Access request detection method, device and system and storage medium

Abstract

The invention provides an access request detection method, device and system and a storage medium, relates to the technical field of network security, and is used for solving the problem that a website cannot protect hostile attacks after a coding mode is changed. The method is applied to a protection system, and the protection system comprises an isolation node and a protection node. The method comprises the following steps: an isolation node receives an access request message sent by a request end, wherein the access request message is used for requesting to access a target website; and the isolation node determines an isolation node state after receiving the access request message, wherein the isolation node state is used for indicating whether the isolation node is attacked by the vulnerability type or not. The isolation node determines a forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used for indicating whether to forward the access request message to the protection node. And under the condition that the protection node receives the access request message forwarded by the isolation node, carrying out distributed denial of service (DDOS) attack detection on the access request message.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, system and storage medium for detecting an access request. Background Art

[0002] When accessing a website, if the access traffic is redirected to the protection gateway, the protection gateway will intercept the access traffic and identify whether the access traffic contains malicious data based on preset security rules. If the access traffic does not contain malicious data, the access traffic is allowed to access the website; if the access traffic contains malicious data, the access traffic is blocked from accessing the website.

[0003] However, once the attacker changes the encoding method of malicious data, the malicious data may circumvent the preset security rules and deliver the attack payload to the website, making the website inoperable.

[0004] Therefore, how to ensure the security of the website has become a technical problem that needs to be solved urgently. Summary of the invention

[0005] The present application provides an access request detection method, device, system and storage medium, which are used to solve the problem that a website cannot protect against malicious attacks after the encoding method is changed.

[0006] In order to achieve the above objectives, this application adopts the following technical solutions:

[0007] In the first aspect, the present application provides a method for detecting an access request. In the method, an isolation node receives an access request message sent by a requesting end, and the access request message is used to request access to a target website. The isolation node determines the state of the isolation node after receiving the access request message, and the state of the isolation node is used to indicate whether the isolation node has been attacked by a vulnerability type, and the vulnerability type attack is an attack launched based on a security vulnerability of the target website. Based on the isolation node state, the isolation node determines a forwarding strategy for the access request message, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. When the protection node receives the access request message forwarded by the isolation node, a distributed denial of service (DDOS) attack detection is performed on the access request message.

[0008] Based on the above technical solution, the isolation node can receive the access request message sent by the request end, and the access request message is used to request access to the target website. Afterwards, the isolation node can determine the isolation node state after receiving the access request message, and the isolation node state is used to indicate whether the isolation node is attacked by a vulnerability type, and the vulnerability type attack is an attack launched based on the security vulnerability of the target website. Afterwards, the isolation node determines the forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end can be isolated from the target website, and can only attack the isolation node, but cannot directly attack the target website. Afterwards, when the protection node receives the access request message forwarded by the isolation node, the access request message is subjected to DDOS attack detection. In this way, the protection node can detect that the request end is carrying out a DDOS attack on the target website and provide protection. In this way, the isolation node can receive the access request information in a separate isolation environment, and control the vulnerability type attack in the isolation node. The protection node can perform DDOS attack detection on the access request message to achieve protection against DDOS attacks. Further, the protection system can achieve multiple protections for the website and increase the security of the website.

[0009] In a possible design, the forwarding strategy includes: refusing to forward the access request message when the isolated node is attacked by a vulnerability type; and forwarding the access request message when the isolated node is not attacked by a vulnerability type.

[0010] In one possible design, the access request detection method further includes: when the access request message passes the detection, the protection node converts the data format of the access request message to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format. The protection node sends the converted access request message to the target website.

[0011] In a possible design, the isolation node receives the access request message sent by the request end, including: the isolation node determines whether the request end is in the access blacklist. If the request end is not in the access blacklist, the isolation node receives the access request message sent by the request end.

[0012] In a possible design, the access request detection method further includes: if the access request message fails the detection, the protection node discards the access request message and adds the request end to an access blacklist. The protection node sends the access blacklist to the isolation node.

[0013] In a possible design, the access request detection method further includes: the protection node receives response data sent by the target website, the response data is used to indicate the data requested by the access request message. The protection node sends the response data to the isolation node. The isolation node receives the response data sent by the protection node, and performs code reconstruction on the response data, the code reconstruction is used to indicate that the code of the response data is modified. The isolation node sends the response data after code reconstruction to the request end.

[0014] In a second aspect, the present application provides a screen projection system, which includes: an isolation node and a protection node.

