Access request detection method, device, system and storage medium

Abstract

The application provides a detection method, device and system of an access request and a storage medium, relates to the technical field of network security, and is used for solving the problem that a website cannot prevent malicious attacks after changing a coding mode. The application is applied to a protection system, and the protection system comprises an isolation node and a protection node. The method comprises the following steps: the isolation node receives an access request message sent by a request end, and the access request message is used for requesting to access a target website; the isolation node determines an isolation node state after the access request message is received, and the isolation node state is used for indicating whether the isolation node is attacked by a vulnerability type; the isolation node determines a forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used for indicating whether the access request message is forwarded to the protection node; and in the case that the protection node receives the access request message forwarded by the isolation node, distributed denial of service (DDOS) attack detection is performed on the access request message.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a detection method, device and system of access request and a storage medium. BACKGROUND

[0002] When a website is accessed, if the access traffic is redirected to a protection gateway, the protection gateway will intercept the access traffic, and identify whether the access traffic contains malicious data based on preset security rules. If the access traffic does not contain malicious data, the access traffic is allowed to access the website. If the access traffic contains malicious data, the access traffic is prevented from accessing the website.

[0003] However, once the attacker changes the encoding mode of the malicious data, the malicious data can bypass the preset security rules and send the attack load to the website, so that the website cannot run.

[0004] Therefore, how to protect the security of the website becomes a technical problem to be solved urgently. SUMMARY

[0005] The present application provides a detection method, device and system of access request and a storage medium, which are used to solve the problem that a website cannot protect malicious attacks after the encoding mode is changed.

[0006] To achieve the above object, the present application adopts the following technical solutions:

[0007] In a first aspect, the present application provides a detection method of access request. In the method, an isolation node receives an access request message sent by a request end, and the access request message is used to request to access a target website. The isolation node determines a state of the isolation node after receiving the access request message, and the state of the isolation node is used to indicate whether the isolation node is attacked by a vulnerability type attack. The vulnerability type attack is an attack launched based on a security vulnerability of the target website. The isolation node determines a forwarding strategy of the access request message based on the state of the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to a protection node. In the case that the protection node receives the access request message forwarded by the isolation node, the protection node performs distributed denial of service (DDOS) attack detection on the access request message.

[0008] Based on the above technical solution, the isolation node can receive the access request message sent by the request end, and the access request message is used to request access to the target website. Then, the isolation node can determine the state of the isolation node after receiving the access request message, and the state of the isolation node is used to indicate whether the isolation node is attacked by a vulnerability type attack, and the vulnerability type attack is an attack based on the security vulnerability of the target website. Then, the isolation node determines the forwarding strategy of the access request message based on the state of the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end and the target website can be isolated, and only the isolation node can be attacked, and the target website cannot be directly attacked. Then, in the case that the protection node receives the access request message forwarded by the isolation node, the access request message is detected for DDOS attack. In this way, the protection node can detect the DDOS attack of the request end on the target website and perform protection. In this way, the isolation node can receive the access request information in a separate isolation environment, and control the vulnerability type attack in the isolation node. The protection node can detect the DDOS attack of the access request message, and realize the protection of the DDOS attack. Further, the protection system can realize multiple protection of the website, and increase the security of the website.

[0009] In a possible design, the forwarding strategy includes: in the case that the isolation node is attacked by a vulnerability type attack, the access request message is refused to be forwarded. In the case that the isolation node is not attacked by a vulnerability type attack, the access request message is forwarded.

[0010] In a possible design, the detection method of the access request further includes: in the case that the access request message passes the detection, the protection node performs data format conversion on the access request message to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format. The protection node sends the converted access request message to the target website.

[0011] In a possible design, the isolation node receives the access request message sent by the request end, including: the isolation node determines whether the request end is in the access blacklist. If the request end is not in the access blacklist, the isolation node receives the access request message sent by the request end.

[0012] In a possible design, the detection method of the access request further includes: in the case that the access request message does not pass the detection, the protection node discards the access request message and adds the request end to the access blacklist. The protection node sends the access blacklist to the isolation node.

[0013] In a possible design, the method further includes: receiving, by the guard node, response data sent by the target website, the response data being used to indicate data requested by the access request message; and sending, by the guard node, the response data to the isolation node. The isolation node receives the response data sent by the guard node, and performs code reconstruction on the response data, the code reconstruction being used to indicate modification of code of the response data. The isolation node sends the response data after code reconstruction to the request end.

[0014] In a second aspect, the present application provides a screen projection system, which includes an isolation node and a guard node.

[0015] The isolation node is configured to receive an access request message sent by a request end, the access request message being used to request access to a target website. The isolation node is further configured to determine a state of the isolation node after receiving the access request message, the state of the isolation node being used to indicate whether the isolation node is attacked by a vulnerability type attack, the vulnerability type attack being an attack initiated based on a security vulnerability of the target website. The isolation node is further configured to determine a forwarding strategy of the access request message based on the state of the isolation node, the forwarding strategy being used to indicate whether to forward the access request message to the guard node. The guard node is configured to perform DDOS attack detection on the access request message in a case where the guard node receives the access request message forwarded by the isolation node.

