Security protection method and device, electronic equipment and computer readable storage medium

Abstract

The invention provides a security protection method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of computers. The security protection method comprises the following steps: acquiring to-be-detected data; for any component of the to-be-detected data, detecting the component based on a preset detection rule corresponding to the component to obtain a detection result of whether the component comprises an injection point; wherein the preset detection rules corresponding to different components of the to-be-detected data are not completely the same, and the preset detection rules are used for detecting whether an injection point exists or not; and if the detection result of any one component represents that the injection point exists, performing exception processing on the to-be-detected data. According to the scheme, the preset detection rules are set for different components, targeted detection can be carried out for the types of the injection points possibly existing in the different components, the accuracy is higher, and the false alarm rate of safety protection products is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of computers, and in particular, to a security protection method, device, electronic device and computer-readable storage medium. Background Art

[0002] Web (World Wide Web, Global Wide Area Network) vulnerability mining and attack tools make Web application protection a top priority. At present, many security protection products have been developed for Web applications, such as Waf (Web Application Firewall), which is a product that specifically provides protection for Web applications by executing a series of security policies for HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure). Waf can make up for the problem that firewalls and IPS (Intrusion Prevention System) are insufficient in their ability to protect Web application attacks. It can also quickly detect anomalies in HTTP data, reject data that does not meet HTTP standards, and reduce the impact of attacks. Summary of the invention

[0003] The present application provides a security protection method, device, electronic device and computer-readable storage medium to reduce the false alarm rate of existing security protection products such as Waf.

[0004] In a first aspect, the present application provides a security protection method, comprising: obtaining data to be detected; for any component of the data to be detected, detecting the component based on a preset detection rule corresponding to the component, and obtaining a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components of the data to be detected are not exactly the same, and the preset detection rules are used to detect whether there is an injection point; if the detection result of any one of the components indicates the existence of an injection point, the data to be detected is subjected to exception processing.

[0005] The prior art uses a set of rules to detect the entire data to be detected, but the types of injection points that may exist in different components of the data to be detected may not be exactly the same, and the detection rules corresponding to different types of injection points may be different. Therefore, the prior art method may result in missed detection or false detection of injection points. In the embodiment of the present application, by setting corresponding preset detection rules for different components of the data to be detected, targeted detection of the types of injection points that may exist in different components can be achieved. Compared with the prior art, the probability of missed detection or false detection of injection points can be reduced, the accuracy is higher, and the false alarm rate of security protection products such as Waf is reduced.

[0006] In combination with the technical solution provided in the first aspect above, in some possible implementations, the component includes entity content; the preset detection rules include at least one detection rule; the component is detected based on the preset detection rules corresponding to the component, including: determining the data type of the entity content; based on the data type of the entity content, determining a set of to-be-determined injection points including all to-be-determined injection points corresponding to the data type of the entity content from a preset correspondence table between the data type and the injection point; according to the set of to-be-determined injection points, obtaining the detection rules corresponding to each to-be-determined injection point of the set of to-be-determined injection points from the preset detection rules corresponding to the entity content; and detecting the entity content based on all the detection rules corresponding to the set of to-be-determined injection points.

[0007] In an embodiment of the present application, since different injection points may exist in different data types, when detecting entity content, the data type included therein is first determined, and a set of injection points to be determined is determined based on the determined data type, and then the entity content is detected based on all detection rules corresponding to the set of injection points to be determined, without the need to use all detection rules in the preset detection rules corresponding to the entity content for detection, thereby reducing the number of detection rules that need to be detected and improving detection efficiency.