[0015] The isolation node is used to receive the access request message sent by the request end, and the access request message is used to request access to the target website. The isolation node is also used to determine the isolation node status after receiving the access request message, and the isolation node status is used to indicate whether the isolation node is attacked by a vulnerability type, and the vulnerability type attack is an attack based on the security vulnerability of the target website. The isolation node is also used to determine the forwarding strategy of the access request message based on the isolation node status, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. The protection node is used to perform DDOS attack detection on the access request message when the protection node receives the access request message forwarded by the isolation node.

[0016] In a third aspect, the present application provides an access request detection device, which includes a receiving module and a processing module.

[0017] The receiving module is used to receive the access request message sent by the requesting end through the isolation node, and the access request message is used to request access to the target website. The processing module is used to determine the isolation node status after receiving the access request message through the isolation node, and the isolation node status is used to indicate whether the isolation node is attacked by a vulnerability type, and the vulnerability type attack is an attack based on the security vulnerability of the target website. The processing module is also used to determine the forwarding strategy of the access request message based on the isolation node status through the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. The processing module is also used to perform DDOS attack detection on the access request message through the protection node when the protection node receives the access request message forwarded by the isolation node.

[0018] In a possible design, the forwarding strategy includes: refusing to forward the access request message when the isolated node is attacked by a vulnerability type; and forwarding the access request message when the isolated node is not attacked by a vulnerability type.

[0019] In one possible design, the processing module is used to convert the data format of the access request message through the protection node when the access request message passes the detection, so as to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format. The device also includes a sending module, which is used to send the converted access request message to the target website through the protection node.

[0020] In one possible design, the processing module is used to determine whether the requesting end is on the access blacklist through the isolation node. The receiving module is used to receive the access request message sent by the requesting end through the isolation node if the requesting end is not on the access blacklist.

[0021] In a possible design, the processing module is used to discard the access request message through the protection node and add the request end to the access blacklist when the access request message fails to pass the detection. The sending module is used to send the access blacklist to the isolation node through the protection node.

[0022] In a possible design, the receiving module is used to receive the response data sent by the target website through the protection node, and the response data is used to indicate the data requested by the access request message. The sending module is used to send the response data to the isolation node through the protection node. The receiving module is also used to receive the response data sent by the protection node through the isolation node. The processing module is used to reconstruct the code of the response data through the isolation node, and the code reconstruction is used to indicate that the code of the response data is modified. The sending module is also used to send the response data after code reconstruction to the request end through the isolation node.

[0023] In a fourth aspect, the present application provides an access request detection device, the device comprising: a processor and a memory; the processor and the memory are coupled; the memory is used to store one or more programs, the one or more programs including computer execution instructions, when the access request detection device is running, the processor executes the computer execution instructions stored in the memory to implement the method described in the first aspect and any possible implementation of the first aspect.

[0024] In a fifth aspect, the present application provides a computer-readable storage medium, which stores instructions. When the instructions are executed on a computer, the computer executes the method described in the above-mentioned first aspect and any possible implementation of the first aspect.

[0025] In a sixth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run a computer program or instructions to implement the method described in the first aspect and any possible implementation of the first aspect.

[0026] In a seventh aspect, the present application provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to execute the method described in the above-mentioned first aspect and any possible implementation manner of the first aspect.

[0027] In the above scheme, the technical problems that can be solved and the technical effects achieved by the access request detection system, access request detection device, computer equipment, computer storage medium, chip or computer program product can refer to the technical problems and technical effects solved by the above-mentioned first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A system architecture diagram of an access request detection system provided in an embodiment of the present application;

[0029] Figure 2 A flowchart of a method for detecting an access request provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the structure of an access request detection device provided in an embodiment of the present application;

[0031] Figure 4 A schematic diagram of the structure of another access request detection device provided in an embodiment of the present application;

[0032] Figure 5 A conceptual partial view of a computer program product provided for an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] The terms “first” and “second” in the description and claims of the present application are used to distinguish different objects rather than to describe a specific order of the objects.

[0035] In addition, the terms "including" and "having" and any variations thereof mentioned in the description of this application are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or modules is not limited to the listed steps or modules, but may optionally include other steps or modules that are not listed, or may optionally include other steps or modules that are inherent to these processes, methods, products or devices.

[0036] In addition, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present concepts in a specific way.

[0037] Web application firewall technology can detect and filter traffic in and out of web pages through preset rules, identify and block potential malicious requests, and thus protect the security of web applications. Web application firewall technology usually includes traffic interception and analysis modules, rule engine modules, threat response modules, and log and report modules. When the request end initiates a request to a website through a browser, the traffic interception module intercepts the request and sends it to the traffic analysis module for parsing. After the traffic analysis module completes the parsing, the rule engine module determines whether the traffic meets the security standards based on the preset rules. If the traffic does not meet the security standards, the threat response module will take corresponding measures and report it to the log recording and reporting module to generate detailed logs and reports. The protection effect of web application firewall technology depends largely on the quality and update frequency of the rule set, and it may not be able to respond to zero-day vulnerability attacks in a timely manner.