[0016] In a third aspect, the present application provides a device for detecting an access request, which includes a receiving module and a processing module.

[0017] The receiving module is configured to receive, by the isolation node, an access request message sent by a request end, the access request message being used to request access to a target website. The processing module is configured to determine, by the isolation node, a state of the isolation node after receiving the access request message, the state of the isolation node being used to indicate whether the isolation node is attacked by a vulnerability type attack, the vulnerability type attack being an attack initiated based on a security vulnerability of the target website. The processing module is further configured to determine, by the isolation node, a forwarding strategy of the access request message based on the state of the isolation node, the forwarding strategy being used to indicate whether to forward the access request message to the guard node. The processing module is further configured to perform, by the guard node, DDOS attack detection on the access request message in a case where the guard node receives the access request message forwarded by the isolation node.

[0018] In a possible design, the forwarding strategy includes: in a case where the isolation node is attacked by the vulnerability type attack, the access request message is refused to be forwarded. In a case where the isolation node is not attacked by the vulnerability type attack, the access request message is forwarded.

[0019] In a possible design, the processing module is configured to perform data format conversion on the access request message by the guard node to obtain a converted access request message in a non-modifiable data format if the access request message passes the detection. The apparatus further includes a sending module configured to send the converted access request message to the target website by the guard node.

[0020] In a possible design, the processing module is configured to determine whether the request end is on the access blacklist by the isolation node. The receiving module is configured to receive the access request message sent by the request end by the isolation node if the request end is not on the access blacklist.

[0021] In a possible design, the processing module is configured to discard the access request message by the guard node if the access request message fails the detection, and add the request end to the access blacklist. The sending module is configured to send the access blacklist to the isolation node by the guard node.

[0022] In a possible design, the receiving module is configured to receive response data sent by the target website by the guard node, the response data being used to indicate data requested by the access request message. The sending module is configured to send the response data to the isolation node by the guard node. The receiving module is further configured to receive the response data sent by the guard node by the isolation node. The processing module is configured to perform code reconstruction on the response data by the isolation node, the code reconstruction being used to indicate modification of code of the response data. The sending module is further configured to send the response data after code reconstruction to the request end by the isolation node.

[0023] In a fourth aspect, the present application provides a detection apparatus for an access request, the apparatus comprising: a processor and a memory; the processor and the memory are coupled; the memory is configured to store one or more programs, the one or more programs comprising computer execution instructions, when the detection apparatus for the access request is running, the processor executes the computer execution instructions stored in the memory to implement the method described in the first aspect and any possible implementation manner of the first aspect.

[0024] In a fifth aspect, the present application provides a computer readable storage medium, the computer readable storage medium storing instructions, when the instructions are running on a computer, causing the computer to execute the method described in the first aspect and any possible implementation manner of the first aspect.

[0025] In a sixth aspect, the present application provides a chip, the chip comprising a processor and a communication interface, the communication interface and the processor being coupled, the processor being configured to run a computer program or instructions to implement the method described in the first aspect and any possible implementation manner of the first aspect.

[0026] In a seventh aspect, the present application provides a computer program product comprising instructions which, when executed by a computer, cause the computer to carry out the method described in the first aspect and any possible implementation manner of the first aspect.

[0027] The technical problems and technical effects solved by the detection system of the access request, the detection device of the access request, the computer device, the computer storage medium, the chip or the computer program product in the above solutions can refer to the technical problems and technical effects solved by the first aspect, which will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0028] Figure 1 A system architecture diagram of a detection system of an access request provided by an embodiment of the present application;

[0029] Figure 2 A flowchart of a detection method of an access request provided by an embodiment of the present application;

[0030] Figure 3 A structural diagram of a detection device of an access request provided by an embodiment of the present application;

[0031] Figure 4 A structural diagram of another detection device of an access request provided by an embodiment of the present application;

[0032] Figure 5 A conceptual partial view of a computer program product provided by an embodiment of the present application. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0034] The terms “first” and “second” in the specification and claims of the present application are used to distinguish different objects, rather than to describe a specific order of the objects.

[0035] In addition, the terms “include” and “have” and any variations thereof mentioned in the description of the present application are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or modules is not limited to the listed steps or modules, but can optionally include other steps or modules not listed, or can optionally include other steps or modules inherent to the process, method, product or device.

[0036] In addition, in the embodiments of the present application, the word "exemplary" or "for example" is used to mean serving as an example, instance, or illustration. Any embodiment or design described in this application as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the embodied examples are intended to explain the concepts defined by the application.

[0037] The network application firewall technology can detect and filter the traffic in and out of the Web page through preset rules, identify and block potential malicious requests, thereby protecting the security of the Web application. The network application firewall technology usually includes a traffic interception and analysis module, a rule engine module, a threat response module, a log and report module. When the request end initiates a request to the website through the browser, the traffic interception module intercepts the request and sends it to the traffic analysis module for analysis. After the traffic analysis module completes the analysis, the rule engine module determines whether the traffic meets the security standards according to the preset rules. If the traffic does not meet the security standards, the threat response module will take appropriate measures, and the log record and report module will generate detailed logs and reports. The protection effect of the network application firewall technology depends largely on the quality and update frequency of the rule set. For zero-day vulnerability attacks, it may not be able to respond in time.