[0008] In combination with the technical solution provided in the first aspect above, in some possible implementations, the entity content includes multiple types of data; the method of determining a set of injection points to be determined including all injection points to be determined corresponding to the data type of the entity content from a preset table of correspondence between data types and injection points based on the data type of the entity content includes: for each data type included in the entity content, based on the data type, determining all injection points to be determined corresponding to the data type from a preset table of correspondence between data types and injection points; based on all injection points to be determined corresponding to each data type, obtaining a set of injection points to be determined corresponding to all data types, wherein the set of injection points to be determined includes all injection points to be determined corresponding to all data types in the entity content; accordingly, detecting the entity content based on all detection rules corresponding to the set of injection points to be determined includes: for each data type included in the entity content, detecting the data of the data type based on all detection rules corresponding to the data type; all detection rules corresponding to the data type are: based on all injection points to be determined corresponding to the data type, detection rules corresponding to all injection points to be determined of the data type are determined from the preset detection rules corresponding to the entity content.

[0009] In the embodiment of the present application, for each type of data in the entity content, the corresponding detection rules are determined according to the injection points that may exist in the type of data, and the data of this type is detected according to the determined detection rules. There will be no other detection rules except the detection rules corresponding to the injection points in the type of data to detect the type of data, so that the probability of false positives can be reduced. And for each type of data, the number of detection rules can be reduced, and the detection efficiency can be improved.

[0010] In combination with the technical solution provided in the first aspect above, in some possible implementations, for any one of the components, the component is detected based on the preset detection rules corresponding to the component to obtain a detection result of whether the component includes an injection point, including: for any one of the components, based on each detection rule in the preset detection rule corresponding to the component, the component is detected in turn; if an injection point is detected in the component under any detection rule, the detection of the component is terminated and a first detection result is obtained; the first detection result indicates that an injection point exists in the component; if no injection point is detected in the component under all detection rules, the detection of the component is terminated and a second detection result is obtained; the second detection result indicates that there is no injection point in the component.

[0011] In the embodiment of the present application, when an injection point is detected in the component under any detection rule, it can be confirmed that an attack behavior exists in the data to be detected. Therefore, there is no need to perform subsequent detection, thereby improving the detection efficiency.

[0012] In combination with the technical solution provided in the first aspect above, in some possible implementations, the component includes a uniform resource locator; after receiving the data to be detected, the method further includes: determining that the uniform resource locator is not in a preset whitelist.

[0013] In the embodiment of the present application, by presetting a whitelist, the data to be detected can be screened, the amount of data required for subsequent detection can be reduced, and the detection efficiency can be improved.

[0014] In combination with the technical solution provided in the first aspect above, in some possible implementations, obtaining the data to be detected includes: receiving a traffic data packet to be detected, wherein the traffic data packet to be detected is one or more of a plurality of traffic data packets corresponding to the data to be detected; accordingly, before detecting any component of the data to be detected based on a preset detection rule corresponding to the component, the method also includes: determining the component of the data to be detected in the traffic data packet to be detected.

[0015] In the embodiment of the present application, when a traffic data packet to be detected is received, the traffic data packet to be detected is directly detected, and there is no need to perform unified detection after receiving a complete set of data to be detected, thereby improving detection efficiency.

[0016] In combination with the technical solution provided in the first aspect above, in some possible implementations, the data to be detected is subjected to exception processing, including: stopping receiving all other traffic data packets that belong to the same traffic data packet to be detected as the traffic data packet to be detected.

[0017] In an embodiment of the present application, when the detection result of any component indicates the existence of an injection point, it can be confirmed that there is an attack behavior in the data to be detected. Therefore, the reception of all other traffic data packets belonging to the same traffic data packet to be detected is stopped, thereby preventing the data to be detected from being attacked.

[0018] In the second aspect, the present application provides a security protection device, including: an acquisition module and a processing module, the acquisition module is used to acquire data to be detected; the processing module is used to detect any component of the data to be detected based on a preset detection rule corresponding to the component, and obtain a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components are not exactly the same, and the preset detection rules are used to detect whether there is an injection point; the processing module is also used to perform exception processing on the data to be detected if the detection result of any one of the components indicates the existence of an injection point.

[0019] In a third aspect, the present application provides an electronic device, comprising: a memory and a processor, the memory and the processor being connected; the memory being used to store programs; and the processor being used to call the programs stored in the memory to execute the method described in the first aspect above and / or in combination with any possible implementation of the first aspect above.

