Security protection method and device, electronic equipment and computer readable storage medium

Abstract

The application provides a security protection method and device, electronic equipment and a computer readable storage medium, and relates to the technical field of computers. The security protection method comprises: obtaining to-be-detected data; for any one component part of the to-be-detected data, detecting the component part based on a preset detection rule corresponding to the component part to obtain a detection result of whether the component part includes an injection point; wherein the preset detection rules corresponding to different component parts of the to-be-detected data are not completely the same, and the preset detection rules are used to detect whether there is an injection point; and if the detection result of any one component part represents that there is an injection point, the to-be-detected data is subjected to abnormal processing. According to the scheme, the preset detection rules are respectively set for different component parts, the types of injection points possibly existing in different component parts can be detected, the accuracy is higher, and the false positive rate of the security protection product is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a security protection method and device, electronic equipment and a computer readable storage medium. BACKGROUND

[0002] Web(World Wide Web, global wide area network) vulnerability mining and attack tools make Web application protection a top priority. At present, many security protection products have been developed for Web applications, such as Waf(Web Application Firewall, Web Application Firewall) and the like. Waf is a product that provides protection for Web applications by executing a series of security policies for HTTP(Hypertext Transfer Protocol, Hypertext Transfer Protocol) / HTTPS(Hypertext Transfer Protocol Secure, Hypertext Transfer Protocol Secure). Waf can make up for the lack of protection against Web application attacks by firewalls and IPS(Intrusion Prevention System, Intrusion Prevention System). It can also quickly detect abnormal HTTP data and reject data that does not meet the HTTP standard to reduce the impact of attacks. SUMMARY

[0003] The present application provides a security protection method, device, electronic equipment and computer readable storage medium to reduce the false positive rate of existing Waf security protection products.

[0004] In a first aspect, the present application provides a security protection method, comprising: obtaining to-be-detected data; detecting any one component of the to-be-detected data based on a preset detection rule corresponding to the component to obtain a detection result of whether the component includes an injection point; wherein the preset detection rules corresponding to different components of the to-be-detected data are not completely the same, and the preset detection rules are used to detect whether there is an injection point; if the detection result of any one of the components indicates that there is an injection point, the to-be-detected data is processed abnormally.

[0005] The prior art detects the entire to-be-detected data by using a set of rules. However, the types of injection points that can exist in different components of the to-be-detected data can not be completely the same, and the detection rules corresponding to different types of injection points can be different. Therefore, the prior art can miss or misidentify injection points. In the embodiments of the present application, the corresponding preset detection rules are set for different components of the to-be-detected data, so that the types of injection points that can exist in different components can be detected. Compared with the prior art, the probability of missing or misidentifying injection points can be reduced, the accuracy is higher, and the false positive rate of security protection products such as Waf can be reduced.

[0006] In some possible implementation manners, the component includes entity content, the preset detection rule includes at least one detection rule, the detection of the component based on the preset detection rule corresponding to the component includes: determining the data type of the entity content; determining, from a preset correspondence table of data type and injection point, a set of to-be-determined injection points including all to-be-determined injection points corresponding to the data type of the entity content; obtaining, from the preset detection rule corresponding to the entity content, a detection rule corresponding to each to-be-determined injection point in the set of to-be-determined injection points; and detecting the entity content based on all the detection rules corresponding to the set of to-be-determined injection points.

[0007] In the embodiments of the present application, because different data types can include different injection points, when detecting the entity content, the data type included in the entity content is determined, the set of to-be-determined injection points is determined according to the determined data type, and the entity content is detected according to all the detection rules corresponding to the set of to-be-determined injection points. Therefore, the number of detection rules that need to be detected can be reduced, and the detection efficiency can be improved.

[0008] In some possible implementation manners of the first aspect, the entity content includes multiple types of data; the determining, from the preset correspondence between data types and injection points, of a set of to-be-determined injection points corresponding to the data types of the entity content, includes: for each type of data included in the entity content, determining, from the preset correspondence between data types and injection points, all to-be-determined injection points corresponding to the type of data; and based on all to-be-determined injection points corresponding to each type of data, obtaining a set of to-be-determined injection points corresponding to all data types, where the set of to-be-determined injection points includes all to-be-determined injection points corresponding to each type of data in the entity content; and correspondingly, the detecting the entity content based on all detection rules corresponding to the set of to-be-determined injection points includes: for data of each type of data included in the entity content, detecting the data of the type of data based on all detection rules corresponding to the type of data; and the all detection rules corresponding to the type of data are determined from preset detection rules corresponding to all to-be-determined injection points of the type of data.