[0038] Remote browser isolation technology can physically isolate the browser environment from the user terminal, ensuring that the target network cannot be directly attacked when the requesting end accesses the target network. Remote browser isolation technology deploys the browser operating environment on a remote server, which enables all web content processing and rendering to be concentrated on the remote browser end. When the requesting end attacks the target website, it will only attack the remote server, and the target network can still operate normally, thus achieving physical isolation.

[0039] Remote browser isolation technology includes pixel push, document object model (DOM) reconstruction and vector rendering. Since remote browser isolation technology allows all executable code to be processed in an isolated environment, all interactions between the requester and the page are carried out in an isolated environment. In this way, even if the access traffic from the requester contains malicious content, the target website will not be affected. However, this technology has high bandwidth requirements. Once the attacker launches a DDOS attack, the protection system is easily paralyzed, thus affecting the normal business of the website.

[0040] Therefore, how to ensure the security of the website has become a technical problem that needs to be solved urgently.

[0041] In order to solve the above technical problems, an embodiment of the present application provides a method for detecting an access request. In the method, an isolation node can receive an access request message sent by a request end, and the access request message is used to request access to a target website. Afterwards, the isolation node can determine the isolation node state after receiving the access request message, and the isolation node state is used to indicate whether the isolation node is attacked by a vulnerability type, and the vulnerability type attack is an attack initiated based on the security vulnerability of the target website. Afterwards, the isolation node determines the forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end can be isolated from the target website, and can only attack the isolation node, but cannot directly attack the target website. Afterwards, when the protection node receives the access request message forwarded by the isolation node, the access request message is subjected to DDOS attack detection. In this way, the protection node can detect that the request end is conducting a DDOS attack on the target website and perform protection. In this way, the isolation node can receive access request information in a separate isolation environment, and control the vulnerability type attack in the isolation node. The protection node can perform DDOS attack detection on the access request message to achieve protection against DDOS attacks. Furthermore, the protection system can implement multiple protections for the website and increase the security of the website.

[0042] The implementation environment of the embodiments of the present application is introduced below.

[0043] like Figure 1 , which is a system architecture diagram of an access request detection system provided in an embodiment of the present application, the system includes: an isolation node 101 and a protection node 102 .

[0044] The isolation node 101 is used to receive an access request message sent by the requesting end. In addition, the isolation node 101 is also used to determine the state of the isolation node after receiving the access request message. In addition, the isolation node 101 is also used to determine the forwarding strategy of the access request message based on the isolation node state to determine whether to send the access request message to the protection node 102. In addition, the isolation node 101 is also used to generate an isolation environment, and the isolation node 101 can parse the access request message in the isolation environment. In addition, the isolation node 101 is also used to receive the response data sent by the protection node 102, and perform DOM reconstruction on the response data. In addition, the isolation node 101 is also used to send the response data after DOM reconstruction to the requesting end.

[0045] The protection node 102 is used to detect the access request message. In addition, the protection node 102 is also used to convert the data format of the access request message and send the converted access request message to the target website. In addition, the protection node 102 is also used to receive the response data sent by the target website and send the response data to the isolation node 101.

[0046] It is understandable that the isolation node 101 parses the access request information in the isolation environment, and if the isolation node 101 is attacked by a vulnerability type, the vulnerability type attack can be controlled in the isolation environment. In this way, the target website can be guaranteed to operate normally.

[0047] In some embodiments, the protection system further includes a request device 103. The request device 103 is used to send an access request message to the isolation node 101.

[0048] It should be understood that the requesting device 103 may act as a requesting end to send an access request message to the isolation node 101 .

[0049] Exemplarily, the requesting device 103 in the embodiment of the present application can be a tablet computer, a mobile phone, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) / virtual reality (VR) device, a vehicle-mounted device, etc. The embodiment of the present application does not impose any special restrictions on the specific form of the requesting end 103.

[0050] In some embodiments, the isolation node 101 may determine whether the requesting end 103 is in the access blacklist to determine whether to receive the access request message sent by the requesting end 103 .

[0051] In some embodiments, when the access request message fails to pass the detection, the protection node 102 may add the request end 103 to the access blacklist and send the access blacklist to the isolation node.

[0052] In some embodiments, the protection system further includes a website device 104. The website device 104 is used to receive access request information sent by the protection node 102, and send response data to the protection node 102.