[0020] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a computer, the computer program executes the method described in the first aspect and / or in combination with any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A schematic diagram of the process of the first security protection method shown in the embodiment of the present application;

[0023] Figure 2 A schematic diagram of a second safety protection method according to an embodiment of the present application;

[0024] Figure 3 A structural block diagram of a safety protection device shown in an embodiment of the present application;

[0025] Figure 4 A structural block diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0027] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of this application, relational terms such as "first", "second", etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0028] The technical solution of the present application will be described in detail below with reference to the accompanying drawings.

[0029] At present, security protection products such as Waf usually detect the complete HTTP data based on a set of preset detection rules after receiving the complete HTTP data. However, this detection method has a high false alarm rate. Therefore, the present application provides a security protection method and device to reduce the false alarm rate of existing security protection products such as Waf.

[0030] See also Figure 1 , Figure 1 This is a flow chart of a safety protection method shown in an embodiment of the present application. Figure 1 Describe the steps it involves.

[0031] S100: Acquire data to be detected.

[0032] In an embodiment of the present application, the subsequent steps of the embodiment of the present application may be performed after obtaining complete data to be detected, that is, after receiving all traffic data packets to be detected of the data to be detected, all traffic data packets to be detected corresponding to the data to be detected may be parsed to obtain complete data to be detected, and then the subsequent steps of the embodiment of the present application may be performed.

[0033] Alternatively, the subsequent steps of the embodiment of the present application may be executed after obtaining part of the data to be detected. For example, after obtaining a traffic data packet to be detected of the data to be detected, the subsequent steps of the embodiment of the present application may be executed.

[0034] It can be understood that the data to be detected is composed of multiple components, and different components carry different data.

[0035] For example, the data to be detected may include a Uniform Resource Locator (URL), a data packet header, a physical body, etc. The functions of the Uniform Resource Locator, the data packet header, and the physical body and the types of data carried are well known to those skilled in the art, and are not described here for the sake of brief description.

[0036] S200: For any component of the data to be detected, the component is detected based on a preset detection rule corresponding to the component to obtain a detection result of whether the component includes an injection point.

[0037] The preset detection rules corresponding to different components of the data to be detected are not completely the same, and the preset detection rules are used to detect whether there is an injection point.

[0038] The preset detection rule corresponding to each component of the data to be detected may include at least one detection rule, and each detection rule is used to detect an injection point.

[0039] Among them, the injection point can be, for example, query, uri_fragmt, cookie, xml, jsn, etc. The examples here are only for the convenience of explanation and should not be regarded as limitations of this application.

[0040] The preset detection rules corresponding to different components of the data to be detected are not completely the same, which means that the preset detection rules corresponding to different components of the data to be detected are completely different, or only some detection details in the preset detection rules corresponding to different components of the data to be detected are the same.

[0041] For ease of understanding, the data to be detected includes component A, component B, and component C. If injection point 1 and injection point 2 can exist in component A, injection point 2 and injection point 3 can exist in component B, and injection point 4 can exist in component C.

[0042] Then the preset detection rule A corresponding to component A needs to include detection rule 1 corresponding to injection point 1 and detection rule 2 corresponding to injection point 2. The preset detection rule B corresponding to component B needs to include detection rule 2 corresponding to injection point 2 and detection rule 3 corresponding to injection point 3. The preset detection rule C corresponding to component C needs to include detection rule 4 corresponding to injection point 4. The examples here are only for ease of understanding and should not be used as limitations on this application.

[0043] In order to facilitate the rapid determination of the preset detection rules corresponding to each component, optionally, the preset detection rules corresponding to different components can be stored separately and independently, and when needed, the corresponding preset detection rules can be directly obtained.

[0044] Since the detection rules in different components may have the same parts, the detection rules corresponding to the injection points that may exist in multiple components can be used as public detection rules. A corresponding relationship between each public detection rule and a component is established. When it is needed, in addition to obtaining the preset detection rules corresponding to the component, the public detection rules corresponding to the component also need to be obtained.