[0009] In the embodiments of the present application, for each type of data in the entity content, the corresponding detection rule is determined according to the injection point that may exist in the type of data, and the type of data is detected according to the determined detection rule. There is no detection rule other than the detection rule corresponding to the injection point in the type of data to detect the type of data, so as to reduce the probability of false positives. In addition, for each type of data, the number of detection rules can be reduced, and the detection efficiency can be improved.

[0010] In some possible implementation manners of the first aspect, for any one of the components, the component is detected based on each detection rule in the preset detection rule corresponding to the component, to obtain a detection result of whether the component includes an injection point, including: for any one of the components, the component is detected based on each detection rule in the preset detection rule corresponding to the component; if the component is detected to have an injection point under any one of the detection rules, the detection of the component is ended, and a first detection result is obtained; the first detection result indicates that the component has an injection point; and if the component is not detected to have an injection point under all detection rules, the detection of the component is ended, and a second detection result is obtained; the second detection result indicates that the component does not have an injection point.

[0011] In the embodiments of the present application, when it is detected under any one detection rule that the component has an injection point, it is confirmed that the attack behavior exists in the to-be-detected data, and therefore, subsequent detection is not needed, thereby improving the detection efficiency.

[0012] In combination with the technical scheme provided in the above first aspect, in some possible implementation manners, the component includes a uniform resource locator; after receiving the to-be-detected data, the method further includes: determining that the uniform resource locator is not in a preset white list.

[0013] In the embodiments of the present application, by using the preset white list, the to-be-detected data can be screened, the amount of data that needs subsequent detection is reduced, and the detection efficiency is improved.

[0014] In combination with the technical scheme provided in the above first aspect, in some possible implementation manners, the obtaining of the to-be-detected data includes: receiving a to-be-detected traffic data packet, wherein the to-be-detected traffic data packet is one or more of a plurality of traffic data packets corresponding to the to-be-detected data; and correspondingly, before detecting any one component of the to-be-detected data based on a preset detection rule corresponding to the component, the method further includes: determining the component of the to-be-detected data possessed by the to-be-detected traffic data packet.

[0015] In the embodiments of the present application, in the case that the to-be-detected traffic data packet of the to-be-detected data is received, the to-be-detected traffic data packet is directly detected, and it is not needed to uniformly detect after receiving a complete to-be-detected data, thereby improving the detection efficiency.

[0016] In combination with the technical scheme provided in the above first aspect, in some possible implementation manners, the abnormal processing of the to-be-detected data includes: stopping receiving all other traffic data packets belonging to the same to-be-detected traffic data as the to-be-detected traffic data packet.

[0017] In the embodiments of the present application, in the case that the detection result of any one component indicates that there is an injection point, it is confirmed that the attack behavior exists in the to-be-detected data, and therefore, all other traffic data packets belonging to the same to-be-detected traffic data as the to-be-detected traffic data packet are stopped from being received, thereby preventing the to-be-detected data from attacking.

[0018] In a second aspect, the present application provides a security protection device, comprising: an acquisition module and a processing module, the acquisition module is configured to acquire to-be-detected data; the processing module is configured to, for any one component part of the to-be-detected data, detect the component part based on a preset detection rule corresponding to the component part to obtain a detection result of whether the component part includes an injection point; wherein the preset detection rules corresponding to different component parts are not completely the same, and the preset detection rules are used to detect whether there is an injection point; and the processing module is further configured to, if the detection result of any one of the component parts indicates that there is an injection point, perform an abnormality processing on the to-be-detected data.

[0019] In a third aspect, the present application provides an electronic device, comprising: a memory and a processor, the memory and the processor are connected; the memory is configured to store a program; and the processor is configured to call the program stored in the memory to execute the method of the first aspect and / or any possible implementation manner combined with the first aspect.

[0020] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a computer to execute the method of the first aspect and / or any possible implementation manner combined with the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor.