[0038] The remote browser isolation technology can physically isolate the browser environment from the user terminal, ensuring that the target network cannot be directly attacked when the request end accesses the target network. The remote browser isolation technology deploys the browser running environment on a remote server, which can enable all Web content processing and rendering work to be performed on the remote browser end. When the request end attacks the target website, it only attacks the remote server, and the target network can still operate normally, thereby achieving physical isolation.

[0039] The remote browser isolation technology includes pixel pushing, document object model (DOM) reconstruction, and vector rendering. Since the remote browser isolation technology can enable all executable code to be processed in the isolation environment, all interactions between the request end and the page are performed in the isolation environment. In this way, even if the access traffic of the request end contains malicious content, the target website will not be affected. However, this technology has high bandwidth requirements, and once the attacker launches a DDOS attack, the protection system is prone to a paralyzed state, thereby affecting the normal business of the website.

[0040] Therefore, how to protect the security of the website has become a technical problem to be solved.

[0041] To solve the above technical problems, an access request detection method is provided in the embodiments of the present application. In the method, the isolation node can receive an access request message sent by a request end, and the access request message is used to request access to a target website. Then, the isolation node can determine the state of the isolation node after receiving the access request message, and the state of the isolation node is used to indicate whether the isolation node is attacked by a vulnerability type attack, and the vulnerability type attack is an attack launched based on a security vulnerability of the target website. Then, the isolation node determines a forwarding strategy of the access request message based on the state of the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end can be isolated from the target website, and can only attack the isolation node, but cannot directly attack the target website. Then, in the case that the protection node receives the access request message forwarded by the isolation node, the protection node performs DDOS attack detection on the access request message. In this way, the protection node can detect the DDOS attack of the request end on the target website and perform protection. In this way, the isolation node can receive the access request information in a separate isolation environment, and control the vulnerability type attack in the isolation node. The protection node can perform DDOS attack detection on the access request message, and realize protection against the DDOS attack. Further, the protection system can realize multiple protection of the website, and increase the security of the website.

[0042] The implementation environment of the embodiments of the present application is introduced below.

[0043] As shown in the system architecture diagram of an access request detection system provided by the embodiments of the present application, the system includes an isolation node 101 and a protection node 102. Figure 1

[0044] The isolation node 101 is used to receive an access request message sent by a request end. In addition, the isolation node 101 is also used to determine the state of the isolation node after receiving the access request message. In addition, the isolation node 101 is also used to determine a forwarding strategy of the access request message based on the state of the isolation node, to determine whether to send the access request message to the protection node 102. In addition, the isolation node 101 is also used to generate an isolation environment, and the isolation node 101 can parse the access request message in the isolation environment. In addition, the isolation node 101 is also used to receive response data sent by the protection node 102, and perform DOM reconstruction on the response data. In addition, the isolation node 101 is also used to send the response data after DOM reconstruction to the request end.

[0045] The protection node 102 is used to detect the access request message. In addition, the protection node 102 is also used to perform data format conversion on the access request message, and send the converted access request message to the target website. In addition, the protection node 102 is also used to receive response data sent by the target website, and send the response data to the isolation node 101. ​

[0046] It can be understood that the isolation node 101 resolves the access request information in the isolation environment, and if the isolation node 101 is subjected to a vulnerability type attack, the vulnerability type attack can be controlled in the isolation environment. In this way, it can be ensured that the target website can normally run.

[0047] In some embodiments, the protection system further includes a request device 103. The request device 103 is configured to send an access request message to the isolation node 101.

[0048] It should be understood that the request device 103 can send an access request message to the isolation node 101 as a request end.

[0049] For example, the request device 103 in the embodiments of the present application can be a tablet computer, a mobile phone, a desktop computer, a laptop computer, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, a cellular phone, a personal digital assistant (PDA), an augmented reality (AR) \ virtual reality (VR) device, a vehicle-mounted device, and the like. The specific form of the request end 103 is not specially limited in the embodiments of the present application.

[0050] In some embodiments, the isolation node 101 can determine whether the request end 103 is in an access blacklist to determine whether to receive the access request message sent by the request end 103.

[0051] In some embodiments, if the access request message fails to pass the detection, the protection node 102 can add the request end 103 to the access blacklist and send the access blacklist to the isolation node.

[0052] In some embodiments, the protection system further includes a website device 104. The website device 104 is configured to receive the access request information sent by the protection node 102 and send response data to the protection node 102.

[0053] It should be understood that the target website runs on the website device 104.

[0054] It should be noted that the isolation node 101 and the protection node 102 can be on the same server or on different servers, and the present application does not limit this.

[0055] The isolation node 101, the protection node 102 and the website device 104 in the embodiments of the present application can be a physical server or a cloud server. The server can be a single server, or can also be a server cluster composed of multiple servers. In some embodiments, the server cluster can also be a distributed cluster. The specific implementation of the server is not limited in the present disclosure.