[0045] Optionally, a check rule library may be provided, in which the detection rules corresponding to all injection points are stored, and a corresponding relationship between each detection rule and a component is established. Among them, all detection rules corresponding to the same component constitute the preset detection rule corresponding to the component. When needed, all detection rules corresponding to the component can be directly determined based on the corresponding relationship between the component and the detection rules.

[0046] In one implementation, the components of the data to be detected may be detected in sequence according to a preset component order, or all components of the data to be detected may be detected in parallel.

[0047] For ease of understanding, the data to be detected includes component A, component B, and component C. If the preset sequence of components is component A, component B, and component C, component A, component B, and component C are detected in sequence.

[0048] If all components of the data to be detected are detected in parallel, component A, component B, and component C are detected in parallel. The examples here are only for ease of understanding and should not be used as a limitation to the present application.

[0049] In one implementation, for any component, the component is detected based on the preset detection rule corresponding to the component, and the process of obtaining the detection result of whether the component includes the injection point can be: for any component, based on each detection rule in the preset detection rule corresponding to the component, the component is detected in sequence. Alternatively, for any component, based on each detection rule in the preset detection rule corresponding to the component, the component is detected in parallel.

[0050] The condition for stopping the detection may be that after all the detection details are detected, the detection is stopped and the detection result of whether the injection point is included in the component is obtained.

[0051] Since all the test details have been tested, the test results may also include a list of all injection points existing in the component.

[0052] Alternatively, for any component, based on each detection rule in the preset detection rule corresponding to the component, the component is detected in sequence. It may be that the component is detected to have an injection point under any detection rule, the detection of the component is terminated, and a first detection result is obtained; the first detection result indicates that there is an injection point in the component. The component is not detected to have an injection point under all detection rules, the detection of the component is terminated, and a second detection result is obtained; the second detection result indicates that there is no injection point in the component.

[0053] Optionally, when it is detected that an injection point exists in any component of the data to be detected, the detection of all components of the data to be detected may be stopped.

[0054] For ease of understanding, the data to be detected includes component A, component B, and component C. It is set to detect component A, component B, and component C in sequence. If an injection point is detected in component A, the detection of the data to be detected is stopped, that is, component B and component C are no longer detected.

[0055] If component A, component B, and component C are tested in parallel, as long as one of the three components A, component B, and component C is detected to have an injection point, the testing will be stopped regardless of whether the other two components have completed the testing.

[0056] The examples given here are only for ease of understanding and should not be construed as limiting the present application.

[0057] Since the entity content may include different types of data, for example, it may include video data, audio data, text data, script data, etc. Different types of data may have different injection points. Therefore, in one embodiment, when the component includes entity content and the preset detection rule includes at least one detection rule, the specific implementation method of detecting the component based on the preset detection rule corresponding to the component may be: first determine the data type of the entity content. Then, based on the data type of the entity content, determine the set of injection points to be determined corresponding to the data type of the entity content from the preset data type and injection point correspondence table. Then, according to the set of injection points to be determined, obtain the detection rules corresponding to each injection point to be determined in the set of injection points to be determined from the preset detection rules corresponding to the entity content. Finally, the entity content is detected based on all the detection rules corresponding to the set of injection points to be determined.

[0058] For ease of understanding, the entity content includes the first category of data and the second category of data as an example for explanation. If the injection points corresponding to the first category of data are injection point 1 and injection point 2, and the injection points corresponding to the second category of data are injection point 2 and injection point 3, then the set of injection points to be determined includes injection point 1, injection point 2, and injection point 3. Then, from the preset detection rules corresponding to the entity content, obtain detection rule 1 corresponding to injection point 1, detection rule 2 corresponding to injection point 2, and detection rule 3 corresponding to injection point 3. Then, the entity content is detected based on detection rule 1, detection rule 2, and detection rule 3. The examples here are only for ease of understanding and should not be used as limitations on this application.