[0022] Figure 1 Flowchart of a first security protection method shown in an embodiment of the present application;

[0023] Figure 2 Flowchart of a second security protection method shown in an embodiment of the present application;

[0024] Figure 3 Structure block diagram of a security protection device shown in an embodiment of the present application;

[0025] Figure 4 Structure block diagram of an electronic device shown in an embodiment of the present application. DETAILED DESCRIPTION

[0026] The technical solutions of the embodiments of the present application will be described below in combination with the drawings in the embodiments of the present application.

[0027] It should be noted that similar reference numerals and letters refer to similar items throughout the accompanying drawings, and once an item is defined in one drawing, that item does not need to be further defined and explained in subsequent drawings. Also, the terms "first", "second", and the like in the description of the application are used to differentiate one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between or among such entities or operations. Moreover, the terms "comprises", "comprising", or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0028] The technical solutions of the application will be described in detail below with reference to the accompanying drawings.

[0029] At present, a security protection product such as Waf usually detects complete HTTP data based on a preset set of detection rules after receiving the complete HTTP data. However, this detection method has a high false positive rate, and therefore, the application provides a security protection method and device to reduce the false positive rate of existing security protection products such as Waf.

[0030] Please refer to Figure 1 , Figure 1 A flowchart of a security protection method according to an embodiment of the application is shown in the figure, and the steps included in the method will be described below. Figure 1

[0031] S100: Obtain to-be-detected data.

[0032] In the embodiment of the application, the subsequent steps of the embodiment of the application can be executed after complete to-be-detected data is obtained, that is, after all to-be-detected traffic data packets corresponding to the to-be-detected data are parsed to obtain complete to-be-detected data, the subsequent steps of the embodiment of the application are executed.

[0033] Alternatively, the subsequent steps of the embodiment of the application can be executed after part of the to-be-detected data is obtained, for example, the subsequent steps of the embodiment of the application are executed after one to-be-detected traffic data packet of the to-be-detected data is obtained.

[0034] It can be understood that the to-be-detected data is composed of multiple components, and different components carry different data.

[0035] ​For example, the to-be-detected data can include a uniform resource locator (URL), a data packet header, an entity content, and the like. The roles of the uniform resource locator, the data packet header, and the entity content and the data types carried thereby are known to those skilled in the art, and thus are not described herein again for the sake of brevity.

[0036] S200: For any one component of the to-be-detected data, detecting the component based on a preset detection rule corresponding to the component, to obtain a detection result of whether the component includes an injection point.

[0037] The preset detection rules corresponding to different components of the to-be-detected data are not completely the same, and the preset detection rules are used to detect whether an injection point exists.

[0038] The preset detection rule corresponding to each component of the to-be-detected data can include at least one detection rule, and each detection rule is used to detect one injection point.

[0039] The injection points can be, for example, query, uri_fragmt, cookie, xml, jsn, and the like. The examples are provided herein only for the sake of convenience and should not be considered as limiting the present application.

[0040] The preset detection rules corresponding to different components of the to-be-detected data are not completely the same, that is, the preset detection rules corresponding to different components of the to-be-detected data are completely different, or only some detection rules in the preset detection rules corresponding to different components of the to-be-detected data are the same.

[0041] For the sake of convenience, it is assumed that the to-be-detected data includes component A, component B, and component C. If injection point 1 and injection point 2 can exist in component A, injection point 2 and injection point 3 can exist in component B, and injection point 4 can exist in component C.

[0042] The preset detection rule A corresponding to component A needs to include detection rule 1 corresponding to injection point 1 and detection rule 2 corresponding to injection point 2. The preset detection rule B corresponding to component B needs to include detection rule 2 corresponding to injection point 2 and detection rule 3 corresponding to injection point 3. The preset detection rule C corresponding to component C needs to include detection rule 4 corresponding to injection point 4. The examples are provided herein only for the sake of convenience and should not be considered as limiting the present application.

[0043] For the sake of convenience, the preset detection rules corresponding to different components can be stored independently, and the corresponding preset detection rules can be directly obtained when needed.

[0044] Since the detection rules in different components can have the same part, optionally, the detection rules corresponding to the injection points that can exist in multiple components can be taken as common detection rules. A corresponding relationship between each common detection rule and a component is established, and when it is needed to be used, in addition to obtaining the preset detection rule corresponding to the component, the common detection rule corresponding to the component also needs to be obtained.

