Data acquisition method, device, electronic device and medium based on encryption request

Abstract

The embodiments of the present disclosure disclose a data acquisition method, device, electronic device and medium based on encrypted requests. A specific implementation of the method includes: determining the plaintext request location information; creating a data source request sandbox isolation environment; performing byte code enhancement processing on the plaintext data source request code to obtain the enhanced plaintext data source request code; starting the isolation environment of the data source request sandbox isolation environment; performing information verification processing on the plaintext data source request information to obtain the request information verification result; performing input parameter identification on the plaintext data source request information to obtain the data source request interface input parameter set; obtaining the request data corresponding to the encrypted data source request information. This implementation method obtains the data corresponding to the encrypted data source request through a code-free intrusion method, which can reduce the intrusion into the original code, omit the decryption step of the encrypted data source request information, improve the efficiency of data acquisition, and reduce the load on the data source test application end.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, device, electronic device, and medium for acquiring data based on an encryption request. Background Art

[0002] With the advancement of encryption technology, the protection of private data is becoming increasingly important and widespread. Therefore, identifying interface parameters for encrypted data requests and obtaining accurate input parameters for requesting data has become a critical issue. The typical approach for obtaining data from encrypted requests is to decrypt the encrypted request to obtain the data request parameters. Then, based on the data request parameters, the requested data is retrieved.

[0003] However, it has been found in practice that when the above method is used to operate log files, the following technical problems often occur: Since decryption requires a large number of calculations and the decryption steps are complicated, the accuracy of identifying the decrypted input parameters is low, resulting in a large load on the data source test application end, low efficiency in obtaining the data source, long acquisition time, and low data security.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the Invention

[0005] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0006] Some embodiments of the present disclosure propose a data acquisition method, apparatus, electronic device, and medium based on an encryption request to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide a data acquisition method based on an encrypted request, comprising: in response to detecting encrypted data source request information of a test interface sent to a data source test application end, determining plaintext request location information of plaintext data source request information corresponding to the encrypted data source request information; creating a data source request sandbox isolation environment based on the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request method; performing byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain enhanced plaintext data source request code; starting the data source request sandbox isolation environment based on the enhanced plaintext data source request code; in response to detecting that the isolation environment is successfully started, performing information verification processing on the plaintext data source request information to obtain a request information verification result; in response to determining that the request information verification result indicates that the verification is passed, performing input parameter identification on the plaintext data source request information to obtain a data source request interface input parameter set; and obtaining request data corresponding to the encrypted data source request information from the data source test application end based on the data source request interface input parameter set.

