part of the encoded data only involves the first decoding method, a decoding attempt is made based on the first decoding method.

[0027] Step 104, updates the decoded data to the encoded data, and returns to execute the step of determining the first decoding method and / or the second decoding method involved in the encoded data by matching the preset encoding features, until the match fails and / or only the first decoding method is matched for the consecutive target number of times.

[0028] In this way, nested decoding of the encoded data is achieved by cyclically matching the encoding features and performing corresponding decoding based on the decoding methods corresponding to the matched encoding features, and the decoding of each layer supports corresponding decoding of multiple decoding methods. In particular, the decoding method corresponding to the Base64 encoding, which has weaker encoding features and is prone to identification errors, is processed independently of other encoding methods. At the same time, based on the weaker encoding features of the Base64 encoding, when both the Base64 decoding method and other decoding methods are involved, other decoding methods are used for decoding, thereby avoiding the interference of the Base64 encoding on other encodings. In addition, when only the Base64 decoding method is involved, a decoding attempt is made, and the decoding can be fully completed. In particular, in the process of cyclic decoding, by setting the continuous target number of times to trigger the stop of the loop only when the first decoding method is matched, it is also possible to avoid continuing to repeat the erroneous Base64 decoding, so that the encoded data with multiple encodings, nested encodings, mixed encodings and their fusions can be fully and correctly decoded, thereby improving the success rate and accuracy of the decoding.

[0029] To facilitate better understanding of those skilled in the art Figure 1 The embodiment shown, the steps of which will be explained below.

[0030] In step 101, the coded data is obtained. Among them, the embodiment of the present application does not limit the source of the coded data, and the coded data can be any data obtained by using the coding process. For example, the coded data can be the data of the request body in the encoded request. In another example, the coded data can also be the encoded response data. In another example, the coded data can also be the encoded data transmitted by an offline method (such as a USB flash drive). Correspondingly, for different source methods, the corresponding method of obtaining the coded data is also different. For example, for the coded data in the request body, it is obtained by parsing the request. In another example, for the coded data in the response data, it is obtained by parsing the response data packet. In another example, the coded data transmitted offline is obtained by reading data in a specified storage space. Of course, the above are only examples provided for coded data and their acquisition. In other embodiments, there are other possibilities, which are not listed here one by one.

[0031] In step 102, by matching the preset coding features, the first decoding method and / or the second decoding method involved in the coded data are determined. Among them, the embodiment of the present application does not limit the preset coding features, which can be features that can reflect the coding method used by the current data determined based on manual experience, historical coding and decoding data, etc., such as % characters, & characters, etc. For example, most of the coding and decoding-related vulnerability scenarios on the current network are collected, including Common Vulnerabilities and Exposures (CVE) security vulnerabilities, various blog sites, github projects, and various bypass problems sorted out in combination with related operations, and the coding methods used are summarized, and coding experiments are carried out to obtain corresponding coding features, etc.

[0032] Furthermore, the embodiments of the present application do not limit the decoding methods involved in the coded data that can be determined, and may include any one or more decoding methods, such as Base64 decoding, Unicode decoding, HyperText Markup Language (HTML) decoding, etc., which are mainly determined by the preset coding features. When the preset coding features include the features of the data encoded by a certain coding method, it can be determined whether the coded data involves the decoding method corresponding to the coding method. At the same time, the embodiments of the present application do not limit the number of decoding methods that can be determined by a single match. For example, in the case where the coded data adopts a hybrid coding scheme, it can be determined that the coded data involves multiple decoding methods. Among them, the direct correspondence between the coding feature and the decoding method refers to the decoding method corresponding to a certain coding feature and the coding method that generates the coding feature.

[0033] It should be noted that what is emphasized in the embodiment of the present application is that Base64 decoding and other decoding methods are regarded as two independent parts, i.e., the first decoding method and the second decoding method. This is mainly to take into account that the coding feature of Base64 encoding is relatively weak, and it is easy to misidentify uncoded data (or data encoded by other encoding methods) as having been Base64 encoded, and it is especially possible that the coded data is constantly matched as having been Base64 encoded during the process of cyclic decoding, involving Base64 decoding, thereby causing invalid decoding (even being called erroneous decoding) to occur repeatedly. At this point, Base64 decoding and other decoding methods are separated and processed, so that Base64 decoding has less interference in matching other decoding methods, so that the identification of the decoding method is more accurate, so as to perform more accurate decoding, avoid decoding failure or decoding error, and further improve the decoding success rate and accuracy.

