A phased, multi-dimensional web security detection system

Abstract

This invention discloses a phased, multi-dimensional Web security detection system, relating to the field of Web management technology. This invention performs phased detection on requests to access Web applications sequentially: Step 1: First, the access control engine receives requests from clients to the origin server's services and parses the request content. Based on the extracted information, the access control engine performs blacklist matching, rate limiting detection, and whitelist detection. Step 2: The detection engine receives client requests not on the whitelist and performs anti-tampering identification, basic Web protection detection, CC security protection detection, BOT management phase detection, and API security protection detection. Each phase focuses on different security dimensions, providing targeted detection and protection measures.

Description

Technical Field

[0001] This invention discloses a phased, multi-dimensional Web security detection system, which relates to the field of Web management technology. Background Technology

[0002] With the rapid development of internet technology, web applications have become one of the main ways for various enterprises and organizations to provide services. However, the resulting web security problems are becoming increasingly serious. Attackers use various methods to attack web applications, leading to data leaks, business interruptions, and economic losses. Common web attacks include SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF), distributed denial-of-service (DDoS) attacks, and abuse and malicious calls to API interfaces. While existing web application firewalls (WAFs) can provide a certain level of protection, their protective mechanisms are inadequate in the face of increasingly complex and diverse attack methods. Furthermore, existing WAFs have shortcomings in detection and response speed, accuracy, and flexibility, making them unable to effectively address emerging security threats. Summary of the Invention

[0003] This invention addresses the problems of existing technologies by providing a phased, multi-dimensional Web security detection system, which improves the protection capabilities of Web applications and enhances their security and stability.

[0004] The specific solution proposed in this invention is as follows:

[0005] This invention provides a phased, multi-dimensional web security detection method, which sequentially performs phased detection on requests to access web applications:

[0006] Step 1: First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address.

[0007] Based on the extracted information, the access control engine is used to match it against the blacklist. If a match is found in the IP blacklist or the region blacklist, the access request is immediately denied; otherwise, rate limiting is initiated.

[0008] Rate limiting is used to determine whether the frequency of client requests exceeds a preset threshold for the maximum number of requests per second that each client can initiate. If so, the request is denied; otherwise, it is added to a whitelist for further checks.

[0009] The system checks if a client request is on a whitelist. If it is, the request is allowed to skip the remaining checks and be forwarded directly to the origin server. Otherwise, the system proceeds to the detection engine to perform the remaining checks.

[0010] Step 2: Receive client requests not on the whitelist through the detection engine. First, determine if the requested content is cached. If so, perform tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, proceed with subsequent basic web protection checks. If the requested content is not cached, skip tamper detection and directly proceed with subsequent basic web protection checks.

[0011] Step 3: Perform basic web security checks: Extract request features, including URL parameters, request body content, and HTTP header information. Match these features against a predefined attack pattern library. If a match is found, deny the request; otherwise, perform CC security checks.

[0012] Step 4: Perform CC security protection detection, analyze the behavioral characteristics of the requests, including request frequency, source IP address, and request pattern. Based on the behavioral characteristics, identify whether the request contains potential CC attacks. If so, deny the request access; otherwise, proceed with the BOOT management phase detection.

[0013] Step 5: Perform the BOT management phase detection. Based on the request's behavioral characteristics, identify whether the request originates from a malicious BOT. If so, deny the request access; otherwise, perform API security protection detection.

[0014] Step 6: Perform API security protection testing. Classify the requested API by API purpose, monitor API risks, and detect API vulnerabilities. If the test fails, the request will be rejected. If the test passes, the request will be forwarded to the origin server.

[0015] Furthermore, step 3 of the aforementioned phased, multi-dimensional Web security detection method specifically includes:

[0016] Extract the features of the request.

[0017] A predefined attack pattern library stores SQL injection attack strategies, cross-site scripting attack strategies, and cross-site request forgery attack strategies.

[0018] The system matches the characteristics against predefined attack patterns and attack strategies within a database. If a match is found, the access request is denied; otherwise, a CC security protection check is performed.

[0019] Furthermore, step 4 of the described phased, multi-dimensional Web security detection method specifically includes:

[0020] Anomaly detection algorithms are used to analyze request behavior characteristics.

[0021] Establish a baseline behavior model and record normal traffic patterns using this model.

[0022] Real-time monitoring and analysis of current traffic, comparison with baseline behavior models, and identification of abnormal traffic peaks and abnormal behavior patterns.