[0053] It should be understood that the target website runs on the website device 104 .

[0054] It should be noted that the isolation node 101 and the protection node 102 can be on the same server or on different servers, and this application does not limit this.

[0055] The isolation node 101, the protection node 102 and the website device 104 in the embodiment of the present application can be a physical server or a cloud server. The server can be a single server, or it can be a server cluster composed of multiple servers. In some implementations, the server cluster can also be a distributed cluster. The present disclosure does not limit the specific implementation of the server.

[0056] It should be noted that the server where the isolation node 101 and the protection node 102 are located is different from the server where the website device 104 is located.

[0057] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0058] like Figure 2 As shown, a method for detecting an access request provided in an embodiment of the present application includes:

[0059] S201. The isolation node receives an access request message sent by a requesting end.

[0060] The access request message is used to request to obtain information of the target website.

[0061] In a possible implementation, the isolation node may receive a connection request message sent by the requesting end, and establish a connection relationship with the requesting end based on the connection request message. Afterwards, the isolation node may receive an access request message sent by the requesting end.

[0062] Exemplarily, the request end sends an HTTP request message to the isolation node, the HTTP request message is used to instruct the request end and the isolation node to establish a WebSocket connection relationship, and the HTTP request message carries specific parameters for the request end and the isolation node to establish a WebSocket connection relationship, such as a subprotocol, compression options, etc. The isolation node can receive the HTTP request message. If the isolation node supports the WebSocket protocol, it can establish a WebSocket connection relationship with the request end.

[0063] In this way, the communication protocol between the request end and the isolated node can be upgraded from the HTTP protocol to the WebSocket protocol. The request end and the isolated node can receive and send data based on the connection relationship.

[0064] In another possible implementation, the isolation node has established a connection relationship with the requesting end, and the isolation node can directly receive the access request message sent by the requesting end.

[0065] S202: The isolated node determines the isolated node state after receiving the access request message.

[0066] The isolation node status is used to indicate whether the isolation node is attacked by a vulnerability type attack, where a vulnerability type attack is an attack launched based on a security vulnerability of the target website.

[0067] Optionally, the vulnerability type attack may include a zero-day vulnerability type attack and an unknown vulnerability type attack.

[0068] It should be noted that a zero-day vulnerability is a security vulnerability that is exploited maliciously immediately after it is discovered, that is, the relevant malicious program appears on the same day that the security patch and the flaw are exposed. An unknown vulnerability is a security vulnerability that has not been publicly disclosed and cannot be protected by existing patches.

[0069] It should be noted that if the isolation node status is used to indicate that the isolation node is attacked by a vulnerability type, it means that the isolation node has been attacked, but it cannot mean that the isolation node has detected in advance that there is a vulnerability type attack in the access request message.

[0070] In the embodiment of the present application, the isolation node status can be represented by numbers (such as 0, 1). Alternatively, the isolation node status information can be represented by letters (such as a, b). Alternatively, the isolation node status information can be represented by a mixture of letters and numbers.

[0071] Exemplarily, if the isolation node status is 0, the isolation node determines that the isolation node is attacked by a vulnerability type; if the isolation node status information is 1, the isolation node determines that the isolation node is not attacked by a vulnerability type.

[0072] In a possible implementation, the isolation node parses the access request message. In the process of parsing the access request message, the isolation node may generate operation information of the isolation node. The isolation node may determine whether the isolation node is attacked by a vulnerability type based on the operation information.

[0073] In one possible design, the operation information may include at least one of the following: network traffic status, resource occupancy information, operation log of the isolated node, and script execution status of the isolated node. The network traffic status is used to indicate whether the network traffic is abnormal, the resource occupancy information is used to indicate the central processing unit (CPU) or memory resources occupied by the isolated node, the operation log of the isolated node is used to indicate whether an error or crash occurs in the isolated node, and the script execution status of the isolated node is used to indicate whether the isolated node executes an unauthorized script.

[0074] Exemplarily, the preset traffic safety threshold of the isolated node per hour is 500 megabytes. If the isolated node detects 1000 megabytes of data upload or download within one hour, it is determined that the network traffic is abnormal, and thus it is determined that the isolated node is attacked by a vulnerability type.

[0075] It should be noted that the isolated node cannot prevent vulnerability type attacks in advance. In the case where the isolated node is attacked by a vulnerability type, the isolated node can discard the access request message with the vulnerability type attack and determine the isolated node status as the isolated node is attacked by a vulnerability type.

[0076] In this way, the isolation node will not forward the access request message to the protection node, thereby isolating the vulnerability type attack in the isolation node, making it impossible for the vulnerability type attack to continue to attack the target website.