[0008] In a second aspect, some embodiments of the present disclosure provide a data acquisition device based on an encrypted request, comprising: a determination unit configured to, in response to detecting encrypted data source request information of a test interface sent to a data source test application terminal, determine plaintext request location information of plaintext data source request information corresponding to the above-mentioned encrypted data source request information; a creation unit configured to create a data source request sandbox isolation environment according to the above-mentioned plaintext request location information, wherein the above-mentioned data source request sandbox isolation environment is a non-invasive embedded environment created for the above-mentioned plaintext data source request method; a byte code enhancement unit configured to perform byte code enhancement processing on the plaintext data source request code corresponding to the above-mentioned plaintext data source request information to obtain the enhanced plaintext data source request code. According to the source request code; the isolation environment startup unit is configured to start the isolation environment of the above-mentioned data source request sandbox isolation environment according to the above-mentioned enhanced plaintext data source request code; the information verification unit is configured to, in response to detecting that the isolation environment is successfully started, perform information verification processing on the above-mentioned plaintext data source request information to obtain the request information verification result; the input parameter identification unit is configured to, in response to determining that the above-mentioned request information verification result indicates that the verification is passed, perform input parameter identification on the above-mentioned plaintext data source request information to obtain the data source request interface input parameter set; the acquisition unit is configured to obtain the request data corresponding to the above-mentioned encrypted data source request information from the above-mentioned data source test application end according to the above-mentioned data source request interface input parameter set.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0011] The aforementioned embodiments of the present disclosure have the following beneficial effects: The data acquisition method based on encrypted requests in some embodiments of the present disclosure obtains data corresponding to an encrypted data source request through a non-intrusive code method, which can reduce intrusion into the original code, omit the decryption step of the encrypted data source request information, improve data acquisition efficiency, and reduce the load on the data source test application. Specifically, the reason for the heavy load on the relevant data source test application, low data source acquisition efficiency, long acquisition time, and low data security is that decryption requires a large number of calculations and the decryption steps are complex, which can easily lead to low accuracy in identifying the input parameters after decryption. This results in a heavy load on the data source test application, low data source acquisition efficiency, long acquisition time, and low data security. Based on this, the image segmentation method in some embodiments of the present disclosure can first, in response to detecting encrypted data source request information sent to a test interface of the data source test application, determine the plaintext request location information of the plaintext data source request information corresponding to the encrypted data source request information. This facilitates the subsequent creation of a data source request sandbox isolation environment. Secondly, based on the plaintext request location information, a data source request sandbox isolation environment is created, wherein the data source request sandbox isolation environment is a non-intrusive embedded environment created for the plaintext data source request method. Here, code can be non-invasively embedded without affecting the original code, improving the scalability and maintainability of the data source testing application, thereby increasing the stability of the data source testing application. Next, bytecode enhancement is performed on the plaintext data source request code corresponding to the plaintext data source request information to obtain enhanced plaintext data source request code. Non-invasively performing bytecode enhancement on the original code can improve the stability, maintainability, and scalability of the data source testing application. Subsequently, the data source request sandbox isolation environment is launched based on the enhanced plaintext data source request code. This achieves isolation from the original code and non-invasive code embedding. Next, in response to detecting successful launch of the isolation environment, information verification is performed on the plaintext data source request information to obtain a request information verification result. This allows detection of malicious code injection in the plaintext data source request information, thereby improving the security of the request and, in turn, the security of the private data source data, reducing the risk of data leakage. Then, in response to determining that the request information verification result indicates verification has passed, input parameter identification is performed on the plaintext data source request information to obtain a data source request interface input parameter set. Here, identifying the plaintext input parameters eliminates the decryption step of the encrypted parameters, reducing the extensive mathematical operations involved in the encryption step, reducing the complexity of input parameter identification and the computational load on the data source test application. Finally, based on the input parameter set of the data source request interface, the data source test application retrieves the request data corresponding to the encrypted data source request information.By simulating a real data source server through the data source test application, the security of real data can be improved. The test interface can also be independently tested, isolating the test environment that has dependencies on the test interface, improving test accuracy and data acquisition efficiency. Consequently, this encrypted request-based data acquisition method obtains the data corresponding to the encrypted data source request through a code-free method, reducing intrusion into the original code, omitting the decryption step of the encrypted data source request information, improving data acquisition efficiency, and reducing the load on the data source test application. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flowchart of some embodiments of a data acquisition method based on an encryption request according to the present disclosure;

[0014] Figure 2 is a schematic structural diagram of some embodiments of a data acquisition device based on an encryption request according to the present disclosure;

[0015] Figure 3 is a schematic structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0017] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0018] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0019] It should be noted that the modifications of "one" and "multiple" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0020] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0021] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0022] Figure 1 A process 100 of some embodiments of the data acquisition method based on an encryption request according to the present disclosure is shown. The data acquisition method based on an encryption request includes the following steps:

[0023] Step 101 : In response to detecting encrypted data source request information sent to a test interface of a data source test application, determining plaintext request location information of plaintext data source request information corresponding to the encrypted data source request information.

[0024] In some embodiments, the execution subject (e.g., an electronic device) of the above-mentioned data acquisition method based on encrypted requests can determine the plaintext request location information of the plaintext data source request information corresponding to the encrypted data source request information in response to detecting the encrypted data source request information sent to the test interface of the data source test application. The data source test application can be a virtual platform that simulates a real data source storage server and returns the data source in response to the data source request. For example, the data source test application can be a mock platform. The test interface can be a communication interface between the client and the data source test application. The plaintext data source request information can be request information for accessing data stored in the data source test application. The encrypted data source request information can be ciphertext request information obtained by encrypting the plaintext data source request information. The plaintext request location information can be the location of the code after the plaintext data source request information is generated in the original code that processes the request data in the data source test application before receiving the encrypted request information and before the data source request client sends the encrypted data source request information.