[0023] Based on abnormal traffic peaks and abnormal behavior patterns, determine whether there is a potential CC attack. If so, deny access requests; otherwise, conduct BOT management phase detection.

[0024] Furthermore, step 5 of the described phased, multi-dimensional Web security detection method specifically includes:

[0025] Analyze the behavioral characteristics of the request.

[0026] Identify abnormal automated behaviors using machine learning algorithms and a predefined BOT feature library.

[0027] For suspicious requests exhibiting abnormal automated behavior, a CAPTCHA challenge is used to distinguish between human users and automated programs. At the same time, the access patterns of specific IP addresses are monitored to identify the source of malicious bots. If so, the access request is denied; otherwise, API security protection checks are performed.

[0028] Furthermore, step 6 of the described phased, multi-dimensional Web security detection method specifically includes:

[0029] The requested APIs are categorized, their purposes are identified, and appropriate security policies are assigned to different API categories.

[0030] Perform authentication and permission checks to ensure authorized users access specific API interfaces.

[0031] Monitoring API risks: Analyzing request content and parameters to detect abnormal patterns and illegal call behavior.

[0032] Perform API vulnerability detection: Regularly scan and test to identify and fix security vulnerabilities in APIs, preventing known vulnerabilities from being maliciously exploited.

[0033] This invention also provides a phased, multi-dimensional web security detection system, which sequentially performs phased detection on requests to access web applications, including an access control engine and a detection engine.

[0034] First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address.

[0035] The access control engine matches the extracted information against a blacklist. If a match is found in the IP or region blacklist, the access request is immediately denied; otherwise, rate limiting is applied.

[0036] The access control engine performs rate limiting checks to determine whether the frequency of client requests exceeds the preset maximum threshold for the number of requests per second that each client can initiate. If so, the access request is denied; otherwise, it is entered into a whitelist for further checks.

[0037] The access control engine performs whitelist checks to match whether the client request is in the whitelist. If it is, the client request is allowed to skip the remaining checks and be directly forwarded to the origin server. Otherwise, the remaining checks are performed by the detection engine.

[0038] The detection engine receives client requests not on the whitelist. It first checks if the requested content is cached. If so, it performs tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, it performs subsequent basic web protection checks. If the requested content is not cached, it skips tamper detection and directly performs subsequent basic web protection checks.

[0039] Web basic protection checks are performed through a detection engine: Request features are extracted, including URL parameters, request body content, and HTTP header information. These features are then matched against a predefined attack pattern library. If a match is found, access is denied; otherwise, CC security protection checks are performed.

[0040] The detection engine performs CC security protection detection, analyzing the behavioral characteristics of requests, including request frequency, source IP address, and request pattern. Based on these behavioral characteristics, it identifies whether a request contains a potential CC attack; if so, the request is denied; otherwise, it proceeds to the bot management phase for further detection.

[0041] The detection engine performs checks during the BOT management phase, identifying whether a request originates from a malicious BOT based on its behavioral characteristics. If so, the request is denied; otherwise, API security protection checks are performed.

[0042] The detection engine performs API security protection detection, classifies the requested API for API purpose, monitors API risks, and detects API vulnerabilities. If the detection fails, the request is denied access; if the detection passes, the request is forwarded to the origin server.

[0043] Furthermore, the detection engine of the phased, multi-dimensional Web security detection system extracts the characteristics of requests and a predefined attack pattern library. The attack pattern library stores SQL injection attack strategies, cross-site scripting attack strategies, and cross-site request forgery attack strategies. The system matches the characteristics with the attack strategies in the predefined attack pattern library. If a match is found, the request is denied; otherwise, CC security protection detection is performed.

[0044] Furthermore, the detection engine of the phased, multi-dimensional Web security detection system uses anomaly detection algorithms to analyze request behavior characteristics, establish a baseline behavior model, record normal traffic patterns through the baseline behavior model, monitor and analyze current traffic in real time, compare it with the baseline behavior model, identify abnormal traffic peaks and abnormal behavior patterns, and determine whether there is a potential CC attack based on the abnormal traffic peaks and abnormal behavior patterns. If so, the request to access is rejected; otherwise, the detection is carried out in the BOT management stage.

[0045] Furthermore, the detection engine of the phased, multi-dimensional Web security detection system analyzes the behavioral characteristics of requests. Through machine learning algorithms and a predefined BOT feature library, it identifies abnormal automated behavior. For suspicious requests with abnormal automated behavior, it uses a CAPTCHA challenge to distinguish between human users and automated programs. At the same time, it monitors the access patterns of specific IP addresses to identify whether there is a malicious BOT source. If so, it rejects the request for access; otherwise, it performs API security protection detection.