[0034] In step 103, when the same part of the coded data involves both the first decoding method and the second decoding method, the corresponding parts of the coded data are decoded based on the second decoding method, and / or, when at least part of the coded data only involves the first decoding method, a decoding attempt is made based on the first decoding method. It can be understood that, considering different coding schemes, in the current coding feature matching process, the same segment of data may be matched to different decoding methods at the same time, wherein, when the first decoding method and the second decoding method are matched at the same time, the second decoding method is preferentially used for decoding, and the first decoding method is abandoned for decoding, which is mainly due to the weak coding feature of Base64 encoding. Compared with the general case, in this case, the Base64 coding feature is more likely to be interference. At the same time, it is also considered that the Base64 coding feature may be an erroneous matching result that occurs when further decoding is not required. Therefore, when at least part of the coded data only involves the first decoding method, a decoding attempt is made based on the first decoding method, that is, only an attempt is made, rather than forced decoding. This is also the reason why the continuous target number of times of matching only the first decoding method is used as the condition for terminating the cyclic decoding.

[0035] In addition, considering other matching situations, the embodiment of the present application does not limit the order of decoding. For one or more decoding methods detected at the same time, it can be decoded in sequence, that is, after decoding is completed according to one decoding method, decoding can be continued according to another decoding method. Alternatively, without affecting the correctness of decoding, it can also be decoded at the same time. For example, in the case of mixed coding, different decoding methods will be matched for different data parts of the encoded data. At this time, the different data parts of the encoded data can be decoded simultaneously using corresponding decoding methods. Among them, in the case of determining that the second decoding method involved in the encoded data includes two or more decoding methods, the decoding based on the second decoding method can also be performed in sequence or simultaneously. The embodiment of the present application does not limit this, and it will not be repeated here.

[0036] It should be noted that the embodiments of the present application do not limit the decoding method. It can be understood that decoding is the inverse operation of encoding. Therefore, decoding can be implemented by calling back the decoding function. The decoding function has been recorded in the relevant technology and will not be described here one by one.

[0037] It should also be noted that, for the first decoding method or the second decoding method matched to different parts, the corresponding decoding method is used to decode the corresponding part, which will not be described in detail here.

[0038] Step 104, update the decoded data to the encoded data, and return to execute the steps of determining the first decoding method and / or the second decoding method involved in the encoded data by matching the preset encoding features, until the match fails and / or the continuous target number of times only matches the first decoding method. Among them, the data decoded by the embodiment of the present application is repeated as the new data to be decoded, and the matching and decoding operations are repeated until a certain condition is met, then it is considered that no decoding is required, and the original data has been obtained. It should be emphasized that the conditions set are that the matching fails and / or the continuous target number of times only matches the first decoding method. Among them, the matching fails to obtain the unencoded original data; the continuous target number of times only matches the first decoding method, which means that only Base64 decoding has been performed for many consecutive times. This is mainly considering that Base64 encoding is easy to identify errors. By limiting the number of matches and decoding, it is limited to incorrectly perform Base64 decoding or limit unlimited Base64 decoding, affecting subsequent decoding processing. Thereby further reducing the interference of Base64 encoding on decoding.

[0039] It should be noted that the embodiment of the present application does not limit the target number of times, which can be determined according to at least one of the application scenario, software and hardware performance, operational requirements, current load conditions, etc. For example, when the current load is heavy, the target number of times can be set to a smaller value to reduce the decoding of a portion of encoded data to occupy more resources, thereby affecting the decoding of other encoded data or affecting other services of the electronic device or its own operation. For example, in the case of high real-time requirements, the target number of times can be set to a smaller value to reduce the time spent on loop iterations, obtain the decoding results of the encoded data earlier, and reduce the delay of subsequent processing such as response. Of course, the above is only an example of the target number of times in different situations. In some embodiments, other strategies can also be used to set the target number of times, etc., which will not be repeated here.

[0040] In some embodiments, Figure 2 As shown, in the case of a cyclic process, the process of the decoding method may further include the following steps:

[0041] Step 201, obtaining encoded data.