[0077] In a possible implementation, when the isolated node is attacked by a DDOS, after the isolated node receives the access request message, the isolated node status is used to indicate that the isolated node is not attacked by a vulnerability type.

[0078] S203: The isolation node determines a forwarding strategy for the access request message based on the isolation node state.

[0079] The forwarding strategy is used to indicate whether to forward the access request message to the protection node.

[0080] In a possible implementation, when the isolated node is attacked by a vulnerability type, the isolated node refuses to forward the access request message. When the isolated node is not attacked by a vulnerability type, the isolated node forwards the access request message.

[0081] In an embodiment of the present application, when an isolated node is attacked by a vulnerability type, the isolated node discards the access request message and adds the requesting end to an access blacklist.

[0082] Optionally, when the isolated node is not attacked by a vulnerability type, the isolated node encrypts the access request message and forwards the encrypted access request message to the protection node.

[0083] It is understandable that the isolation node can physically isolate the request end and the target website, so that when the isolation node is attacked by a vulnerability type, the target website can still operate normally.

[0084] In some embodiments, the isolation node may generate an access request message based on a website address or a click operation input by the requesting end, and forward the access request message to the protection node.

[0085] It should be noted that after forwarding the access request message, the isolation node may discard the access request message so that the access request message will not be leaked.

[0086] S204: When the protection node receives the access request message forwarded by the isolation node, the protection node performs DDOS attack detection on the access request message.

[0087] The DDOS attack detection is used to indicate whether the number of access request messages sent by the requesting end exceeds a preset access quantity threshold.

[0088] Optionally, the DDOS attack detection may include challenge collapsar (CC) attack detection.

[0089] In a possible implementation, the access request message includes an identifier of the requesting end. The protection node may store the number of access request messages received from each requesting end. The protection node may receive the access request message forwarded by the isolation node, and determine the number of access request messages of the requesting end based on the identifier of the requesting end. Afterwards, the access request message may be subjected to DDOS attack detection based on the number of access request messages of the requesting end.

[0090] In an embodiment of the present application, if the number of access request messages from the requesting end is greater than a preset access number threshold, it is determined that the access request message has not passed the DDOS attack detection. If the number of access request messages sent by the requesting end is less than a preset access number threshold, it is determined that the access request message has passed the DDOS attack detection.

[0091] It should be noted that the number of access request messages may be the number of messages in a preset time period before the current time. For example, the current time is 4:00 p.m. and the preset time period is two hours. If the number of messages in the time period from 2:00 p.m. to 4:00 p.m. is 100 and the number of messages in the time period from 1:00 p.m. to 4:00 p.m. is 300, then the number of access request messages is 100.

[0092] It is understandable that the isolation node cannot identify DDOS attacks and will continue to forward access request messages, and cannot isolate the DDOS attacks in the isolation node. The protection node can perform DDOS attack detection on the access request message, thereby intercepting the DDOS attack and preventing the website from being attacked by DDOS. In this way, multiple protections can be achieved for the website.

[0093] Based on the above technical solution, the isolation node can receive the access request message sent by the request end, and the access request message is used to request access to the target website. Afterwards, the isolation node can determine the isolation node state after receiving the access request message, and the isolation node state is used to indicate whether the isolation node is attacked by a vulnerability type. Afterwards, the isolation node determines the forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end can be isolated from the target website, and the request end will attack the isolation node, but cannot directly attack the target website. Afterwards, when the protection node receives the access request message forwarded by the isolation node, the access request message is subjected to DDOS attack detection. In this way, the protection node can detect that the request end is carrying out a DDOS attack on the target website and provide protection. In this way, the isolation node can isolate the access request information in a separate virtual space to achieve protection against vulnerability type attacks. The protection node can determine the number of access request messages sent by the request end to achieve protection against DDOS attacks. Further, the protection system can achieve multiple protections for the website and increase the security of the website.

[0094] In some embodiments, the protection node may pre-store security protection rules, and before the protection node performs DDOS attack detection on the access request message, the protection node may perform security judgment on the access request message based on the security protection rules. If the protection node determines that the access request message is a dangerous type message, the access request message is discarded; if the protection node determines that the access request message is a safe type message, the access request message is subjected to DDOS attack detection.

[0095] It is understandable that if the isolation node misses a dangerous type of message, the protection node can provide secondary protection for the target website, thereby making the target website more secure and ensuring that the target website can operate normally.

[0096] In some embodiments, if the access request message fails the detection, the guard node may discard the access request message and add the request end to the access blacklist. The guard node sends the access blacklist to the isolation node.