[0025] In the process of adopting technical solutions to solve the above-mentioned technical problem one, the following technical problem two is often accompanied: how to use a small number of test cases to improve the test accuracy and stability of the data source test application end. In response to the above-mentioned technical problem two, the conventional solution is generally: generate a large number of test cases for the data source test application end through expert experience for random testing. However, the above-mentioned conventional solution still has the following technical problems: since a large number of test case sets are generated by expert experience, there is a certain degree of subjectivity, and the test of the data source test application end is not comprehensive, the quality of the test cases cannot be guaranteed and there is a certain degree of repeatability, resulting in a large test load on the data source test application end, and low accuracy of the application end simulation test, which in turn leads to low efficiency and security of data acquisition. Taking into account the shortcomings of conventional solutions and combining the advantages / technical status of the data source test application end tests owned by the inventors, the inventors can decide to adopt the following solutions:

[0026] In some optional implementations of some embodiments, before determining, in response to detecting the encrypted data source request information sent to the test interface of the data source test application, the plaintext request location information of the plaintext data source request information corresponding to the encrypted data source request information, the method may further include:

[0027] The first step is to obtain application platform requirement information of the initial data source test application platform, wherein the application platform requirement information can be text information describing the functions and performance required for designing the initial data source test application platform.

[0028] The second step is to generate an application-side test case set for the initial data source test application platform based on the application platform requirement information. The application-side test cases in the application-side test case set may include test cases related to functional testing, exception testing, boundary condition testing, load testing, stress testing, resource utilization testing, and security testing of the data source test application platform.

[0029] As an example, the execution entity may use an automated test case generation tool to generate an application-side test case set for testing the application platform for the initial data source based on the application platform requirement information. The automated test case generation tool may be an automated testing framework, TestNG.

[0030] The third step is to test the application based on the initial data source and perform the following test steps:

[0031] Sub-step 1: Perform a text similarity calculation on the application-side test case set to obtain a first similarity matrix. Each element in the first similarity matrix may represent the similarity between two corresponding application-side test cases. For example, the element in row i and column j of the first similarity matrix may represent the similarity between application-side test case i and application-side test case j.

[0032] As an example, the execution entity may first perform text preprocessing on the application-side test case sequence to obtain a test case text information set. The text preprocessing may include removing numbers, spaces, and comment characters from the test case sequence. Then, using a latent Dirichlet distribution model, topic modeling is performed on the test case text information set to obtain a probability matrix. The probability matrix may represent the probability of each topic in the topic set to which each test case text information in the test case text information set belongs. The topics in the topic set may be topics obtained by extracting keywords from the text information included in the test cases using the latent Dirichlet distribution model and classifying the keyword set. The element in the i-th row and j-th column of the probability matrix may represent a summary value of the i-th test case belonging to the j-th topic. For example, the topic set may include at least one of the following: an equivalence class, a decision table, and a boundary value. Finally, a similarity calculation is performed on each row vector in the probability matrix to obtain a first similarity matrix. The similarity calculation may be based on Euclidean distance.

[0033] Sub-step 2: Perform statement coverage similarity processing on the application-side test case set to obtain a second similarity matrix. The elements in the second similarity matrix may represent the degree of overlap between the test statements executed when the two corresponding application-side test cases are tested. The statement coverage similarity processing may be similarity processing of the code statements of each function of the code coverage simulation application in the application-side test case.

[0034] As an example, the execution entity may first determine a test statement set for each application-side test case in the application-side test case sequence. Then, the similarity between any two application-side test cases in the application-side test case sequence may be determined using Jaccard distance similarity to obtain a second similarity matrix.