[0042] Step 202, matching a preset coding feature in the coded data.

[0043] Step 203 , checking whether the following conditions are met: the match fails and / or the first decoding mode is matched only for the consecutive target number of times. If so, executing step 204 , if not, implementing step 205 .

[0044] Step 204: output the currently obtained data.

[0045] Step 205, determining a first decoding method and / or a second decoding method involved in the encoded data; wherein the first decoding method is Base64 decoding, and the second decoding method includes at least one decoding method other than Base64 decoding.

[0046] Step 206, when the same part of the encoded data involves both the first decoding method and the second decoding method, the corresponding parts of the encoded data are decoded based on the second decoding method, and / or, when at least part of the encoded data only involves the first decoding method, a decoding attempt is made based on the first decoding method.

[0047] Step 207: Update the decoded data to encoded data.

[0048] It should be noted that Figure 2 The embodiment shown is similar to the above Figure 1 The embodiments shown are substantially the same, the difference mainly being that clear judgment steps, loop steps and output steps are provided. Of course, other processing may also be performed in some embodiments, such as verifying the content of the data instead of outputting, etc., which will not be described one by one here.

[0049] As mentioned above, Base64 encoding will interfere with other encoding methods, or in other words, Base64 encoding is a kind of encoding method with weak encoding characteristics, which is easy to match errors. Based on this, in some embodiments, Figure 3 As shown, the decoding method process may also include the following steps:

[0050] Step 301, obtaining encoded data.

[0051] Step 302: Determine the second decoding method involved in the encoded data by matching a preset encoding feature corresponding to the second decoding method.

[0052] Step 303, for the target sub-coded data, determine the first decoding method involved in the coded data by matching the preset coding features corresponding to the first decoding method, wherein the target sub-coded data is the data portion of the coded data that fails to match the preset coding features corresponding to the second decoding method.

[0053] Step 304, when the encoded data at least partially involves the first decoding method, decode the corresponding data in the encoded data based on the first decoding method, and when the encoded data at least partially involves the second decoding method, decode the corresponding data in the encoded data based on the second decoding method.

[0054] Step 305, updates the decoded data to the encoded data, and returns to execute the step of determining the second decoding method involved in the encoded data by matching the preset encoding features corresponding to the second decoding method, until the match fails and / or only the first decoding method is matched for the consecutive target number of times.

[0055] Thus, on the basis of the aforementioned embodiment, by first matching the coding features of the second decoding method, and then matching the coding features of the first decoding method for the unmatched part, that is, giving priority to matching the strong coding features, and then matching the weak coding features based on the part that failed to match, the interference that may be caused by Base64 encoding is reduced, and at the same time, the decoding attempt for the weaker coding features is not abandoned, so that the success rate of decoding is further improved, and thus the accuracy of decoding is also further improved. At the same time, since the matching of the first decoding method is for the data part in the code data that fails to match the preset coding features corresponding to the second decoding method, the first decoding method in the coded data will only match the coding features that can only match the first decoding method. For the part that may exist and can match the coding features corresponding to both the first decoding method and the second decoding method at the same time, since the matching is successful in the matching of the coding features corresponding to the second decoding method, the matching of the coding features corresponding to the first decoding method will not be performed again, and decoding will not be performed based on the first decoding method, which is equivalent to realizing the "when the same part of the coded data involves both the first decoding method and the second decoding method, the corresponding parts of the coded data are decoded separately based on the second decoding method" in the aforementioned embodiment.

[0056] For ease of understanding, the following Figure 3 The steps in the embodiment shown are explained. Among them, step 301, step 304-step 305 are substantially the same as step 101, step 203-step 204 in the aforementioned embodiment, and the main difference is that step 202 in the aforementioned embodiment is replaced by step 302-step 303, and the same parts will not be repeated here.

[0057] In step 302, by matching the preset coding features corresponding to the second decoding method, the second decoding method involved in the encoded data is determined. Among them, the embodiment of the present application does not limit the preset coding features corresponding to the second decoding method, which can be determined according to the coding features corresponding to any coding method other than Base64 coding. For example, Unicode encoding usually includes the irrelevant \ character in Base64 encoding, so the \ character can be used as the preset coding feature corresponding to the Unicode encoding in the second decoding method. For example, there is a format for HTML encoding: &#x[HEX]{4}, where &#x are & characters, # characters, and x characters, HEX represents the characters (or strings) under hexadecimal, and {4} represents the hexadecimal characters appearing 4 times, so the & character can be used as the preset coding feature corresponding to the URL character encoding in the second decoding method. Of course, the above is only an example, and in some embodiments, the preset coding features corresponding to the decoding method can also be determined in combination with the coding method corresponding to the decoding method, which will not be repeated here.

