Method for detecting existence of illegal external connection channel in terminal based on middleware injection mode

Abstract

The invention discloses a method for detecting existence of an illegal external connection channel in a terminal based on a middleware injection mode, which comprises the following steps of: loading byte codes by a detection engine, and hooking corresponding functions on a Web application to realize monitoring and intervention on the Web application; when the intranet terminal accesses the detection Web application, the detection engine detects a request message and inserts a static resource in a response; the static resource tries to access the extranet monitoring server from the browser; after the external network monitoring server receives the access data from the static resources, an illegal external connection alarm is immediately carried out; the extranet monitoring server returns an extranet IP and a browser fingerprint of the terminal host in the access data to the static resource; and the static resource sends the external network IP and the browser fingerprint of the terminal host to the internal network monitoring server, and the internal network monitoring server carries out illegal external connection alarm after receiving the external network IP and the browser fingerprint. According to the invention, powerful support can be provided for network security protection, and security detection precision and breadth are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for detecting the existence of illegal external connection channels in a terminal based on a middleware injection mode. Background Art

[0002] In today's network environment, traditional external connection detection methods face many challenges. The Https encryption feature makes it difficult for bypass devices to obtain key information, and traditional methods are useless in non-browser scenarios. Inserting JS through bypass will interfere with website operation and cause compatibility issues. New encryption technology and complex network structures also make traditional methods incapable of handling, prone to misjudgment and possible omission of threats. Traditional methods cannot meet security needs.

[0003] CN107733706A discloses a non-agent illegal external connection monitoring method and system, including an intranet terminal host accessing a business website webpage, and JS code is downloaded to the terminal host through a browser along with the webpage; JS code accesses an external network monitoring server from the terminal host; after the external network monitoring server receives the access data of the JS code, it immediately issues an illegal external connection alarm, and returns the external network IP address of the terminal host to the JS code; the JS code sends the external network IP address and the intranet IP address of the terminal host to the intranet monitoring server together; after the intranet monitoring server receives the data sent by the JS code, it immediately issues an illegal external connection alarm. However, this solution is difficult to detect encrypted traffic with encryption characteristics similar to Https. Moreover, the process of inserting code into the page may interfere with the normal operation of the target website, resulting in a slow loading speed, affecting user experience and business fluency. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention aims to provide a method for detecting the existence of illegal external connection channels in a terminal based on middleware injection.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] The method for detecting the existence of illegal external connection channels in a terminal based on middleware injection includes the following steps:

[0007] S1. The detection engine loads the bytecode and hooks the corresponding functions on the Web application to monitor and intervene in the Web application.

[0008] S2 When the intranet terminal accesses the detection Web application, the detection engine detects the request message and inserts JS code or static resource code in the response;

[0009] S3, JS code or static resource code attempts to access the external network monitoring server from the browser;

[0010] S4. When the external network monitoring server receives access data from JS code or static resource code, it immediately issues an illegal external connection alarm;

[0011] S5. The external network monitoring server returns the external network IP and browser fingerprint of the terminal host in the access data to the JS code or static resource code;

[0012] S6. JS code or static resource code sends the external IP and browser fingerprint of the terminal host to the intranet monitoring server. After receiving the fingerprint, the intranet monitoring server will issue an illegal external connection alarm.

[0013] Furthermore, the static resource code is a cascading style sheet static resource request code.

[0014] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program implements the above method when executed by a processor.

[0015] The present invention also provides a computer device, comprising a processor and a memory, wherein the memory is used to store a computer program; and when the processor is used to execute the computer program, the above method is implemented.

[0016] The beneficial effects of the present invention are:

[0017] 1. The present invention can run inside the application and can effectively detect Http and Https traffic without external decryption, thus avoiding traditional encryption problems.

[0018] 2. The present invention can expand the detection scope by hooking the application backend to cover background scenarios and complex communications.

[0019] 3. It is not limited by the size of the injected code and can avoid the disadvantages of the traditional injection method through the traffic side.