[0046] Furthermore, the detection engine of the phased, multi-dimensional Web security detection system categorizes requested APIs, identifies the purpose of different APIs, and assigns corresponding security policies to different categories of API applications. It performs authentication and permission checks to ensure that authorized users access specific API interfaces, monitors API risks by analyzing request content and parameters, detects abnormal patterns and illegal call behaviors, and performs API vulnerability detection by regularly scanning and testing to identify and fix security vulnerabilities in APIs, preventing known vulnerabilities from being maliciously exploited.

[0047] The advantages of this invention are:

[0048] This invention performs phased, multi-dimensional web security testing. By dividing the system into multiple independent testing phases, one or more phases can be flexibly selected and executed according to business needs, thereby significantly improving system stability and protection effectiveness. Each phase includes access control, website anti-tampering, basic web protection, CC attack protection, BOT management, API security protection, and sensitive information leakage prevention, with each phase focusing on different security dimensions and providing targeted detection and protection measures. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of the application process of the access control engine of this invention.

[0050] Figure 2 This is a schematic diagram of the application process of the website access tampering engine in this invention.

[0051] Figure 3 This is a schematic diagram of the application process of the detection engine of the present invention.

[0052] Figure 4 This is a timing diagram of each detection stage of the present invention. Detailed Implementation

[0053] The present invention will be further described below with reference to the accompanying drawings and specific embodiments, so that those skilled in the art can better understand and implement the present invention. However, the embodiments described are not intended to limit the present invention.

[0054] Example 1

[0055] This invention provides a phased, multi-dimensional web security detection method, which sequentially performs phased detection on requests to access web applications:

[0056] Step 1: First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address.

[0057] Based on the extracted information, the access control engine is used to match it against the blacklist. If a match is found in the IP blacklist or the region blacklist, the access request is immediately denied; otherwise, rate limiting is initiated.

[0058] Rate limiting is used to determine whether the frequency of client requests exceeds a preset threshold for the maximum number of requests per second that each client can initiate. If so, the request is denied; otherwise, it is added to a whitelist for further checks.

[0059] The system checks whether the client request is in the whitelist. If it is, the client request is allowed to skip the remaining checks and be directly forwarded to the origin server. Otherwise, the system enters the detection engine to perform the remaining checks.

[0060] Step 2: Receive client requests not on the whitelist through the detection engine. First, determine if the requested content is cached. If so, perform tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, proceed with subsequent basic web protection checks. If the requested content is not cached, skip tamper detection and directly proceed with subsequent basic web protection checks.

[0061] Step 3: Perform basic web protection detection: Extract the characteristics of the request, including URL parameters, request body content and HTTP header information. Match the characteristics with a predefined attack pattern library. If the match is successful, the request access is rejected; otherwise, perform CC security protection detection.

[0062] Specifically, it may include:

[0063] Extract the features of the request.

[0064] A predefined attack pattern library stores SQL injection attack strategies, cross-site scripting attack strategies, and cross-site request forgery attack strategies.

[0065] The system matches the characteristics against predefined attack patterns and attack strategies within a database. If a match is found, the access request is denied; otherwise, a CC security protection check is performed.

[0066] Step 4: Perform CC security protection detection and analyze the behavioral characteristics of the request, including request frequency, source IP address and request pattern. Based on the behavioral characteristics of the request, identify whether the request has potential CC attack. If so, deny the request access; otherwise, perform detection in the BOT management stage.

[0067] Specifically, it may include:

[0068] Anomaly detection algorithms are used to analyze request behavior characteristics.

[0069] Establish a baseline behavior model and record normal traffic patterns using this model.

[0070] Real-time monitoring and analysis of current traffic, comparison with baseline behavior models, and identification of abnormal traffic peaks and abnormal behavior patterns.

[0071] Based on abnormal traffic peaks and abnormal behavior patterns, determine whether there is a potential CC attack. If so, deny access requests; otherwise, conduct BOT management phase detection.

[0072] The detection strategy can be dynamically adjusted to enhance protection against complex attacks. Once a CC attack is confirmed, the system will immediately take protective measures, such as limiting request frequency, rejecting malicious IP addresses, and triggering alarms, while also logging the attack for subsequent analysis and optimization of the protection strategy.

[0073] Step 5: Perform the detection in the BOT management phase. Based on the behavioral characteristics of the request, identify whether the request has a malicious BOT source. If so, deny the request access; otherwise, perform API security protection detection.