[0058] Step 303, for the target sub-encoded data, by matching the preset encoding features corresponding to the first decoding method, determine the first decoding method involved in the encoded data. Among them, it is emphasized in the embodiment of the present application that the encoding feature matching of the first decoding method does not use the encoded data that has been successfully matched, but only uses the target sub-encoded data, that is, the data part of the encoded data that fails to match the preset encoding features corresponding to the second decoding method. In other words, avoid conflicts caused by identifying two or more decoding methods for the same part of data and performing corresponding decoding, and at the same time, preferentially use the second decoding method that is not prone to matching errors for decoding. In addition, for the two or more decoding methods identified for the same part of data, the embodiment of the present application adopts the possibility of abandoning the Base64 decoding method. This is mainly due to the fact that the encoding features of Base64 encoding are not obvious, weak, and prone to errors. Reliable and effective matching is given priority, making the decoding method determined by matching more reliable, thereby further improving the success rate and accuracy of the final decoding.

[0059] It should be noted that Figure 3 The illustrated embodiment mainly considers the difference between the first decoding method and the second decoding method. In some embodiments, the difference between two or more decoding methods in the second decoding method may also be considered to further provide different matching orders for different decoding methods. For example, the matching order is determined according to the obviousness (or strength, probability of recognition error, etc.) of the coding features. The core of this is to give priority to matching reliable and effective coding features, and then continue to use the next level of reliable and effective coding features for matching based on the part where the matching fails. I will not go into details here.

[0060] In order to help those skilled in the art better understand the coding feature matching of different decoding methods, different decoding methods will be described with examples below.

[0061] In some embodiments, for Base64 encoding, the Base64 character set can be used as a preset encoding feature corresponding to Base64 decoding, and the characters in the encoded data are matched one by one in the Base64 character set to determine whether the encoded data involves Base64 encoding, wherein, if the characters in the encoded data are all matched successfully, or, a continuous segment of characters in the encoded data are all matched successfully, it can be determined that the encoded data or the continuous characters that are successfully matched involve Base64 decoding, that is, the first decoding method. Of course, based on some special cases, the Base64 character set can be extended, such as extending line feed characters (such as \r, \n, and / or, \f), - characters, _ characters, etc. to the encoding features matched by Base64 encoding. For example, in combination with the aforementioned embodiment, that is, for the target sub-encoded data, by matching the preset encoding features corresponding to the first decoding method, determining the first decoding method involved in the encoded data can be achieved in the following manner: detecting whether the target sub-encoded data all belong to characters in the target character set, wherein the target character set includes characters in the Base64 character set and extended characters, and the extended characters include one or more of the following characters: line feed characters, - characters, _ characters. Of course, the above is only an example of the extension of the Base64 character set. In some embodiments, the Base64 character set can also be extended in a corresponding manner according to the application scenario, the usage requirements of different encoding methods, the combination of different encoding methods, etc., such as adding feature extensions that are not involved in the encoding features of other decoding methods to the Base64 character set, etc., which will not be listed one by one here.

[0062] For URL encoding, in the existing decoding method identification, the general format based on URL encoding is: %xx, where xx is a word in HEX format, and the % character is used as the encoding feature corresponding to URL decoding. However, in some cases, such as "%'OR NOT 78=78#", it is not obtained by URL encoding, and also, for example, the string in Unicode encoding: %u. Based on these special cases, it can be seen that part of the reason for the decoding error is also: the setting of the encoding feature is wrong. Based on this, in some embodiments, matching the preset encoding feature and determining the first decoding method and / or the second decoding method involved in the encoded data can be achieved in the following way: after matching the % character in the encoded data, according to the character after the % character, determine that the % character involves the standard uniform resource locator character encoding or Unicode encoding in the second decoding method. No longer simply matching the % character directly as URL decoding, but further combining other contents in the encoded data for specific judgment to eliminate the problem of matching the decoding method error, the success rate and accuracy of decoding can be further improved. For example, in some embodiments, based on the aforementioned example of a decoding error caused by the prior art, according to the character after the % character, it is determined that the % character involves a standard uniform resource locator character encoding or a Unicode encoding in the second decoding method. This can be specifically achieved in the following manner: when the character after the % character is a u character, the % character involves a Unicode encoding in the second decoding method; and / or, when the character after the % character is a hexadecimal character, it is determined that the % character involves a standard uniform resource locator character encoding in the second decoding method.