[0097] It is understandable that in this way, the protection node can prevent further attacks that may be launched by the requesting end, reduce the risk of potential attacks on the target website, and thus enhance the security of the target website.

[0098] In some embodiments, the protection node and the isolation node share a database, which includes an access blacklist. If the access request message fails to pass the detection, the protection node can add the requester to the access blacklist.

[0099] In this way, the protection node can update the access blacklist in the database in real time, thereby realizing dynamic adjustment of the access blacklist. Since the isolation node and the protection node share a database, the isolation node can obtain the access blacklist in the database in real time through the database, and promptly discard the access request message sent by the requester in the access blacklist, thereby realizing real-time protection against DDOS attacks.

[0100] In some embodiments, if the guard node cannot obtain the identifier of the requesting end from the access request message, the access request message is discarded.

[0101] In some embodiments, the isolation node pre-stores an access blacklist, which is used to indicate requesters with security risks. The isolation node can determine whether the requester is on the access blacklist. If the requester is not on the access blacklist, the isolation node receives the access request message sent by the requester.

[0102] In one possible design, if the requesting end is on the access blacklist, the isolation node discards the access request message sent by the requesting end.

[0103] In this way, the isolation node determines whether to receive the access request message sent by the request end by pre-checking whether the request end is in the blacklist. In this way, the isolation node can quickly identify and intercept network attacks, protect the target website, and reduce resource consumption.

[0104] In some embodiments, when the access request message passes the detection, the protection node can convert the data format of the access request message to obtain a converted access request message, the format of the converted access request message is an unmodifiable data format, and the protection node sends the converted access request message to the target website.

[0105] In the embodiment of the present application, the access request message includes the URL information of the target website.

[0106] In a possible implementation, the protection node may obtain the URL information of the target website based on the access request message. Afterwards, the protection node may convert the data format of the access request message based on the URL information of the target website to obtain a converted access request message, the format of the converted access request message is an unmodifiable data format and meets the data format requirements of the target website. Afterwards, the protection node encapsulates the converted access request message, and then, the protection node may send the converted access request message to the target website based on the URL information of the target website.

[0107] Optionally, the URL information of the target website includes the network address of the target website. The protection node can search for the network address of the target website in the database. If the network address of the target website exists in the database, the protection node can send a converted access request message to the target website based on the network address.

[0108] It is understandable that by converting the data format of the access request message, even if the data is intercepted during transmission, the attacker cannot obtain the original data due to the change in the internal structure of the data. In this way, the security of the data during transmission can be ensured to prevent the data from being illegally accessed or stolen. In addition, the format of the converted access request message can meet the data format requirements of the target website, and the access message can be converted according to different websites, so that the converted access request message can be received by the target website, realizing the dynamic conversion of the data format of the access request message.

[0109] After introducing the process of the request end sending an access request message to the target website above, the following introduces the process of the target website sending response data to the request end after receiving the access request message sent by the protection node.

[0110] In some embodiments, the protection node may receive response data sent by the target website, the response data being used to indicate the data requested by the access request message. Afterwards, the protection node may send the response data to the isolation node. The isolation node may receive the response data sent by the protection node and reconstruct the code of the response data, the code reconstruction being used to indicate that the code of the response data is to be modified. The isolation node sends the response data after code reconstruction to the request end.

[0111] In the embodiment of the present application, code refactoring may be DOM refactoring.

[0112] In a possible implementation, the protection node detects the response data and sends the response data that passes the detection to the isolation node. The isolation node receives the response data, reconstructs the response data through DOM, and sends the reconstructed response data to the request end.

[0113] In a possible design, when the response data passes the detection, the protection node encrypts the response data and sends the encrypted response data to the isolation node. Afterwards, the isolation node can parse the response data and construct the DOM tree data and Cascading Style Sheets (CSS) rule tree data of the response data. Afterwards, the isolation node can reconstruct the DOM tree and send the reconstructed DOM tree data and CSS rule tree data to the request end.

[0114] Optionally, before the protection node detects the response data, an encrypted script may be injected into the response data.

[0115] It is understandable that the protection node injects an encrypted script into the response data during quality inspection, which can disrupt the structure of the response data, thereby preventing sensitive information in the response data from being leaked, thereby increasing the security of the response data.

[0116] In this way, the isolation node can reconstruct the response data through DOM, thereby blurring the sensitive data and ensuring the security of the response data during transmission. Even if the response data is intercepted during transmission, the original data cannot be obtained from the response data after DOM reconstruction. In this way, the confidentiality of the information can be strengthened.

[0117] Optionally, the isolation node may send the reconstructed DOM tree data and CSS rule tree data to the request end in binary format, or may send the reconstructed DOM tree data and CSS rule tree data to the request end in JSON format.