[0059] In one implementation manner, after obtaining the detection details corresponding to each to-be-determined injection point in the to-be-determined injection point set, all the obtained detection details are directly used to detect the entire content of the entity content.

[0060] For example, if the entity content includes the first category data and the second category data, and all the acquired detection rules include detection rule 1, detection rule 2, and detection rule 3, the first category data and the second category data are detected using detection rule 1, detection rule 2, and detection rule 3, respectively. The examples here are only for ease of understanding and should not be used as a limitation to this application.

[0061] In one implementation manner, when the entity content includes multiple types of data, based on the data type of the entity content, from a preset data type and injection point correspondence table, a process of determining a set of to-be-determined injection points including all to-be-determined injection points corresponding to the data type of the entity content may be as follows: for each data type included in the entity content, based on the data type, from a preset data type and injection point correspondence table, all to-be-determined injection points corresponding to the data type are determined; based on all to-be-determined injection points corresponding to each data type, a set of to-be-determined injection points corresponding to all data types is obtained, wherein the set of to-be-determined injection points includes all to-be-determined injection points corresponding to all data types in the entity content.

[0062] Accordingly, the process of detecting the entity content based on all detection rules corresponding to the set of injection points to be determined may be: for each data type included in the entity content, the data of the data type is detected based on all detection rules corresponding to the data type. All detection rules corresponding to the data type are: based on all injection points to be determined corresponding to the data type, the detection rules corresponding to all injection points to be determined of the data type are determined from the preset detection rules corresponding to the entity content.

[0063] For ease of understanding, an example is given in which the entity content includes the first type of data and the second type of data. If the injection points corresponding to the first type of data are injection point 1 and injection point 2, and the injection points corresponding to the second type of data are injection point 2 and injection point 3.

[0064] For the first type of data, it is determined that all injection points corresponding to the first type of data include injection point 1 and injection point 2. Then, it is determined that the detection rules corresponding to the first type of data include detection rule 1 corresponding to injection point 1 and detection rule 2 corresponding to injection point 2. Then, the first type of data is detected based on detection rule 1 and detection rule 2.

[0065] Similarly, for the second type of data, it is determined that all injection points corresponding to the second type of data include injection point 2 and injection point 3. Then, it is determined that the detection rules corresponding to the second type of data include detection rule 2 corresponding to injection point 2 and detection rule 3 corresponding to injection point 3. Then, the second type of data is detected based on detection rule 2 and detection rule 3.

[0066] The examples given here are only for ease of understanding and should not be construed as limiting the present application.

[0067] Optionally, if the entity content includes multiple types of data, the different types of data may be detected in sequence, or the multiple types of data may be detected in parallel.

[0068] For example, if the entity content includes first-category data and second-category data, the first-category data may be detected first, and then the second-category data; or, the first-category data and the second-category data may be detected in parallel.

[0069] In one implementation mode, when obtaining the data to be detected, the specific implementation mode is: when receiving a traffic data packet to be detected, before detecting any component of the data to be detected based on a preset detection rule corresponding to the component, the component of the data to be detected in the traffic data packet to be detected can also be determined. The traffic data packet to be detected is one or more of the multiple traffic data packets corresponding to the data to be detected.

[0070] That is, after receiving a traffic data packet to be detected, the components of the traffic data packet to be detected can be determined. Alternatively, when multiple traffic data packets to be detected are received, the components of each received traffic data packet to be detected can be determined simultaneously.

[0071] After determining the components of the data to be detected in the traffic data packet to be detected, any component of the data to be detected in the traffic data packet to be detected can be detected based on the preset detection rule corresponding to the component. The specific implementation method of detecting the component based on the preset detection rule corresponding to the component has been clearly described in the previous text, and will not be repeated here for the sake of brief description.

[0072] In one implementation, if the component includes a uniform resource locator, after receiving the data to be detected, it can also be determined whether the uniform resource locator exists in a preset whitelist.

[0073] If the uniform resource locator of the data to be detected exists in the preset white list, the subsequent detection process, that is, S200-S300, is not performed.