[0020] In short, the present invention can provide strong support for network security protection and improve the accuracy and breadth of security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a flow chart of the method of embodiment 1 of the present invention;

[0022] Figure 2 This is a flow chart of the method of embodiment 2 of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0024] Example 1

[0025] This embodiment provides a method for detecting the existence of illegal external connection channels in a terminal based on middleware injection. Figure 1 As shown, the following steps are included:

[0026] S1. The detection engine loads the bytecode and hooks the corresponding functions on the Web application to monitor and intervene in the Web application. The detection engine can run directly inside the Web application. By hooking the backend of the Web application, the detection scope can be expanded to cover background scenarios and complex communications.

[0027] S2. When the intranet terminal accesses the detection Web application, the detection engine detects the request message and inserts JS code or static resource code in the response. The static resource code is a cascading style sheet static resource request code. When the intranet terminal dynamically sends the detection code, the sent detection code can be dynamically allocated, so it is not limited by the size of the injected code, avoiding the disadvantages of the traditional injection method through the traffic side.

[0028] S3, JS code or static resource code attempts to access the external network monitoring server from the browser.

[0029] S4. When the external network monitoring server receives access data from JS code or static resource code, it immediately issues an illegal external connection alarm.

[0030] S5. The external network monitoring server returns the JS code or static resource code based on the external network IP and browser fingerprint of the terminal host in the access data.

[0031] S6. JS code or static resource code sends the external IP and browser fingerprint of the terminal host to the intranet monitoring server. After receiving the fingerprint, the intranet monitoring server will issue an illegal external connection alarm.

[0032] Example 2

[0033] This embodiment provides an application example of the method described in Embodiment 1, such as Figure 2 As shown, the following steps are included:

[0034] (1) Access the Spring-boot Web portal application from the intranet terminal.

[0035] (2) The detection engine determines whether the Spring-boot Web portal application has loaded bytecode and hook functions (Java). If so, it proceeds to the next step; otherwise, it stops and does not perform the insertion operation.

[0036] (3) Insert static resource code.

[0037] (4) After the static resource code is loaded in the browser, it attempts to access the external network monitoring server.

[0038] (5) The external network monitors whether the server has received the access data. If so, proceed to the next step; otherwise, it is determined that there is no illegal external connection.

[0039] (6) If the external network monitoring server receives access data, it will issue an illegal external connection alarm.

[0040] (7) The external network monitoring server returns the terminal host information (external network IP, browser fingerprint) to the static resource code.

[0041] (8) The static resource code sends the terminal host information to the intranet monitoring server.

[0042] (9) After receiving the information from the terminal host, the internal network monitoring server will issue an illegal external connection alarm.

[0043] (10) The operation and maintenance personnel trace the source based on the external IP address and browser fingerprint of the internal network monitoring server alarm.

[0044] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A method for detecting the existence of illegal external connection channels in a terminal based on middleware injection, characterized in that: The steps include: S1. The detection engine loads the bytecode and hooks the corresponding functions on the Web application to monitor and intervene in the Web application. S2 When the intranet terminal accesses the detection Web application, the detection engine detects the request message and inserts JS code or static resource code in the response; S3, JS code or static resource code attempts to access the external network monitoring server from the browser; S4. When the external network monitoring server receives access data from JS code or static resource code, it immediately issues an illegal external connection alarm; S5. The external network monitoring server returns the external network IP and browser fingerprint of the terminal host in the access data to the JS code or static resource code; S6. JS code or static resource code sends the external IP and browser fingerprint of the terminal host to the intranet monitoring server. After receiving the fingerprint, the intranet monitoring server will issue an illegal external connection alarm.

2. The method according to claim 1, characterized in that The static resource code is a cascading style sheet static resource request code.

3. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 2 is implemented.

4. A computer device, characterized in that: The method comprises a processor and a memory, wherein the memory is used to store a computer program; when the processor is used to execute the computer program, the method described in any one of claims 1 to 2 is implemented.

Images