[0045] Optionally, a check rule library can be provided, and all detection rules corresponding to respective injection points are stored in the check rule library, and a corresponding relationship between each detection rule and a component is established. All detection rules corresponding to the same component constitute the preset detection rule corresponding to the component. When it is needed to be used, all detection rules corresponding to the component can be directly determined according to the corresponding relationship between the component and the detection rule.

[0046] In an implementation, the components of the to-be-detected data can be detected in sequence according to a preset component order. Alternatively, all components of the to-be-detected data can also be detected in parallel.

[0047] For ease of understanding, the to-be-detected data is taken as an example including component A, component B, and component C. If the preset component order is component A, component B, and component C, component A, component B, and component C are detected in sequence.

[0048] If all components of the to-be-detected data are detected in parallel, component A, component B, and component C are detected in parallel. This example is only for ease of understanding and should not be taken as a limitation on the present application.

[0049] In an implementation, for any one component, the detection of the component based on the preset detection rule corresponding to the component to obtain the detection result of whether the component includes an injection point can be: for any one component, the component is detected in sequence based on each detection rule in the preset detection rule corresponding to the component. Alternatively, for any one component, the component can also be detected in parallel based on each detection rule in the preset detection rule corresponding to the component.

[0050] The detection stopping condition can be that after all detection rules are detected, the detection is stopped, and the detection result of whether the component includes an injection point is obtained.

[0051] Since all detection rules are detected, the detection result can also include a list of all injection points existing in the component.

[0052] Alternatively, in the case of detecting each component part in turn based on each detection rule in the preset detection rule corresponding to the component part. The detection of the component part can be ended and a first detection result can be obtained when the component part is detected to have an injection point under any one detection rule; the first detection result indicates that the component part has an injection point. The detection of the component part can be ended and a second detection result can be obtained when the component part is not detected to have an injection point under all detection rules; the second detection result indicates that the component part does not have an injection point.

[0053] Alternatively, the detection of all component parts of the to-be-detected data can be stopped when any one component part of the to-be-detected data is detected to have an injection point.

[0054] For ease of understanding, it is assumed that the to-be-detected data includes component part A, component part B and component part C, and the detection of component part A, component part B and component part C is performed in turn. If component part A is detected to have an injection point, the detection of the to-be-detected data is stopped, that is, component part B and component part C are no longer detected.

[0055] If component part A, component part B and component part C are detected in parallel, the detection is stopped as long as one of component part A, component part B and component part C is detected to have an injection point, regardless of whether the other two component parts are detected or not.

[0056] The examples are only for ease of understanding and should not be considered as a limitation of the present application.

[0057] Since the entity content can include different types of data, for example, video data, audio data, text data, script data and the like. Different types of data can have different injection points. Therefore, in one embodiment, when the component part includes entity content and the preset detection rule includes at least one detection rule, the specific implementation of detecting the component part based on the preset detection rule corresponding to the component part can be as follows: first, determine the data type of the entity content. Then, based on the data type of the entity content, determine the set of to-be-determined injection points corresponding to the data type of the entity content from the preset correspondence table of data type and injection point. Then, according to the set of to-be-determined injection points, obtain the detection rule corresponding to each to-be-determined injection point of the set of to-be-determined injection points from the preset detection rule corresponding to the entity content. Finally, detect the entity content based on all detection rules corresponding to the set of to-be-determined injection points.

[0058] For ease of understanding, the first type of data and the second type of data are taken as examples for illustration. If the injection points corresponding to the first type of data are injection point 1 and injection point 2, and the injection points corresponding to the second type of data are injection point 2 and injection point 3, the injection point set to be determined includes injection point 1, injection point 2, and injection point 3. Then, from the preset detection rules corresponding to the entity content, detection rule 1 corresponding to injection point 1, detection rule 2 corresponding to injection point 2, and detection rule 3 corresponding to injection point 3 are obtained. Then, the entity content is detected based on detection rule 1, detection rule 2, and detection rule 3. The examples are only for ease of understanding, and should not be regarded as a limitation on the present application.