[0056] It should be noted that the server where the isolation node 101 and the protection node 102 are located is different from the server where the website device 104 is located.

[0057] The embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0058] As shown in the method for detecting an access request provided by the embodiments of the present application, the method comprises the following steps: Figure 2

[0059] S201, the isolation node receives an access request message sent by the request end.

[0060] The access request message is used to request to obtain information of a target website.

[0061] In one possible implementation, the isolation node can receive a connection request message sent by the request end, and establish a connection relationship with the request end based on the connection request message. Then, the isolation node can receive an access request message sent by the request end.

[0062] For example, the request end sends an HTTP request message to the isolation node, the HTTP request message is used to indicate the request end and the isolation node to establish a WebSocket connection relationship, and the HTTP request message carries specific parameters for the request end and the isolation node to establish the WebSocket connection relationship, such as a sub-protocol, a compression option, etc. The isolation node can receive the HTTP request message. If the isolation node supports the WebSocket protocol, the isolation node can establish a WebSocket connection relationship with the request end.

[0063] In this way, the communication protocol between the request end and the isolation node can be upgraded from the HTTP protocol to the WebSocket protocol. The request end and the isolation node can receive and send data based on the connection relationship.

[0064] In another possible implementation, the isolation node has already established a connection relationship with the request end, and the isolation node can directly receive an access request message sent by the request end.

[0065] S202, the isolation node determines the state of the isolation node after receiving the access request message.

[0066] ​The isolated node status indicates whether the isolated node has been attacked by a vulnerability type attack, which is an attack launched based on a security vulnerability of the target website.

[0067] Optionally, vulnerability type attacks can include zero-day vulnerability type attacks and unknown vulnerability type attacks.

[0068] It should be noted that zero-day vulnerabilities are security vulnerabilities that are exploited maliciously immediately after being discovered; that is, malicious programs appear on the same day that a security patch is released and the vulnerability is exposed. Unknown vulnerabilities are security vulnerabilities that have not been publicly disclosed and cannot be protected against using existing patches.

[0069] It should be noted that if the status of an isolated node is used to indicate that the isolated node has been attacked by a vulnerability, it means that the isolated node has been attacked, but it does not mean that the isolated node detected the vulnerability in the access request message in advance.

[0070] In this embodiment, the state of an isolated node can be represented by numbers (e.g., 0, 1). Alternatively, the state information of an isolated node can be represented by letters (e.g., a, b). Alternatively, the state information of an isolated node can be represented by a combination of letters and numbers.

[0071] For example, if the isolation node status is 0, it indicates that the isolation node has been attacked by a vulnerability type; if the isolation node status is 1, it indicates that the isolation node has not been attacked by a vulnerability type.

[0072] In one possible implementation, the isolation node parses the access request message. During this parsing process, the isolation node generates operational information. Based on this information, the isolation node can determine whether it has been attacked using a specific vulnerability.

[0073] In one possible design, operational information may include at least one of the following: network traffic status, resource usage information, isolation node operation logs, and isolation node script execution status. Network traffic status indicates whether network traffic is abnormal; resource usage information indicates the CPU or memory resources used by the isolation node; the isolation node operation logs indicate whether the isolation node has encountered errors or crashes; and the isolation node script execution status indicates whether the isolation node has executed unauthorized scripts.

[0074] For example, the preset traffic security threshold for the isolation node is 500 megabytes per hour. If the isolation node detects 1000 megabytes of data uploaded or downloaded within one hour, it determines that the network traffic is abnormal, thereby determining that the isolation node has been attacked by a vulnerability.

[0075] It should be noted that the isolation node cannot prevent the vulnerability type attack in advance. In the case that the isolation node is subjected to the vulnerability type attack, the isolation node can discard the access request message with the vulnerability type attack, and determine the isolation node state as the isolation node being subjected to the vulnerability type attack.

[0076] In this way, the isolation node does not forward the access request message to the protection node, thereby isolating the vulnerability type attack in the isolation node, so that the vulnerability type attack cannot continue to attack the target website.

[0077] In a possible implementation, in the case that the isolation node is subjected to the DDOS attack, after the isolation node receives the access request message, the isolation node state is used to indicate that the isolation node is not subjected to the vulnerability type attack.

[0078] S203, the isolation node determines a forwarding strategy of the access request message based on the isolation node state.

[0079] The forwarding strategy is used to indicate whether to forward the access request message to the protection node.

[0080] In a possible implementation, in the case that the isolation node is subjected to the vulnerability type attack, the isolation node refuses to forward the access request message. In the case that the isolation node is not subjected to the vulnerability type attack, the isolation node forwards the access request message.

[0081] In the embodiment of the application, in the case that the isolation node is subjected to the vulnerability type attack, the isolation node discards the access request message, and adds the request end to an access blacklist.

[0082] Optionally, in the case that the isolation node is not subjected to the vulnerability type attack, the isolation node encrypts the access request message, and forwards the encrypted access request message to the protection node.

[0083] It can be understood that the isolation node can perform physical isolation between the request end and the target website. In this way, in the case that the isolation node is subjected to the vulnerability type attack, the target website can still normally run.