[0118] In some embodiments, the requesting end may receive the DOM reconstructed response data sent in isolation, and render the DOM reconstructed response data to obtain the interface of the target website.

[0119] It is understandable that the requester can obtain the target website information, but the response data after DOM reconstruction can hide the Web resources. In this way, the requester can access the target website normally, but cannot obtain sensitive data based on the response data after DOM reconstruction, making the transmission confidentiality between the requester and the target website stronger.

[0120] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. It is understandable that, in order to realize the above functions, the detection device of the access request includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the detection method steps of the access request of each example described in the embodiment disclosed in the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0121] The embodiment of the present application also provides an access request detection device, which can be a server, a CPU in the server, a module in the server for protecting websites, or a client in the server for protecting websites.

[0122] The embodiment of the present application can divide the detection device of the access request into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

[0123] The present application embodiment provides a detection device for access request. Figure 3 As shown, the access request detection device may include: a receiving module 301 and a processing module 302 .

[0124] The receiving module 301 is used to receive an access request message sent by a requesting end through an isolation node, where the access request message is used to request access to a target website.

[0125] The processing module 302 is used to determine the state of the isolation node after receiving the access request message through the isolation node, and the isolation node state is used to indicate whether the isolation node is attacked by a vulnerability type. The processing module 302 is also used to determine the forwarding strategy of the access request message based on the isolation node state through the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. The processing module 302 is also used to perform DDOS attack detection on the access request message through the protection node when the protection node receives the access request message forwarded by the isolation node.

[0126] Figure 4 4 is a schematic diagram of another access request detection device according to an exemplary embodiment. The access request detection device may include a processor 402, and the processor 402 is used to execute application code to implement the access request detection method in the present application.

[0127] The processor 402 may be a CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present application.

[0128] like Figure 4 As shown, the access request detection device may further include a memory 403. The memory 403 is used to store application program codes for executing the solution of the present application, and the execution is controlled by the processor 402.

[0129] The memory 403 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 403 may exist independently and be connected to the processor 402 via the bus 404. The memory 403 may also be integrated with the processor 402.

[0130] like Figure 4 As shown, the access request detection device may further include a communication interface 401, wherein the communication interface 401, the processor 402, and the memory 403 may be coupled to each other, for example, via a bus 404. The communication interface 401 is used to exchange information with other devices, for example, to support information exchange between the access request detection device and other devices.

[0131] It should be pointed out that Figure 4 The device structure shown in the figure does not constitute a limitation on the detection device of the access request, except Figure 4 In addition to the components shown, the access request detection device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0132] In actual implementation, the functions implemented by the processing unit can be Figure 4 The processor 402 shown calls the program code in the memory 403 to implement.

[0133] The present application also provides a computer-readable storage medium, on which instructions are stored, and when the instructions in the computer-readable storage medium are executed by a processor of a computer device, the computer can execute the access request detection method provided in the above-mentioned embodiment. For example, the computer-readable storage medium can be a memory 403 including instructions, and the above instructions can be executed by a processor 402 of a computer device to complete the above method. Optionally, the computer-readable storage medium can be a non-temporary computer-readable storage medium, for example, the non-temporary computer-readable storage medium can be a ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage device, etc.

[0134] Figure 5 A conceptual partial view of a computer program product provided by an embodiment of the present application is schematically shown, where the computer program product includes a computer program for executing a computer process on a computing device.

[0135] In one embodiment, the computer program product is provided using a signal bearing medium 500. The signal bearing medium 500 may include one or more program instructions that, when executed by one or more processors, may provide the above-described Figure 1 , Figure 2 Thus, for example, reference to Figure 2 In the embodiment shown in , one or more features of S201 to S204 may be undertaken by one or more instructions associated with the signal bearing medium 500. In addition, Figure 5 The program instructions in also describe example instructions.

[0136] In some examples, the signal bearing medium 500 may include a computer readable medium 501, such as, but not limited to, a hard drive, a compact disk (CD), a digital video disk (DVD), a digital tape, a memory, a read-only memory (ROM) or a random access memory (RAM), and the like.

[0137] In some implementations, signal bearing medium 500 may include computer recordable medium 502 such as, but not limited to, memory, read / write (R / W) CD, R / W DVD, and the like.

[0138] In some implementations, signal bearing medium 500 may include communication medium 503 such as, but not limited to, digital and / or analog communication media (eg, fiber optic cables, waveguides, wired communication links, wireless communication links, etc.).

[0139] The signal bearing medium 500 may be communicated by a wireless form of communication medium 503. The one or more program instructions may be, for example, computer executable instructions or logic implemented instructions.