[0059] In an embodiment, after obtaining the detection rules corresponding to each injection point to be determined in the injection point set to be determined, all the obtained detection rules are directly used to detect all the contents of the entity content.

[0060] For example, if the entity content includes the first type of data and the second type of data, and all the obtained detection rules include detection rule 1, detection rule 2, and detection rule 3, the first type of data and the second type of data are detected by using detection rule 1, detection rule 2, and detection rule 3, respectively. The examples are only for ease of understanding, and should not be regarded as a limitation on the present application.

[0061] In an embodiment, in the case where the entity content includes multiple types of data, based on the data types of the entity content, the process of determining the injection point set to be determined including all the injection points to be determined corresponding to the data types of the entity content from the preset correspondence table of data types and injection points can be: for each data type included in the entity content, based on the data type, determining all the injection points to be determined corresponding to the data type from the preset correspondence table of data types and injection points; and based on all the injection points to be determined corresponding to each data type, obtaining the injection point set to be determined corresponding to all the data types, wherein the injection point set to be determined includes all the injection points to be determined corresponding to all the data types in the entity content.

[0062] Correspondingly, the process of detecting the entity content based on all the detection rules corresponding to the injection point set to be determined can be: for the data of each data type included in the entity content, detecting the data of the data type based on all the detection rules corresponding to the data type. All the detection rules corresponding to the data type are: the detection rules corresponding to all the injection points to be determined of the data type, which are determined from the preset detection rules corresponding to the entity content based on all the injection points to be determined of the data type.

[0063] For the convenience of understanding, the first type of data and the second type of data are taken as examples for illustration. If the injection points corresponding to the first type of data are injection point 1 and injection point 2, and the injection points corresponding to the second type of data are injection point 2 and injection point 3.

[0064] Then, for the first type of data, it is determined that all the injection points corresponding to the first type of data include injection point 1 and injection point 2. Then, it is determined that the detection rules corresponding to the first type of data include detection rule 1 corresponding to injection point 1 and detection rule 2 corresponding to injection point 2. Then, the first type of data is detected based on detection rule 1 and detection rule 2.

[0065] Similarly, for the second type of data, it is determined that all the injection points corresponding to the second type of data include injection point 2 and injection point 3. Then, it is determined that the detection rules corresponding to the second type of data include detection rule 2 corresponding to injection point 2 and detection rule 3 corresponding to injection point 3. Then, the second type of data is detected based on detection rule 2 and detection rule 3.

[0066] The examples are only for the convenience of understanding and should not be regarded as a limitation of the present application.

[0067] Optionally, for the entity content including multiple types of data, the different types of data can be detected in sequence according to the order, or the multiple types of data can be detected in parallel.

[0068] For example, if the entity content includes the first type of data and the second type of data, the first type of data can be detected first, and then the second type of data is detected, or the first type of data and the second type of data can be detected in parallel.

[0069] In an implementation, when the specific implementation of obtaining the to-be-detected data is receiving a to-be-detected traffic data packet, before detecting any component of the to-be-detected data based on the preset detection rule corresponding to the component, it can also be determined that the to-be-detected traffic data packet has the component of the to-be-detected data. The to-be-detected traffic data packet is one or more of the multiple traffic data packets corresponding to the to-be-detected data.

[0070] That is, after receiving a to-be-detected traffic data packet, the component of the to-be-detected traffic data packet can be determined. Alternatively, in the case of receiving multiple to-be-detected traffic data packets, the component of each to-be-detected traffic data packet received can be determined simultaneously.

[0071] After determining the components of the to-be-detected data in the to-be-detected traffic data packet, any one of the components of the to-be-detected data in the to-be-detected traffic data packet is detected based on the preset detection rule corresponding to the component. The specific implementation manner of detecting the component based on the preset detection rule corresponding to the component has been described above, and will not be described here for brevity.

[0072] In an implementation, if the component includes a uniform resource locator, after receiving the to-be-detected data, it can be further determined whether the uniform resource locator exists in a preset whitelist.

[0073] If the uniform resource locator of the to-be-detected data exists in the preset whitelist, the subsequent detection process is not performed, that is, S200-S300.

[0074] If the uniform resource locator of the to-be-detected data does not exist in the preset whitelist, S200-S300 is continued to be executed.