[0074] If the uniform resource locator of the data to be detected does not exist in the preset white list, then continue to execute S200-S300.

[0075] The specific number and types of uniform resource locators included in the preset whitelist can be set according to actual needs and are not limited here.

[0076] S300: If the detection result of any component indicates the existence of an injection point, an exception process is performed on the data to be detected.

[0077] The method of exception handling may be any method of handling data with attack behaviors, such as data blocking, data discarding, etc. The specific method of exception handling is not limited here.

[0078] If the detection result of the non-existent component indicates that there is an injection point, the data to be detected is determined to be normal and the data to be detected is processed normally, for example, forwarded or stored, etc. The specific method of processing the data to be detected normally is not limited here.

[0079] In one implementation mode, when the specific implementation method of obtaining the data to be detected is: receiving a traffic data packet to be detected, if an injection point is detected in the traffic data packet to be detected, the specific implementation method of performing exception processing on the data to be detected may be: stopping receiving all other traffic data packets that belong to the same traffic data packet to be detected.

[0080] For example, if the traffic data packets to be detected corresponding to the data to be detected are: traffic data packet 1 to be detected, traffic data packet 2 to be detected, traffic data packet 3 to be detected, and traffic data packet 4 to be detected, and traffic data packet 1 to be detected, traffic data packet 2 to be detected, traffic data packet 3 to be detected, and traffic data packet 4 to be detected are sent in sequence from front to back. That is, traffic data packet 1 to be detected is received first, and traffic data packet 4 to be detected is received last. If after receiving traffic data packet 1 to be detected, it is detected that there is an injection point in traffic data packet 1 to be detected, traffic data packet 2 to be detected, traffic data packet 3 to be detected, and traffic data packet 4 to be detected are no longer received. The examples here are only for ease of understanding and should not be used as limitations on this application.

[0081] In order to facilitate understanding of the above specific implementation method of obtaining the data to be detected: when receiving the traffic data packet to be detected, the specific implementation method of the security protection method is as follows: Figure 2 .

[0082] like Figure 2 As shown, first, a data packet of traffic to be detected is received. Then, the components of the data to be detected in the traffic data packet to be detected are determined. Afterwards, for any component of the data to be detected in the traffic data packet to be detected, the component is detected based on the preset detection rule corresponding to the component to obtain a detection result of whether the component includes an injection point. If the detection result of any component indicates the existence of an injection point, the data to be detected corresponding to the traffic data packet to be detected is subjected to exception processing. If the detection result of no component indicates the existence of an injection point, it is determined that there is no exception in the traffic data packet to be detected.

[0083] in, Figure 2 The specific implementation methods of each step shown have been clearly described in the previous text and will not be repeated here for the sake of brevity.

[0084] Optionally, the above-mentioned detection of components using detection rules can be implemented using hyperscan software.

[0085] The detection modes of hyperscan software are divided into block and stream. In practical applications, you can choose according to actual needs.

[0086] In one implementation, the above security protection method can be applied to Waf security protection software.

[0087] Based on the same technical concept, the present application also provides a safety protection device, such as Figure 3 As shown, the safety protection device 100 includes an acquisition module 110 and a processing module 120 .

[0088] The acquisition module 110 is used to acquire the data to be detected.

[0089] The processing module 120 is used to detect any component of the data to be detected based on the preset detection rule corresponding to the component, and obtain a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components are not exactly the same, and the preset detection rules are used to detect whether there is an injection point.

[0090] The processing module 120 is further configured to perform exception processing on the data to be detected if the detection result of any of the components indicates the presence of an injection point.

[0091] The components include entity content, the preset detection rules include at least one detection rule, and the processing module 120 is specifically used to determine the data type of the entity content; based on the data type of the entity content, determine a set of undetermined injection points including all undetermined injection points corresponding to the data type of the entity content from a preset correspondence table between data types and injection points; according to the set of undetermined injection points, obtain the detection rules corresponding to each undetermined injection point in the set of undetermined injection points from the preset detection rules corresponding to the entity content; and detect the entity content based on all the detection rules corresponding to the set of undetermined injection points.