[0084] In some embodiments, the isolation node can generate the access request message based on a website address or a click operation input by the request end, and forward the access request message to the protection node.

[0085] It should be noted that after the isolation node forwards the access request message, the isolation node can discard the access request message, so that the access request message is not leaked.

[0086] S204, in the case that the protection node receives the access request message forwarded by the isolation node, performing DDOS attack detection on the access request message.

[0087] The DDOS attack detection is used to determine whether the number of access request messages sent by the request end exceeds a preset access number threshold.

[0088] Optionally, the DDOS attack detection can include challenge collapsar (CC) attack detection.

[0089] In a possible implementation, the access request message includes an identifier of the request end. The guard node can store the number of access request messages sent by each request end. The guard node can receive the access request message forwarded by the isolation node, and determine the number of access request messages of the request end based on the identifier of the request end. Then, the DDOS attack detection can be performed on the access request message based on the number of access request messages of the request end.

[0090] In the embodiments of the present application, if the number of access request messages of the request end is greater than the preset access number threshold, it is determined that the access request message fails the DDOS attack detection. If the number of access request messages sent by the request end is less than the preset access number threshold, it is determined that the access request message passes the DDOS attack detection.

[0091] It should be noted that the number of access request messages can be the number of messages in a preset time period before the current time. For example, the current time is 4 pm, and the preset time period is two hours. If the number of messages in the time period from 2 pm to 4 pm is 100, and the number of messages in the time period from 1 pm to 4 pm is 300, the number of access request messages is 100.

[0092] It can be understood that the isolation node cannot identify the DDOS attack and will continue to forward the access request message, and cannot isolate the DDOS attack in the isolation node. The guard node can perform the DDOS attack detection on the access request message, so as to intercept the DDOS attack, so that the website will not be attacked by the DDOS attack. In this way, multiple protections of the website can be achieved.

[0093] Based on the above technical solution, the isolation node can receive the access request message sent by the request end, and the access request message is used to request access to the target website. Then, the isolation node can determine the state of the isolation node after receiving the access request message, and the state of the isolation node is used to indicate whether the isolation node is attacked by the vulnerability type attack. Then, the isolation node determines the forwarding strategy of the access request message based on the state of the isolation node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. In this way, the request end and the target website can be isolated, and the request end can attack the isolation node, but cannot directly attack the target website. Then, in the case that the protection node receives the access request message forwarded by the isolation node, the protection node performs DDOS attack detection on the access request message. In this way, the protection node can detect the DDOS attack of the request end on the target website and perform protection. In this way, the isolation node can isolate the access request information in a separate virtual space, and realize protection against vulnerability type attacks. The protection node can determine the number of access request messages sent by the request end, and realize protection against DDOS attacks. Further, the protection system can realize multiple protection of the website, and increase the security of the website.

[0094] In some embodiments, the protection node can pre-store a security protection rule. Before the protection node performs DDOS attack detection on the access request message, the protection node can perform security judgment on the access request message based on the security protection rule. If the protection node judges that the access request message is a dangerous type message, the access request message is discarded; if the protection node judges that the access request message is a safe type message, the protection node performs DDOS attack detection on the access request message.

[0095] It can be understood that if the isolation node misreports a dangerous type message, the protection node can perform secondary protection on the target website, so that the security of the target website is stronger, and the normal operation of the target website is ensured.

[0096] In some embodiments, in the case that the access request message fails to pass the detection, the protection node can discard the access request message and add the request end to the access blacklist. The protection node sends the access blacklist to the isolation node.

[0097] It can be understood that in this way, the protection node can prevent the request end from launching further attacks, reduce the risk of potential attack behavior on the target website, and thus strengthen the security of the target website.

[0098] In some embodiments, the protection node and the isolation node share a database, and the database includes an access blacklist. In the case that the access request message fails to pass the detection, the protection node can add the request end to the access blacklist.

[0099] In this way, the guard node can update the access blacklist in the database in real time, so as to realize dynamic adjustment of the access blacklist. Since the isolation node and the guard node share a database, the isolation node can obtain the access blacklist in the database in real time through the database, and discard the access request message sent by the request end in the access blacklist in time, so as to realize real-time protection against DDOS attacks.

[0100] In some embodiments, if the guard node cannot obtain the identifier of the request end from the access request message, the access request message is discarded.

[0101] In some embodiments, the isolation node pre-stores an access blacklist, and the access blacklist is used to indicate a request end with security risks. The isolation node can determine whether the request end is in the access blacklist. If the request end is not in the access blacklist, the isolation node receives the access request message sent by the request end.

[0102] In a possible design, if the request end is in the access blacklist, the isolation node discards the access request message sent by the request end.

[0103] In this way, the isolation node determines whether to receive the access request message sent by the request end by pre-checking whether the request end is in the blacklist. In this way, the isolation node can quickly identify and intercept network attacks, protect the target website, and can reduce resource consumption.

[0104] In some embodiments, in the case that the access request message is detected, the guard node can perform data format conversion on the access request message to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format. The guard node sends the converted access request message to the target website.

[0105] In the embodiments of the present application, the access request message includes the website information of the target website.