[0074] Specifically, it may include:

[0075] Analyze the behavioral characteristics of the request.

[0076] Identify abnormal automated behaviors using machine learning algorithms and a predefined BOT feature library.

[0077] For suspicious requests exhibiting abnormal automated behavior, a CAPTCHA challenge is used to distinguish between human users and automated programs. At the same time, the access patterns of specific IP addresses are monitored to identify the source of malicious bots. If so, the access request is denied; otherwise, API security protection checks are performed.

[0078] The detection strategy can be dynamically adjusted to respond promptly to new types of BOT attacks. All detected BOT behaviors and the measures taken are recorded in detail for subsequent analysis and optimization of protection strategies. Through this series of steps, the BOT management phase can effectively identify and manage the behavior of automated programs, prevent malicious crawlers and automated attacks, and ensure the normal operation of web applications and data security.

[0079] Step 6: Perform API security protection testing. Classify the requested API by API purpose, monitor API risks, and detect API vulnerabilities. If the test fails, the request will be rejected. If the test passes, the request will be forwarded to the origin server.

[0080] Specifically, it may include:

[0081] The requested APIs are categorized, their purposes are identified, and appropriate security policies are assigned to different API categories.

[0082] Perform authentication and permission checks to ensure authorized users access specific API interfaces.

[0083] Monitoring API risks: Analyzing request content and parameters to detect abnormal patterns and illegal call behavior.

[0084] Perform API vulnerability detection: Regularly scan and test to identify and fix security vulnerabilities in APIs, preventing known vulnerabilities from being maliciously exploited.

[0085] Furthermore, sensitive information can be filtered and processed in the response content from the origin server to the client to ensure that sensitive data is not leaked. Specifically, the response content returned by the server is comprehensively scanned to identify potentially sensitive information, such as ID card numbers, mobile phone numbers, and credit card numbers. Then, according to predefined security policies, the detected sensitive information is processed, including data anonymization and masking, to ensure that this information is not transmitted or exposed in plaintext. The sensitive information leakage prevention stage effectively protects user privacy and data security, prevents the leakage of sensitive information, and ensures the security and compliance of web applications in data processing and transmission.

[0086] This invention also provides a phased, multi-dimensional web security detection system, which sequentially performs phased detection on requests to access web applications, including an access control engine and a detection engine.

[0087] First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address.

[0088] The access control engine matches the extracted information against a blacklist. If a match is found in the IP or region blacklist, the access request is immediately denied; otherwise, rate limiting is applied.

[0089] The access control engine performs rate limiting checks to determine whether the frequency of client requests exceeds the preset maximum threshold for the number of requests per second that each client can initiate. If so, the access request is denied; otherwise, it is entered into a whitelist for further checks.

[0090] The access control engine performs whitelist checks to match whether the client request is in the whitelist. If it is, the client request is allowed to skip the remaining checks and be directly forwarded to the origin server. Otherwise, the remaining checks are performed by the detection engine.

[0091] The detection engine receives client requests not on the whitelist. It first checks if the requested content is cached. If so, it performs tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, it performs subsequent basic web protection checks. If the requested content is not cached, it skips tamper detection and directly performs subsequent basic web protection checks.

[0092] Web basic protection checks are performed through a detection engine: Request features are extracted, including URL parameters, request body content, and HTTP header information. These features are then matched against a predefined attack pattern library. If a match is found, access is denied; otherwise, CC security protection checks are performed.

[0093] The detection engine performs CC security protection detection, analyzing the behavioral characteristics of requests, including request frequency, source IP address, and request pattern. Based on these behavioral characteristics, it identifies whether a request contains a potential CC attack; if so, the request is denied; otherwise, it proceeds to the bot management phase for further detection.

[0094] The detection engine performs checks during the BOT management phase, identifying whether a request originates from a malicious BOT based on its behavioral characteristics. If so, the request is denied; otherwise, API security protection checks are performed.

[0095] The detection engine performs API security protection detection, classifies the requested API for API purpose, monitors API risks, and detects API vulnerabilities. If the detection fails, the request is denied access; if the detection passes, the request is forwarded to the origin server.

[0096] The information interaction and execution process between modules in the above system are based on the same concept as the method embodiments of the present invention, and the specific details can be found in the descriptions in the method embodiments of the present invention, and will not be repeated here.