[0063] For Unicode encoding, considering that there are some variations, such as UTF-8 (8 bits, Universal Character Set / Unicode Transformation Format), etc., further differentiation can be provided for Unicode decoding in order to better support subsequent decoding. For example, in some embodiments, by matching preset encoding features, determining the first decoding method and / or the second decoding method involved in the encoded data can be achieved in the following way: matching the \ character in the encoded data; when the match is successful, determining that the second decoding method involved in the \ character is a special Unicode encoding of the standard Unicode based on the characters adjacent to the matched \ character. In other words, providing a more refined decoding method division for Unicode encoding enables further determination of a more accurate decoding scheme, thereby enabling faster and more efficient decoding, which is more conducive to application in low-latency services.

[0064] There are also some variations in URL encoding, such as the introduction of URL encodings with different special characters. Therefore, in order to better support subsequent decoding, further differentiation can be provided for URL decoding. For example, in some embodiments, by matching preset encoding features, the first decoding method and / or the second decoding method involved in the encoded data is determined, which can be achieved in the following manner: matching the & character in the encoded data; in the case of a successful match, determining the second decoding method involved in the & character as the entity encoding of the hypertext markup language or any binary encoding type format of the hypertext markup language based on the characters adjacent to the matched & character. In other words, providing a more refined decoding method division for URL encoding enables further determination of a more accurate decoding scheme, thereby enabling faster and more efficient decoding, which is more conducive to application in low-latency services.

[0065] Of course, the above are only examples for different decoding methods. In some embodiments, other decoding methods may be involved, so as to match through corresponding coding features. For other decoding methods, the corresponding coding features may also be similar to Base64 decoding, and character matching and trial decoding may be performed through corresponding character sets. Various decoding methods and their corresponding coding features will not be listed one by one here.

[0066] To facilitate those skilled in the art to better understand the decoding method provided in the embodiments of the present application, the following will be described in conjunction with specific application scenarios.

[0067] In some embodiments, Figure 4 As shown, the decoding method may include the following steps:

[0068] Step 401, receiving a user request.

[0069] Step 402: Perform content detection on the user request to obtain encoded data.

[0070] Step 403, by matching the preset coding features, determine the first decoding method and / or the second decoding method involved in the coded data; wherein the first decoding method is Base64 decoding, and the second decoding method includes at least one decoding method other than Base64 decoding.

[0071] Step 404, when the same part of the encoded data involves both the first decoding method and the second decoding method, the corresponding parts of the encoded data are decoded based on the second decoding method, and / or, when at least part of the encoded data only involves the first decoding method, a decoding attempt is made based on the first decoding method.

[0072] Step 405, updates the decoded data to the encoded data, and returns to execute the step of determining the first decoding method and / or the second decoding method involved in the encoded data by matching the preset encoding features, until the match fails or only the first decoding method is matched for the consecutive target number of times.

[0073] Step 406: The data obtained by the last decoding of the encoded data is used as the decoding result for detection and protection is performed based on the detection result.

[0074] In this way, on the basis of the aforementioned embodiment, decoding is performed in conjunction with the request sending process, so that the security of the request can be improved, and at the same time, by improving the success rate and accuracy of decoding the encoded data in the request, the success rate and accuracy of the request response are improved, thereby improving the user experience.

[0075] For ease of understanding Figure 4 The embodiment shown, the steps of which will be explained below.

[0076] In step 401, a user request is received. The present embodiment does not limit the reception of the user request, which can be received as the destination pointed by the request, or Figure 5 As shown, the request is made between two electronic devices ( Figure 5 The request is forwarded between two electronic devices (only the electronic device is used as a server as an example), and is received by the intermediate component (such as a firewall, a security component, etc.) between the two electronic devices, and the request content is processed and decoded, wherein the decoding function can be realized by mounting an intelligent decoding engine. It is even possible to further provide a protection function through the security detection module in the intermediate component to improve the protection capability and performance. Of course, the above is only an example. In some embodiments, there can also be other scenarios, which will not be described one by one here.