[0106] In a possible implementation, the guard node can obtain the website information of the target website based on the access request message. Then, the guard node can perform data format conversion on the access request message based on the website information of the target website to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format and meets the data format requirements of the target website. Then, the guard node encapsulates the converted access request message, and then the guard node sends the converted access request message to the target website based on the website information of the target website.

[0107] Optionally, the website information of the target website includes a network address of the target website, the protection node can search the network address of the target website in the database, and if the network address of the target website exists in the database, the protection node can send the converted access request message to the target website based on the network address.

[0108] It can be understood that the data format conversion of the access request message can ensure the security of the data in the transmission process, and prevent the data from being illegally accessed or stolen. Moreover, the format of the converted access request message can meet the data format requirements of the target website, and the data conversion of the access message can be performed according to different websites, so that the converted access request message can be received by the target website, and the dynamic conversion of the data format of the access request message is realized.

[0109] After the above process of sending the access request message to the target website by the request end is introduced, the process of sending the response data by the target website to the request end after receiving the access request message sent by the protection node is introduced.

[0110] In some embodiments, the protection node can receive the response data sent by the target website, and the response data is used to indicate the data requested by the access request message. Then, the protection node can send the response data to the isolation node. The isolation node can receive the response data sent by the protection node, and perform code reconstruction on the response data, and the code reconstruction is used to indicate that the code of the response data is modified. The isolation node sends the response data after code reconstruction to the request end.

[0111] In the embodiments of the present application, the code reconstruction can be DOM reconstruction.

[0112] In a possible implementation, the protection node detects the response data and sends the response data passing the detection to the isolation node. The isolation node receives the response data and performs DOM reconstruction on the response data, and sends the reconstructed response data to the request end.

[0113] In a possible design, in the case that the response data passes the detection, the protection node encrypts the response data and sends the encrypted response data to the isolation node. Then, the isolation node can parse the response data and construct DOM tree data and Cascading Style Sheets (CSS) rule tree data of the response data. Then, the isolation node can reconstruct the DOM tree and send the reconstructed DOM tree data and CSS rule tree data to the request end.

[0114] Optionally, before the protection node detects the response data, an encryption script can be injected into the response data.

[0115] It can be understood that the guard node can disturb the structure in the response data by detecting the quality inspection and injecting the encrypted script in the response data, so that the sensitive information in the response data is not leaked, and the security of the response data is increased.

[0116] In this way, the isolation node can perform DOM reconstruction on the response data, so as to realize the blurring processing of the sensitive data, and ensure the security of the response data in the transmission process. Even if the response data is intercepted in the transmission process, the original data cannot be obtained from the DOM reconstructed response data. In this way, the information security can be stronger.

[0117] Optionally, the isolation node can send the reconstructed DOM tree data and the CSS rule tree data to the request end in a binary format, or send the reconstructed DOM tree data and the CSS rule tree data to the request end in a JSON format.

[0118] In some embodiments, the request end can receive the DOM reconstructed response data sent by the isolation, and render the DOM reconstructed response data to obtain the interface of the target website.

[0119] It can be understood that the request end can obtain the target website information, but the DOM reconstructed response data can hide the web resources. In this way, the request end can normally access the target website, but cannot obtain the sensitive data based on the DOM reconstructed response data, so that the transmission security between the request end and the target website is stronger.

[0120] The above mainly describes the scheme provided by the embodiments of the application from the perspective of the method. It can be understood that the access request detection device contains the hardware structure and / or software module corresponding to the execution of each function in order to realize the above functions. Those skilled in the art should easily realize that the access request detection method steps of each example described in combination with the embodiments disclosed in the application can be realized in the form of hardware or combination of hardware and computer software. Whether a certain function is executed by hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the application.

[0121] The embodiments of the application also provide an access request detection device. The access request detection device can be a server, or a CPU in the server, or a module for protecting a website in the server, or a client for protecting a website in the server.

[0122] This application embodiment can divide the access request detection device into functional modules or functional units according to the above method example. For example, each function can be divided into a separate functional module or functional unit, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or in software functional modules or functional units. The module or unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0123] This application provides an access request detection device. For example... Figure 3 As shown, the detection device for the access request may include a receiving module 301 and a processing module 302.

[0124] The receiving module 301 is used to receive access request messages sent by the requesting end through the isolation node. The access request messages are used to request access to the target website.

[0125] Processing module 302 is used to determine the status of the isolated node after receiving the access request message, and the status of the isolated node is used to indicate whether the isolated node has been attacked by a vulnerability type. Processing module 302 is also used to determine the forwarding strategy of the access request message based on the status of the isolated node, and the forwarding strategy is used to indicate whether to forward the access request message to the protection node. Processing module 302 is also used to perform DDoS attack detection on the access request message through the protection node when the protection node receives the access request message forwarded by the isolated node.

[0126] Figure 4 This is a schematic diagram illustrating the structure of another access request detection apparatus according to an exemplary embodiment. The access request detection apparatus may include a processor 402, which executes application code to implement the access request detection method of this application.

[0127] Processor 402 may be a CPU, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs according to the present application.