[0097] Similarly, the system of this invention performs phased, multi-dimensional Web security detection. By dividing the system into multiple independent detection phases, one or more phases can be flexibly selected and executed according to business needs, thereby significantly improving the system's stability and protection effectiveness. Each phase includes access control, website anti-tampering, basic Web protection, CC attack protection, BOT management, API security protection, and sensitive information leakage prevention, with each phase focusing on different security dimensions and providing targeted detection and protection measures.

[0098] These detection phases can operate as independent components, supporting independent testing, development, and iterative upgrades, ensuring the system can quickly adapt to emerging security threats and business needs. This not only enhances system flexibility but also simplifies maintenance and upgrade processes, making optimization and expansion at each stage more convenient. Furthermore, the system's modular architecture allows for personalized configuration based on different scenarios and requirements, providing more precise and efficient security protection.

[0099] It should be noted that not all steps and modules in the above processes and system structures are mandatory; some steps or modules can be omitted as needed. The execution order of the steps is not fixed and can be adjusted as required. The system structures described in the above embodiments can be physical or logical structures. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be implemented by certain components in multiple independent devices.

[0100] The above-described embodiments are merely preferred embodiments provided to fully illustrate the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are all within the scope of protection of the present invention. The scope of protection of the present invention is defined by the claims.

Claims

1. A phased, multi-dimensional Web security detection method, characterized by: For requests to access the web application, each stage of the inspection is performed sequentially: Step 1: First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address. Based on the extracted information, the access control engine is used to match it against the blacklist. If a match is found in the IP blacklist or the region blacklist, the access request is immediately denied; otherwise, rate limiting is initiated. Rate limiting is used to determine whether the frequency of client requests exceeds a preset threshold for the maximum number of requests per second that each client can initiate. If so, the request is denied; otherwise, it is added to a whitelist for further checks. The system checks if a client request is on a whitelist. If it is, the request is allowed to skip the remaining checks and be forwarded directly to the origin server. Otherwise, the system proceeds to the detection engine to perform the remaining checks. Step 2: Receive client requests not on the whitelist through the detection engine. First, determine if the requested content is cached. If so, perform tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, proceed with subsequent basic web protection checks. If the requested content is not cached, skip tamper detection and directly proceed with subsequent basic web protection checks. Step 3: Perform basic web security checks: Extract request features, including URL parameters, request body content, and HTTP header information. Match these features against a predefined attack pattern library. If a match is found, deny the request; otherwise, perform CC security checks. Step 4: Perform CC security protection detection, analyze the behavioral characteristics of the requests, including request frequency, source IP address, and request pattern. Based on the behavioral characteristics, identify whether the request contains potential CC attacks. If so, deny the request access; otherwise, proceed with the BOOT management phase detection. Step 5: Perform the BOT management phase detection. Based on the request's behavioral characteristics, identify whether the request originates from a malicious BOT. If so, deny the request access; otherwise, perform API security protection detection. Step 6: Perform API security protection testing. Classify the requested API by API purpose, monitor API risks, and detect API vulnerabilities. If the test fails, the request will be rejected. If the test passes, the request will be forwarded to the origin server.

2. The phased, multi-dimensional Web security detection method according to claim 1, characterized in that: Step 3 specifically includes: Extract the features of the request. A predefined attack pattern library stores SQL injection attack strategies, cross-site scripting attack strategies, and cross-site request forgery attack strategies. The system matches the characteristics against predefined attack patterns and attack strategies within a database. If a match is found, the access request is denied; otherwise, a CC security protection check is performed.

3. The phased, multi-dimensional Web security detection method according to claim 1, characterized in that: Step 4 specifically includes: Anomaly detection algorithms are used to analyze request behavior characteristics. Establish a baseline behavior model and record normal traffic patterns using this model. Real-time monitoring and analysis of current traffic, comparison with baseline behavior models, and identification of abnormal traffic peaks and abnormal behavior patterns. Based on abnormal traffic peaks and abnormal behavior patterns, determine whether there is a potential CC attack. If so, deny access requests; otherwise, conduct BOT management phase detection.

4. The phased, multi-dimensional Web security detection method according to claim 1, characterized in that: Step 5 specifically includes: Analyze the behavioral characteristics of the request. Identify abnormal automated behaviors using machine learning algorithms and a predefined BOT feature library. For suspicious requests exhibiting abnormal automated behavior, a CAPTCHA challenge is used to distinguish between human users and automated programs. At the same time, the access patterns of specific IP addresses are monitored to identify the source of malicious bots. If so, the access request is denied; otherwise, API security protection checks are performed.