[0092] The entity content includes multiple types of data; the processing module 120 is specifically used to determine, for each data type included in the entity content, from a preset data type and injection point correspondence table, all the to-be-determined injection points corresponding to the data type based on the data type; based on all the to-be-determined injection points corresponding to each data type, a set of to-be-determined injection points corresponding to all data types is obtained, wherein the set of to-be-determined injection points includes all the to-be-determined injection points corresponding to all the data types in the entity content; for each data type included in the entity content, the data of the data type is detected based on all the detection rules corresponding to the data type; all the detection rules corresponding to the data type are: based on all the to-be-determined injection points corresponding to the data type, the detection rules corresponding to all the to-be-determined injection points of the data type are determined from the preset detection rules corresponding to the entity content.

[0093] The processing module 120 is specifically used to detect any one of the components in turn based on each detection rule in the preset detection rule corresponding to the component; if an injection point is detected in the component under any detection rule, the detection of the component is terminated and a first detection result is obtained; the first detection result indicates that an injection point exists in the component; if no injection point is detected in the component under all detection rules, the detection of the component is terminated and a second detection result is obtained; the second detection result indicates that no injection point exists in the component.

[0094] The components include a uniform resource locator; after receiving the data to be detected, the processing module 120 is also used to determine whether the uniform resource locator is not in the preset white list.

[0095] The acquisition module 110 is specifically used to receive a traffic data packet to be detected, wherein the traffic data packet to be detected is one or more of a plurality of traffic data packets corresponding to the data to be detected. Accordingly, before any component of the data to be detected is detected based on a preset detection rule corresponding to the component, the processing module 120 is also used to determine the component of the data to be detected in the traffic data packet to be detected.

[0096] The processing module 120 is specifically configured to stop receiving all other traffic data packets that belong to the same traffic data packet to be detected as the traffic data packet to be detected.

[0097] The security protection device 100 provided in the embodiment of the present application has the same implementation principle and technical effects as those of the aforementioned security protection method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned security protection method embodiment.

[0098] See also Figure 4 , which is an electronic device 200 provided in an embodiment of the present application. The electronic device 200 includes: a processor 210 and a memory 220.

[0099] The memory 220 and the processor 210 are electrically connected to each other directly or indirectly to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses or signal lines. The memory 220 is used to store computer programs, such as storing Figure 3The software function module shown in is the security protection device 100. The security protection device 100 includes at least one software function module that can be stored in the memory 220 in the form of software or firmware or solidified in the operating system (OS) of the electronic device 200. The processor 210 is used to execute the executable module stored in the memory 220, such as the software function module or computer program included in the security protection device 100. At this time, the processor 210 is used to obtain the data to be detected; for any component of the data to be detected, the component is detected based on the preset detection rule corresponding to the component, and the detection result of whether the component includes an injection point is obtained; wherein the preset detection rules corresponding to different components of the data to be detected are not exactly the same, and the preset detection rules are used to detect whether there is an injection point; if the detection result of any one of the components indicates the existence of an injection point, the data to be detected is subjected to exception processing.

[0100] Among them, the memory 220 can be, but is not limited to, RAM (Random Access Memory), ROM (Read Only Memory), PROM (Programmable Read-Only Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electric Erasable Programmable Read-Only Memory), etc.

[0101] The processor 210 may be an integrated circuit chip with signal processing capabilities. The above-mentioned processor may be a general-purpose processor, including a CPU (Central Processing Unit), an NP (Network Processor), etc.; it may also be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps and logic block diagrams disclosed in the embodiments of the present application may be implemented or executed. A general-purpose processor may be a microprocessor or the processor 210 may also be any conventional processor, etc.

[0102] The electronic device 200 mentioned above includes but is not limited to a personal computer, a server, etc.