[0075] The specific number and type of the uniform resource locators included in the preset whitelist can be set according to actual needs, and will not be limited here.

[0076] S300: If the detection result of any one of the components indicates that there is an injection point, the to-be-detected data is processed abnormally.

[0077] The abnormal processing manner can be any processing manner of data with attack behavior, such as data blocking, data discarding, etc., and the specific manner of abnormal processing will not be limited here.

[0078] If the detection result of any one of the components does not indicate that there is an injection point, it is determined that the to-be-detected data is normal, and the to-be-detected data is processed normally. For example, the to-be-detected data is forwarded, stored, etc., and the specific manner of processing the to-be-detected data normally will not be limited here.

[0079] In an implementation, when the specific implementation manner of obtaining the to-be-detected data is receiving the to-be-detected traffic data packet, and if the to-be-detected traffic data packet has an injection point, the specific implementation manner of processing the to-be-detected data abnormally can be stopping receiving all other traffic data packets belonging to the same to-be-detected traffic data as the to-be-detected traffic data packet.

[0080] For example, if the to-be-detected data corresponds to to-be-detected traffic data packets: to-be-detected traffic data packet 1, to-be-detected traffic data packet 2, to-be-detected traffic data packet 3, and to-be-detected traffic data packet 4, and the to-be-detected traffic data packet 1, to-be-detected traffic data packet 2, to-be-detected traffic data packet 3, and to-be-detected traffic data packet 4 are sent in turn from front to back. That is, the to-be-detected traffic data packet 1 is received first, and the to-be-detected traffic data packet 4 is received last. If it is detected that there is an injection point in the to-be-detected traffic data packet 1 after receiving the to-be-detected traffic data packet 1, the to-be-detected traffic data packet 2, to-be-detected traffic data packet 3, and to-be-detected traffic data packet 4 are no longer received. The example here is only for easy understanding and should not be regarded as a limitation on the present application.

[0081] In order to facilitate understanding of the specific implementation mode of the above-mentioned safety protection method when the specific implementation mode of obtaining to-be-detected data is receiving to-be-detected traffic data packets, please refer to Figure 2 .

[0082] As shown in Figure 2 , the to-be-detected traffic data packets are first received. Then the components of the to-be-detected data possessed by the to-be-detected traffic data packets are determined. Then, for any one component of the to-be-detected data possessed by the to-be-detected traffic data packets, the component is detected based on the preset detection rule corresponding to the component to obtain the detection result of whether the component includes an injection point. If the detection result of any one component indicates that there is an injection point, the to-be-detected data corresponding to the to-be-detected traffic data packet is processed abnormally. If the detection result of no component indicates that there is an injection point, it is determined that the to-be-detected traffic data packet has no abnormality.

[0083] The specific implementation modes of each step shown in Figure 2 have been described clearly in the foregoing, and for brief description, they will not be described here.

[0084] Optionally, the detection of the component by the detection rule described above can be realized by using hyperscan software.

[0085] The detection mode of the hyperscan software is divided into block and stream, and in actual application, it can be selected according to actual needs.

[0086] In one implementation mode, the safety protection method described above can be applied to Waf safety protection software.

[0087] Based on the same technical concept, the present application also provides a safety protection device, as shown in Figure 3 , the safety protection device 100 includes an acquisition module 110 and a processing module 120.

[0088] The acquisition module 110 is configured to acquire to-be-detected data.

[0089] The processing module 120 is configured to, for any one component part of the to-be-detected data, perform detection on the component part based on a preset detection rule corresponding to the component part, to obtain a detection result of whether an injection point is included in the component part; wherein the preset detection rules corresponding to different component parts are not completely same, and the preset detection rules are used to detect whether an injection point exists.

[0090] The processing module 120 is further configured to, if the detection result of any one of the component parts indicates that an injection point exists, perform abnormality processing on the to-be-detected data.

[0091] The component part includes entity content, and the preset detection rule includes at least one detection rule. The processing module 120 is specifically configured to determine a data type of the entity content; determine, from a preset correspondence relationship table of data types and injection points, a to-be-determined injection point set including all to-be-determined injection points corresponding to the data type of the entity content based on the data type of the entity content; acquire, from the preset detection rule corresponding to the entity content, a detection rule corresponding to each to-be-determined injection point of the to-be-determined injection point set according to the to-be-determined injection point set; and perform detection on the entity content based on all detection rules corresponding to the to-be-determined injection point set.