[0128] like Figure 4 As shown, the access request detection device may further include a memory 403. The memory 403 stores the application code that executes the scheme of this application, and its execution is controlled by the processor 402.

[0129] The memory 403 can be a Read-Only Memory (ROM) or other type of static storage device that can store static information and instructions, a Random Access Memory (RAM) or other type of dynamic storage device that can store information and instructions, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Compact Disc Read-Only Memory (CD-ROM) or other optical disk storage, a magneto-optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to this. The memory 403 can exist independently and be connected to the processor 402 through the bus 404. The memory 403 can also be integrated with the processor 402.

[0130] As shown in Figure 4 The detection apparatus of the access request can also include a communication interface 401, wherein the communication interface 401, the processor 402, and the memory 403 can be coupled to each other, for example, through the bus 404. The communication interface 401 is used to interact with other devices, for example, to support the information interaction between the detection apparatus of the access request and other devices.

[0131] It should be noted that the device structure shown in Figure 4 does not constitute a limitation on the detection apparatus of the access request. In addition to the components shown in Figure 4 , the detection apparatus of the access request can include more or fewer components than those shown, or combine certain components, or arrange different components.

[0132] In actual implementation, the functions implemented by the processing unit can be implemented by the processor 402 calling the program code in the memory 403. Figure 4

[0133] ​The application further provides a computer readable storage medium, and instructions are stored on the computer readable storage medium. When the instructions in the computer readable storage medium are executed by a processor of a computer device, the computer can execute the access request detection method provided by the above-mentioned embodiments. For example, the computer readable storage medium can be a memory 403 including instructions, and the above-mentioned instructions can be executed by the processor 402 of the computer device to complete the above-mentioned method. Alternatively, the computer readable storage medium can be a non-transitory computer readable storage medium, for example, the non-transitory computer readable storage medium can be a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, and an optical data storage device, etc.

[0134] Figure 5 A conceptual partial view of a computer program product provided by an embodiment of the application is schematically shown, and the computer program product includes a computer program for executing a computer process on a computing device.

[0135] In one embodiment, the computer program product is provided using a signal bearing medium 500. The signal bearing medium 500 can include one or more program instructions which, when executed by one or more processors, can provide the functionality or some portion thereof described above with respect to Figure 1 、 Figure 2 the embodiments shown in FIG. 7. Thus, for example, with reference to the embodiments shown in FIG. 7, one or more features of S201-S204 can be assumed by one or more instructions associated with the signal bearing medium 500. Further, the program instructions in the signal bearing medium 500 also describe example instructions. Figure 2 Figure 5

[0136] In some examples, the signal bearing medium 500 can include a computer readable medium 501 such as, but not limited to, a hard disk drive, a compact disc (CD), a digital video disc (DVD), a digital tape, memory, read-only memory (ROM), or a random access memory (RAM), etc.

[0137] In some embodiments, the signal bearing medium 500 can include a computer recordable medium 502 such as, but not limited to, a memory, a read / write (R / W) CD, a R / W DVD, etc.

[0138] In some embodiments, the signal bearing medium 500 can include a communication medium 503 such as, but not limited to, a digital and / or an analog communication medium (e.g., a fiber optic cable, a waveguide, a wired communication link, a wireless communication link, etc.).

[0139] ​​The signal-bearing medium 500 can be conveyed by a wireless form of the communication medium 503. The one or more program instructions can be, for example, computer-executable instructions or logic-implementing instructions.

[0140] In some examples, the detection apparatus of the access request can be configured to provide various operations, functions, or actions in response to the one or more program instructions of the computer-readable medium 501, the computer-recordable medium 502, and / or the communication medium 503.

[0141] From the above description of the embodiments, it is apparent that for the convenience and conciseness of description, only the division of the above functional modules is taken as an example for description, and in actual application, the above functions can be completed by different functional modules, that is, the internal structure of the apparatus is divided into different functional modules to complete the full classification or part of the functions described above.

[0142] In several embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented by other ways. For example, the apparatus embodiments described above are only illustrative, for example, the division of the modules or units is only a logical function division, and in actual implementation, there can be another division way, for example, a plurality of units or components can be combined or integrated into another apparatus, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or components shown or discussed can be indirect coupling or communication connection through some interfaces, apparatuses or units, which can be electrical, mechanical or other forms.

[0143] The units described as separate components can or can not be physically separate, and the components shown as units can be one physical unit or multiple physical units, that is, can be located in one place, or can be distributed to multiple different places. Part or all of the classification units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0144] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present separately, or two or more units can be integrated in one unit. The above integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0145] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a readable storage medium. Based on such understanding, the technical solutions of the embodiments of the present application essentially or say the part that contributes to the prior art or the whole classification part or part of the technical solutions can be embodied in the form of a software product. The software product is stored in a storage medium, including a plurality of instructions to make a device (which can be a single-chip microcomputer, a chip, etc.) or a processor execute the whole classification part or part of the steps of the method of each embodiment of the present application. The storage medium mentioned above includes a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, and various storage program codes.