[0077] In addition, the embodiments of the present application do not limit the user request, which can be in any format, and the content of the request can also be set arbitrarily, which will not be repeated here.

[0078] In step 402, the user request is content detected to obtain encoded data. Among them, taking the user request as an HTTP request as an example, the content of each position of the HTTP request message is parsed, and the main areas are the request line part, the header field part, and the request body (body entity) part. The request line part is further divided into the request method, request path, request parameters, and HTTP protocol. The request header is the usual Host, UA, cookie, content-type, connection, etc. The request body entity is usually the content carried by request methods such as PUT / POST, and the entity format type corresponds to various content formats according to the actual value of Content-Type, such as Json / xml / multipart / x-formed, etc. Through the aforementioned request format, the request is content parsed to obtain the encoded content therein, which is usually the data of the request body part.

[0079] In step 403 to step 405, they are substantially the same as step 102 to step 104 in the aforementioned embodiment, and are not described in detail here.

[0080] In step 406, the data obtained by the last decoding of the encoded data is used as the decoding result for detection and protection is performed based on the detection result. Among them, the embodiment of the present application does not limit the specific implementation method of detection and protection, and can be set according to the protection requirements. For example, content detection can be performed on the encoded data and the decoding result of the encoded data together to determine whether there are attack features in the message, and if there are attack features, one or more of the measures such as interception, monitoring, and release are used for corresponding processing.

[0081] It should be noted that the above embodiments are mainly Figure 1 Based on the embodiments shown, different implementation methods or different application scenarios are further provided, but this does not mean that Figure 2-Figure 4 The embodiments shown cannot be combined with each other, for example Figure 3 The encoding features of different decoding methods are matched in different orders. Figure 4 In the illustrated embodiment, request combination and detection are performed, etc., which will not be described in detail here.

[0082] Based on the above embodiment or combination of embodiments, it can be seen that for multiple encodings, multi-layer feature recognition and decoding can be achieved. For multiple (m-fold) and mixed multiple encodings (n-fold), the feature recognition method of a single traversal reduces the number of traversals m*nm. For nested encodings, such as URL encoding first, then Unicode encoding, then Base64 encoding, etc. or other sequentially encoded request messages, it is possible to decode at multiple levels through loop processing.

[0083] That is to say, the decoding method provided in the embodiment of the present application can support the matching of the coding features corresponding to the first decoding method and the second decoding method during the matching process, that is, it can automatically identify multiple coding types after one match, and there is no need for multiple traversals when there are mixed scenarios, which significantly reduces the number of coding type identifications; it can efficiently handle complex coding scenarios, significantly improve the decoding ability, reduce the decoding time, and achieve efficient decoding. Through the integrated application of different decoding strategies, it is possible to accurately identify and decode request messages in various complex scenarios, avoid the common problem of insufficient decoding ability in the prior art, and achieve accurate decoding. Finally, by reducing the number of traversals, increasing the number of traversal layers, optimizing the decoding method, and being compatible with special abnormal scenarios and various different decoding schemes to solve the decoding problems of complex scenarios, it is more flexible and covers more comprehensive scenarios.

[0084] The step division of the above methods is only for the purpose of clear description. When implemented, they can be combined into one step or some steps can be split and decomposed into multiple steps. As long as they include the same logical relationship, they are all within the scope of protection of this patent; adding insignificant modifications to the algorithm or process or introducing insignificant designs without changing the core design of the algorithm and process are all within the scope of protection of this patent.

[0085] Another aspect of the present application embodiment further provides an electronic device, such as Figure 6 As shown, it includes: at least one processor 601; and a memory 602 that is communicatively connected to the at least one processor 601; wherein the memory 602 stores instructions that can be executed by the at least one processor 601, and the instructions are executed by the at least one processor 601 so that the at least one processor 601 can execute the decoding method described in any of the above method embodiments.

[0086] The memory 602 and the processor 601 are connected in a bus manner, and the bus may include any number of interconnected buses and bridges, and the bus connects various circuits of one or more processors 601 and the memory 602 together. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be one element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices on a transmission medium. The data processed by the processor 601 is transmitted on a wireless medium via an antenna, and further, the antenna also receives data and transmits the data to the processor 601.