[0092] The entity content includes multiple types of data. The processing module 120 is specifically configured to, for each type of data included in the entity content, determine, from a preset correspondence relationship table of data types and injection points, all to-be-determined injection points corresponding to the data type based on the data type; obtain a to-be-determined injection point set corresponding to all data types based on all to-be-determined injection points corresponding to each type of data, wherein the to-be-determined injection point set includes all to-be-determined injection points corresponding to all data types in the entity content; perform detection on the data of each type of data included in the entity content based on all detection rules corresponding to the data type; and the all detection rules corresponding to the data type are detection rules corresponding to all to-be-determined injection points of the data type and determined from the preset detection rule corresponding to the entity content based on the all to-be-determined injection points of the data type.

[0093] The processing module 120 is specifically configured to, for any one of the components, sequentially detect the component based on each detection rule in a preset detection rule corresponding to the component; detect that the component has an injection point under any one detection rule, end the detection of the component, and obtain a first detection result; the first detection result represents that the component has an injection point; no injection point is detected in the component under all detection rules, the detection of the component is ended, and a second detection result is obtained; the second detection result represents that the component has no injection point.

[0094] The component includes a uniform resource locator; after receiving the to-be-detected data, the processing module 120 is further configured to determine that the uniform resource locator is not in a preset whitelist.

[0095] The acquisition module 110 is specifically configured to receive to-be-detected traffic data packets, wherein the to-be-detected traffic data packets are one or more of a plurality of traffic data packets corresponding to the to-be-detected data. Correspondingly, before detecting any one component of the to-be-detected data based on a preset detection rule corresponding to the component, the processing module 120 is further configured to determine that the to-be-detected traffic data packets have the component of the to-be-detected data.

[0096] The processing module 120 is specifically configured to stop receiving all other traffic data packets belonging to the same to-be-detected traffic data as the to-be-detected traffic data packet.

[0097] The security protection device 100 provided in the embodiment of the application has the same implementation principle and technical effects as the foregoing security protection method embodiments. For brevity of description, the part of the device embodiment not mentioned can refer to the corresponding content in the foregoing security protection method embodiments.

[0098] Please refer to Figure 4 The electronic device 200 provided in the embodiment of the application. The electronic device 200 includes a processor 210 and a memory 220.

[0099] The memory 220 and the processor 210 are directly or indirectly electrically connected to each other to realize data transmission or interaction. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. Among them, the memory 220 is used to store a computer program, such as a computer program that stores Figure 3The software function module is the security protection device 100 shown in the middle. The security protection device 100 includes at least one software function module stored in the memory 220 in the form of software or firmware or solidified in the operating system (OS) of the electronic device 200. The processor 210 is configured to execute the executable modules stored in the memory 220, such as the software function modules or computer programs included in the security protection device 100. At this time, the processor 210 is configured to obtain to-be-detected data, detect any one component of the to-be-detected data based on a preset detection rule corresponding to the component, and obtain a detection result of whether the component includes an injection point. Different components of the to-be-detected data correspond to different preset detection rules, and the preset detection rules are used to detect whether there is an injection point. If the detection result of any one of the components indicates that there is an injection point, the to-be-detected data is subjected to abnormal processing.

[0100] The memory 220 can be, but is not limited to, a RAM (Random Access Memory), a ROM (Read Only Memory), a PROM (Programmable Read-Only Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electric Erasable Programmable Read-Only Memory), and the like.

[0101] The processor 210 can be an integrated circuit chip with a signal processing capability. The processor can be a general-purpose processor, including a CPU (Central Processing Unit), an NP (Network Processor), and the like; or can be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The processor can implement or execute the disclosed methods, steps, and logic block diagrams in the embodiments of the present application. The general-purpose processor can be a microprocessor or the processor 210 can also be any conventional processor.

[0102] The electronic device 200 includes, but is not limited to, a personal computer, a server, and the like.

[0103] The embodiment of the present application further provides a computer readable storage medium (hereinafter referred to as a storage medium) having a computer program stored thereon, and the computer program is run by a computer such as the electronic device 200 to execute the security protection method shown above. The computer readable storage medium includes a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various storage medium capable of storing program codes.