[0146] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any change or replacement within the technical scope disclosed in the present application should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of detecting access requests, characterized by, The application is applied to a protection system, and the protection system comprises an isolation node and a protection node; the method comprises the following steps: The isolation node receives an access request message sent by a request end, and the access request message is used for requesting to access a target website; The isolation node determines an isolation node state after receiving the access request message, and the isolation node state is used for indicating whether the isolation node is attacked by a vulnerability type attack, and the vulnerability type attack is an attack initiated based on a security vulnerability of the target website; The isolation node determines a forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used for indicating whether the access request message is forwarded to the protection node; In the case that the protection node receives the access request message forwarded by the isolation node, the protection node performs distributed denial of service (DDOS) attack detection on the access request message; In the case that the access request message passes the detection, the protection node performs data format conversion on the access request message to obtain a converted access request message, and the format of the converted access request message is an unmodifiable data format; The protection node sends the converted access request message to the target website; The protection node receives response data sent by the target website; The protection node sends the response data to the isolation node; The isolation node receives the response data sent by the protection node and performs code reconstruction on the response data, and the code reconstruction is used for indicating that the code of the response data is modified; The isolation node sends the code-reconstructed response data to the request end.

2. The method of claim 1, wherein, The forwarding strategy comprises the following steps: In the case that the isolation node is attacked by the vulnerability type attack, the access request message is refused to be forwarded; In the case that the isolation node is not attacked by the vulnerability type attack, the access request message is forwarded.

3. The method of claim 1, wherein, The isolation node receiving the access request message sent by the request end comprises the following steps: The isolation node determines whether the request end is in an access blacklist; If the request end is not in the access blacklist, the isolation node receives the access request message sent by the request end.

4. The method of claim 3, wherein, The method further comprises the following steps: In the case that the access request message fails to pass the detection, the protection node discards the access request message and adds the request end to the access blacklist; The protection node sends the access blacklist to the isolation node.

5. A protection system characterized by, The protection system comprises an isolation node and a protection node; The isolation node is configured to receive an access request message sent by a request end, and the access request message is used for requesting to access a target website; The isolation node is further configured to determine an isolation node state after receiving the access request message, and the isolation node state is used for indicating whether the isolation node is attacked by a vulnerability type attack, and the vulnerability type attack is an attack initiated based on a security vulnerability of the target website; The isolation node is further configured to determine a forwarding strategy of the access request message based on the isolation node state, and the forwarding strategy is used for indicating whether the access request message is forwarded to the protection node; The protection node is configured to perform DDOS attack detection on the access request message when the access request message is received from the isolation node. The protection node is further configured to perform data format conversion on the access request message to obtain a converted access request message when the access request message passes the detection, wherein the format of the converted access request message is an unmodifiable data format. The protection node is further configured to send the converted access request message to the target website. The protection node is further configured to receive response data sent by the target website. The protection node is further configured to send the response data to the isolation node. The isolation node is further configured to receive the response data sent by the protection node and perform code reconstruction on the response data, wherein the code reconstruction is configured to indicate modification of the code of the response data. The isolation node is further configured to send the response data after code reconstruction to the request end.

6. An access request detection apparatus characterized by comprising: The application is applied to a protection system, and the protection system comprises an isolation node and a protection node. The receiving module is configured to receive an access request message sent by a request end through the isolation node, wherein the access request message is used to request access to a target website. The processing module is configured to determine a state of the isolation node after the access request message is received through the isolation node, wherein the state of the isolation node is used to indicate whether the isolation node is attacked by a vulnerability type attack, and the vulnerability type attack is an attack initiated based on a security vulnerability of the target website. The processing module is further configured to determine a forwarding strategy of the access request message based on the state of the isolation node through the isolation node, wherein the forwarding strategy is used to indicate whether the access request message is forwarded to the protection node. The processing module is further configured to perform DDOS attack detection on the access request message through the protection node when the access request message is received from the isolation node by the protection node. The processing module is further configured to perform data format conversion on the access request message to obtain a converted access request message when the access request message passes the detection, wherein the format of the converted access request message is an unmodifiable data format. The sending module is configured to send the converted access request message to the target website. The receiving module is further configured to receive response data sent by the target website. The sending module is further configured to send the response data to the isolation node. The receiving module is further configured to receive the response data sent by the protection node. The processing module is further configured to perform code reconstruction on the response data, wherein the code reconstruction is configured to indicate modification of the code of the response data. The sending module is further configured to send the response data after code reconstruction to the request end.

7. An access request detecting apparatus characterized by comprising: The application comprises: a processor and a memory; the processor and the memory are coupled. The memory is configured to store one or more programs, the one or more programs comprising computer-executable instructions that, when executed by the access request detecting apparatus, cause the processor to execute the computer-executable instructions stored by the memory to cause the access request detecting apparatus to perform the method of any one of claims 1-4.

8. A computer-readable storage medium having stored therein instructions, the computer-readable storage medium comprising: When the computer executes the instructions, the computer performs the method of any one of claims 1-4.

9. A computer program product comprising instructions, characterized in that, When the instructions are executed by a computing device, the computing device is caused to perform the method of any one of claims 1-4.

Images