[0103] The embodiment of the present application also provides a computer-readable storage medium (hereinafter referred to as storage medium), on which a computer program is stored, and when the computer program is run by a computer such as the above-mentioned electronic device 200, the above-mentioned security protection method is executed. The computer-readable storage medium includes: a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and other media that can store program codes.

[0104] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A safety protection method, characterized in that: include: Obtain the data to be tested; For any component of the data to be detected, the component is detected based on a preset detection rule corresponding to the component to obtain a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components of the data to be detected are not completely the same, and the preset detection rules are used to detect whether there is an injection point; If the detection result of any of the components indicates the existence of an injection point, exception processing is performed on the data to be detected.

2. The method according to claim 1, characterized in that The components include entity content; the preset detection rules include at least one detection rule; The component is detected based on a preset detection rule corresponding to the component, including: Determining the data type of the entity content; Based on the data type of the entity content, determining a set of injection points to be determined including all injection points to be determined corresponding to the data type of the entity content from a preset correspondence table between data types and injection points; According to the set of injection points to be determined, from the preset detection rules corresponding to the entity content, obtaining the detection details corresponding to each injection point to be determined in the set of injection points to be determined; The entity content is detected based on all detection rules corresponding to the set of injection points to be determined.

3. The method according to claim 2, characterized in that The entity content includes multiple types of data; The step of determining, based on the data type of the entity content, from a preset correspondence table between data types and injection points, a set of injection points to be determined including all injection points to be determined corresponding to the data type of the entity content, comprises: For each data type included in the entity content, based on the data type, all to-be-determined injection points corresponding to the data type are determined from a preset correspondence table between data types and injection points; Based on all the to-be-determined injection points corresponding to each data type, a set of to-be-determined injection points corresponding to all data types is obtained, wherein the set of to-be-determined injection points includes all the to-be-determined injection points corresponding to all the data types in the entity content; Accordingly, the entity content is detected based on all detection rules corresponding to the set of injection points to be determined, including: For each data type included in the entity content, the data of the data type is detected based on all detection rules corresponding to the data type; all detection rules corresponding to the data type are: based on all undetermined injection points corresponding to the data type, the detection rules corresponding to all undetermined injection points of the data type are determined from the preset detection rules corresponding to the entity content.

4. The method according to claim 1, characterized in that For any of the components, the component is detected based on a preset detection rule corresponding to the component to obtain a detection result of whether the component includes an injection point, including: For any of the components, based on each detection rule in the preset detection rule corresponding to the component, the component is detected in turn; If an injection point is detected in the component under any one of the detection rules, the detection of the component is terminated and a first detection result is obtained; the first detection result indicates that an injection point exists in the component; If no injection point is detected in the component under all the detection criteria, the detection of the component is terminated and a second detection result is obtained; the second detection result indicates that no injection point exists in the component.

5. The method according to claim 1, characterized in that The component includes a uniform resource locator; after receiving the data to be detected, the method further includes: It is determined that the uniform resource locator is not in a preset whitelist.

6. The method according to any one of claims 1 to 5, characterized in that: The step of obtaining the data to be detected includes: Receiving a traffic data packet to be detected, wherein the traffic data packet to be detected is one or more of a plurality of traffic data packets corresponding to the data to be detected; Accordingly, before detecting any component of the data to be detected based on a preset detection rule corresponding to the component, the method further includes: Determine the components of the data to be detected contained in the traffic data packet to be detected.

7. The method according to claim 6, characterized in that Performing abnormal processing on the data to be detected includes: Stop receiving all other traffic data packets that belong to the same traffic data packet to be detected as the traffic data packet to be detected.

8. A safety protection device, characterized in that: include: An acquisition module is used to acquire the data to be detected; A processing module, configured to detect any component of the data to be detected based on a preset detection rule corresponding to the component, and obtain a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components are not completely the same, and the preset detection rules are used to detect whether there is an injection point; The processing module is further configured to perform exception processing on the data to be detected if the detection result of any of the components indicates the existence of an injection point.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is used to call the program stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is executed.

Images