5. The phased, multi-dimensional Web security detection method according to claim 1, characterized in that: Step 6 specifically includes: The requested APIs are categorized, their purposes are identified, and appropriate security policies are assigned to different API categories. Perform authentication and permission checks to ensure authorized users access specific API interfaces. Monitoring API risks: Analyzing request content and parameters to detect abnormal patterns and illegal call behavior. Perform API vulnerability detection: Regularly scan and test to identify and fix security vulnerabilities in APIs, preventing known vulnerabilities from being maliciously exploited.

6. A phased, multi-dimensional Web security detection system, characterized by: The system sequentially performs various stages of detection on requests to access the web application, including an access control engine and a detection engine. First, the access control engine receives requests from clients to the origin server, parses the request content, extracts client IP and URI related information, and identifies the geographic information of the client IP address. The access control engine matches the extracted information against a blacklist. If a match is found in the IP or region blacklist, the access request is immediately denied; otherwise, rate limiting is applied. The access control engine performs rate limiting checks to determine whether the frequency of client requests exceeds the preset maximum threshold for the number of requests per second that each client can initiate. If so, the access request is denied; otherwise, it is entered into a whitelist for further checks. The access control engine performs whitelist checks to match whether the client request is in the whitelist. If it is, the client request is allowed to skip the remaining checks and be directly forwarded to the origin server. Otherwise, the remaining checks are performed by the detection engine. The detection engine receives client requests not on the whitelist. It first checks if the requested content is cached. If so, it performs tamper detection on the URI-related information. If tampering is detected, the request is rejected; otherwise, it performs subsequent basic web protection checks. If the requested content is not cached, it skips tamper detection and directly performs subsequent basic web protection checks. Web basic protection checks are performed through a detection engine: Request features are extracted, including URL parameters, request body content, and HTTP header information. These features are then matched against a predefined attack pattern library. If a match is found, access is denied; otherwise, CC security protection checks are performed. The detection engine performs CC security protection detection, analyzing the behavioral characteristics of requests, including request frequency, source IP address, and request pattern. Based on these behavioral characteristics, it identifies whether a request contains a potential CC attack; if so, the request is denied; otherwise, it proceeds to the bot management phase for further detection. The detection engine performs checks during the BOT management phase, identifying whether a request originates from a malicious BOT based on its behavioral characteristics. If so, the request is denied; otherwise, API security protection checks are performed. The detection engine performs API security protection detection, classifies the requested API for API purpose, monitors API risks, and detects API vulnerabilities. If the detection fails, the request is denied access; if the detection passes, the request is forwarded to the origin server.

7. A phased, multi-dimensional Web security detection system according to claim 6, characterized in that: The detection engine extracts the characteristics of the request and uses a predefined attack pattern library. This library stores SQL injection attack strategies, cross-site scripting attack strategies, and cross-site request forgery attack strategies. The characteristics are matched against the attack strategies in the predefined attack pattern library. If a match is found, the request is denied; otherwise, CC security protection detection is performed.

8. A phased, multi-dimensional Web security detection system according to claim 6, characterized in that: The detection engine uses anomaly detection algorithms to analyze request behavior characteristics, establish a baseline behavior model, record normal traffic patterns through the baseline behavior model, monitor and analyze current traffic in real time, compare it with the baseline behavior model, identify abnormal traffic peaks and abnormal behavior patterns, and determine whether there is a potential CC attack based on the abnormal traffic peaks and abnormal behavior patterns. If so, the request access is denied; otherwise, the BOT management phase detection is performed.

9. A phased, multi-dimensional Web security detection system according to claim 6, characterized in that: By analyzing the behavioral characteristics of requests through a detection engine, and using machine learning algorithms and a predefined BOT feature library, abnormal automated behavior is identified. For suspicious requests with abnormal automated behavior, a CAPTCHA challenge is used to distinguish between human users and automated programs. At the same time, the access patterns of specific IP addresses are monitored to identify whether there is a malicious BOT source. If so, the request is denied; otherwise, API security protection detection is performed.

10. A phased, multi-dimensional Web security detection system according to claim 6, characterized in that: The detection engine categorizes requested APIs, identifies the purpose of different APIs, and assigns corresponding security policies to different categories of API applications. It performs authentication and permission checks to ensure that authorized users can access specific API interfaces and monitors API risks by analyzing request content and parameters, detecting abnormal patterns and illegal call behaviors, and performing API vulnerability detection by regularly scanning and testing to identify and fix security vulnerabilities in APIs and prevent known vulnerabilities from being maliciously exploited.

Images