[0087] The processor 601 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management and other control functions. The memory 602 can be used to store data used by the processor 601 when performing operations.

[0088] Another aspect of the present application embodiment further provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the above method embodiment is implemented.

[0089] That is, those skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0090] Those skilled in the art will appreciate that the above embodiments are specific embodiments for implementing the present application, and in actual applications, various changes may be made thereto in form and detail without departing from the spirit and scope of the present application.

Claims

1. A decoding method, characterized in that: include: Get the encoded data; By matching a preset coding feature, determining a first decoding method and / or a second decoding method involved in the coded data; wherein the first decoding method is Base64 decoding, and the second decoding method includes at least one decoding method other than Base64 decoding; When the same part of the coded data involves both the first decoding method and the second decoding method, respectively decoding the corresponding parts of the coded data based on the second decoding method, and / or when at least part of the coded data involves only the first decoding method, performing a decoding attempt based on the first decoding method; The decoded data is updated to the encoded data, and the step of determining the first decoding method and / or the second decoding method involved in the encoded data by matching the preset encoding features is returned to be executed until the match fails and / or only the first decoding method is matched for the consecutive target number of times.

2. The decoding method according to claim 1, characterized in that: The determining the first decoding method and / or the second decoding method involved in the coded data by matching the preset coding feature includes: Determining the second decoding method involved in the encoded data by matching a preset encoding feature corresponding to the second decoding method; For the target sub-coded data, the first decoding method involved in the coded data is determined by matching the preset coding feature corresponding to the first decoding method, wherein the target sub-coded data is the data portion of the coded data that fails to match the preset coding feature corresponding to the second decoding method.

3. The encoding method according to claim 2, characterized in that The step of determining the first decoding method involved in the target sub-encoded data by matching a preset encoding feature corresponding to the first decoding method includes: Detect whether the target sub-encoded data all belong to characters in a target character set, wherein the target character set includes characters in a Base64 character set and extended characters, and the extended characters include one or more of the following characters: a line feed character, a - character, and a _ character.

4. The decoding method according to any one of claims 1 to 3, characterized in that: The determining the first decoding method and / or the second decoding method involved in the coded data by matching the preset coding feature includes: After the % character is matched in the encoded data, it is determined that the % character is related to the standard uniform resource locator character encoding or the Unicode encoding in the second decoding mode according to the character after the % character.

5. The encoding method according to claim 4, characterized in that: The step of determining, based on the character after the % character, that the % character relates to a standard uniform resource locator character encoding or a Unicode encoding in the second decoding mode comprises: In the case where the character after the % character is a u character, the % character relates to the Unicode encoding in the second decoding mode; and / or, In the case that the character after the % character is a hexadecimal character, it is determined that the % character is related to the standard uniform resource locator character encoding in the second decoding mode.

6. The decoding method according to any one of claims 1 to 3, characterized in that: The determining the first decoding method and / or the second decoding method involved in the coded data by matching the preset coding feature includes: Matches a \ character in the encoded data; In the case of successful matching, the second decoding method related to the \ character is determined to be a standard Unicode encoding or any preset special Unicode encoding according to the matched characters adjacent to the \ character.

7. The encoding method according to any one of claims 1 to 3, characterized in that: The determining the first decoding method and / or the second decoding method involved in the coded data by matching the preset coding feature includes: Matches the & character in the encoded data; When the match is successful, the second decoding mode related to the & character is determined to be an entity encoding of a hypertext markup language or any binary encoding type format of a hypertext markup language according to characters adjacent to the matched & character.

8. The decoding method according to any one of claims 1 to 3, characterized in that: The target number is associated with at least one of the following information: application scenario, software and hardware performance, operation requirements, and current load conditions.

9. The decoding method according to any one of claims 1 to 3, characterized in that: The obtaining of the coded data comprises: Receive user requests; Performing content detection on the user request to obtain the encoded data; The method further comprises: The data obtained by decoding the encoded data for the last time is used as the decoding result for detection and protection is performed based on the detection result.

10. An electronic device, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the decoding method according to any one of claims 1 to 9.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the decoding method according to any one of claims 1 to 9 is implemented.

Images