[0104] The above merely provides preferred embodiments of the present application but should not be used to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modification, equivalent replacement, improvement, and the like within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A security protection method, characterized in that, include: Acquire the data to be tested; For any component of the data to be detected, the component is detected based on a preset detection rule corresponding to that component to obtain a detection result of whether the component includes an injection point; wherein, the preset detection rules corresponding to different components of the data to be detected are not completely the same, and the preset detection rule is used to detect whether an injection point exists; If the detection result of any of the components indicates the presence of an injection point, then the data to be detected is subjected to anomaly processing.

2. The method according to claim 1, characterized in that, The components include entity content; the preset detection rules include at least one detection rule. The component is detected based on a preset detection rule corresponding to it, including: Determine the data type of the entity content; Based on the data type of the entity content, a set of injection points to be determined, including all injection points to be determined corresponding to the data type of the entity content, is determined from a preset correspondence table between data types and injection points. Based on the set of injection points to be determined, obtain the detection details corresponding to each injection point in the set of injection points to be determined from the preset detection rules corresponding to the entity content; The entity content is detected based on all detection rules corresponding to the set of injection points to be determined.

3. The method according to claim 2, characterized in that, The entity content includes various types of data; Based on the data type of the entity content, a set of injection points to be determined is determined from a preset correspondence table between data types and injection points, including all injection points to be determined corresponding to the data type of the entity content. For each data type included in the entity content, based on that data type, all injection points corresponding to that data type are determined from a preset table of correspondence between data types and injection points. Based on all the injection points to be determined for each data type, a set of injection points to be determined for all data types is obtained, wherein the set of injection points to be determined includes all the injection points to be determined for each data type in the entity content; Accordingly, the entity content is detected based on all detection rules corresponding to the set of injection points to be determined, including: For each data type included in the entity content, the data of that data type is detected based on all the detection rules corresponding to that data type; all the detection rules corresponding to that data type are: based on all the injection points to be determined corresponding to that data type, the detection rules corresponding to all the injection points to be determined corresponding to that data type are determined from the preset detection rules corresponding to the entity content.

4. The method according to claim 1, characterized in that, For any one of the components, the component is detected based on a preset detection rule corresponding to that component, and a detection result is obtained as to whether the component includes an injection point, including: For any one of the components, the component is sequentially tested based on the various test details in the preset test rules corresponding to that component. If an injection point is detected in the component under any of the detection rules, the detection of the component ends and a first detection result is obtained; the first detection result indicates that an injection point exists in the component. No injection point was detected in the component under all detection criteria, so the detection of the component was terminated and a second detection result was obtained; the second detection result indicates that there is no injection point in the component.

5. The method according to claim 1, characterized in that, The components include a Uniform Resource Locator (URL); after receiving the data to be detected, the method further includes: It was determined that the Uniform Resource Locator was not in the preset whitelist.

6. The method according to any one of claims 1-5, characterized in that, The acquisition of the data to be detected includes: Receive traffic data packets to be detected, wherein the traffic data packets to be detected are one or more of a plurality of traffic data packets corresponding to the data to be detected; Accordingly, before detecting any component of the data to be detected based on a preset detection rule corresponding to that component, the method further includes: Determine the components of the data to be detected contained in the traffic data packet to be detected.

7. The method according to claim 6, characterized in that, Anomaly handling of the data to be detected includes: Stop receiving all other traffic data packets belonging to the same traffic data packet to be detected as the traffic data packet to be detected.

8. A safety protection device, characterized in that, include: The acquisition module is used to acquire the data to be detected; The processing module is used to detect any component of the data to be detected based on a preset detection rule corresponding to that component, and to obtain a detection result of whether the component includes an injection point; wherein, the preset detection rules corresponding to different components are not exactly the same, and the preset detection rules are used to detect whether an injection point exists; The processing module is further configured to perform anomaly processing on the data to be detected if the detection result of any of the components indicates the presence of an injection point.

9. An electronic device, characterized in that, include: A memory and a processor, wherein the memory and the processor are connected; The memory is used to store programs; The processor is configured to invoke a program stored in the memory to execute the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-7.

Images