[0140] In some examples, the access request detection apparatus may be configured to provide various operations, functions, or actions in response to one or more program instructions in computer-readable medium 501 , computer-recordable medium 502 , and / or communication medium 503 .

[0141] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0142] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0143] The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0144] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0145] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or the full classification part or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium, including a number of instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to execute the full classification part or part of the steps of each embodiment method of the present application. The aforementioned storage medium includes various media that can store program codes, such as-U disk, mobile hard disk, ROM, RAM, disk or CD.

[0146] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for detecting an access request, characterized in that: Applied to a protection system, the protection system comprises: an isolation node and a protection node; the method comprises: The isolation node receives an access request message sent by the requesting end, wherein the access request message is used to request access to a target website; The isolation node determines the isolation node state after receiving the access request message, wherein the isolation node state is used to indicate whether the isolation node is attacked by a vulnerability type, wherein the vulnerability type attack is an attack initiated based on a security vulnerability of the target website; The isolation node determines a forwarding strategy for the access request message based on the isolation node state, where the forwarding strategy is used to indicate whether to forward the access request message to the protection node; When the protection node receives the access request message forwarded by the isolation node, a distributed denial of service (DDOS) attack detection is performed on the access request message.

2. The method according to claim 1, characterized in that The forwarding strategy includes: In the case where the isolated node is attacked by a vulnerability type, refusing to forward the access request message; If the isolated node is not attacked by a vulnerability type, the access request message is forwarded.

3. The method according to claim 1, characterized in that: The method further comprises: In the case where the access request message passes the detection, the protection node converts the data format of the access request message to obtain the converted access request message, and the format of the converted access request message is an unmodifiable data format; The protection node sends the converted access request message to the target website.

4. The method according to claim 1, characterized in that: The isolation node receives the access request message sent by the requesting end, including: The isolation node determines whether the requesting end is accessing a blacklist; If the requesting end is not in the access blacklist, the isolation node receives the access request message sent by the requesting end.

5. The method according to claim 4, characterized in that The method further comprises: If the access request message fails the detection, the protection node discards the access request message and adds the requesting end to the access blacklist; The protection node sends the access blacklist to the isolation node.

6. The method according to claim 1, characterized in that The method also includes: The protection node receives the response data sent by the target website; The protection node sends the response data to the isolation node; The isolation node receives the response data sent by the protection node, and performs code reconstruction on the response data, where the code reconstruction is used to indicate that the code of the response data is modified; The isolation node sends the response data after code reconstruction to the request end.

7. A system for detecting access requests, characterized in that: The protection system comprises: an isolation node and a protection node; The isolation node is used to receive an access request message sent by a requesting end, wherein the access request message is used to request access to a target website; The isolation node is further used to determine the isolation node state after receiving the access request message, and the isolation node state is used to indicate whether the isolation node is attacked by the vulnerability type, and the vulnerability type attack is an attack launched based on the security vulnerability of the target website; The isolation node is further used to determine a forwarding strategy for the access request message based on the isolation node state, wherein the forwarding strategy is used to indicate whether to forward the access request message to the protection node; The protection node is used to perform DDOS attack detection on the access request message when receiving the access request message forwarded by the isolation node.

8. A device for detecting an access request, characterized in that: Applied to a protection system, the protection system comprises: an isolation node and a protection node; the access request detection device comprises a receiving module and a processing module: The receiving module is used to receive an access request message sent by the requesting end through the isolation node, wherein the access request message is used to request access to a target website; The processing module is used to determine, through the isolation node, the isolation node state after receiving the access request message, the isolation node state is used to indicate whether the isolation node is attacked by the vulnerability type, and the vulnerability type attack is an attack launched based on the security vulnerability of the target website; The processing module is further used to determine a forwarding strategy of the access request message based on the state of the isolation node through the isolation node, wherein the forwarding strategy is used to indicate whether to forward the access request message to the protection node; The processing module is further configured to perform DDOS attack detection on the access request message through the protection node when the protection node receives the access request message forwarded by the isolation node.

9. A device for detecting an access request, characterized in that: include: Processor and memory; The processor is coupled to the memory; The memory is used to store one or more programs, and one or more of the programs include computer-executable instructions. When the access request detection device is running, the processor executes the computer-executable instructions stored in the memory to enable the access request detection device to perform the method as described in any one of claims 1-6.

10. A computer-readable storage medium, wherein instructions are stored in the computer-readable storage medium, characterized in that: When a computer executes the instruction, the computer performs the method according to any one of claims 1 to 6.

11. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 6.

Images