[0035] Sub-step 3: Perform a weighted operation on the first similarity matrix and the second similarity matrix to obtain a third similarity matrix. The weight of the first similarity matrix may be 0.7, and the weight of the second similarity matrix may be 0.3.

[0036] Sub-step 4: Cluster the application-side test case set based on the third similarity matrix to obtain multiple application-side test case clusters. The number of application-side test case clusters in the multiple application-side test case clusters may be determined based on a Davies-Bouldin Index (DB Index). The DB Index can represent the effectiveness of clustering. A smaller DB Index indicates a better clustering effect.

[0037] As an example, the execution entity may utilize a hierarchical clustering algorithm to perform clustering processing on the application-side test case sequence according to the third similarity matrix to obtain a plurality of test case clusters.

[0038] Sub-step 5: For each application-side test case cluster in the plurality of application-side test case clusters, perform the following determination steps:

[0039] In the first sub-step, each application-side test case included in the above application-side test case cluster is determined as an intra-cluster application-side test case set.

[0040] The second sub-step is to determine the feature vector of each intra-cluster application-side test case in the intra-cluster application-side test case set as a test case feature vector set, wherein the test case feature vector can represent the attribute characteristics of the data source test application side.

[0041] In the third sub-step, the feature vector set is input into a defect prediction classification model to obtain a classification result set. The classification results in the classification result set include a classification type and a probability value corresponding to the classification type. The classification types include defective and non-defective. Defective can indicate that the execution result of the application-side test case on the data source test application is inconsistent with the preset execution result. The preset execution result can be the result predicted before the application-side test case is executed. For example, when the application-side test case performs a login boundary value test on a simulation application, the preset execution result is login failure, but the execution result is login success, indicating that the test case is defective. The probability value corresponding to the classification type can indicate the probability value of whether the test case corresponding to the feature vector is a defective test case. For example, the test case feature vector set includes a first feature vector and a second feature vector. The classification type of the first feature vector can be non-defective, and the probability value corresponding to non-defective is 0.8959. The classification type of the second feature vector can be defective, and the probability value corresponding to defective is 0.7895. The defect prediction classification model may be a model for classifying defects in the above-mentioned intra-cluster application-side test case set. For example, the defect prediction classification model may be an SVM (Support Vector Machine) model.

[0042] The fourth sub-step is to sort the intra-cluster application-side test cases in the classification result set that are classified as defective to obtain an intra-cluster application-side test case sequence. The sorting is performed in descending order of the probability values corresponding to the intra-cluster test cases in the classification result set that are classified as defective.

[0043] A fifth sub-step is determining the distance between the application-side test cases classified as defect-free in the classification result set and the cluster center within the cluster, thereby obtaining a set of distance values. The cluster center within the cluster may be the test case located at the center of the application-side test case cluster. The distance value may be a Euclidean distance.

[0044] The sixth sub-step is to sort the distance value set to obtain a distance value sequence, wherein the sorting can be performed in ascending order.

[0045] Sub-step 6, based on the obtained multiple intra-cluster application-side test case sequences and multiple distance value sequences, perform inter-cluster sorting on the above-mentioned multiple application-side test case clusters to obtain inter-cluster application-side test case sequences. The above-mentioned inter-cluster application-side test case sequences can be sequences obtained by inter-cluster sorting of multiple application-side test case clusters. The above-mentioned inter-cluster sorting can be sorted in descending order according to the number of test cases classified as defective in each application-side test case cluster. When multiple application-side test case clusters include the same number of defective application-side test cases, inter-cluster sorting is performed in descending order according to the probability values corresponding to the intra-cluster application-side test cases at the initial position in the intra-cluster test case sequence. When multiple application-side test case clusters do not include defective application-side test cases, inter-cluster sorting is performed in descending order according to the distance values at the terminal position in the distance value set.

[0046] As an example, the execution entity may first determine the number of intra-cluster test cases classified as defective in each of the multiple intra-cluster test case sequences, thereby obtaining a number set. Secondly, the number set may be sorted to obtain a number sequence. The sorting may be performed in descending order. Thirdly, in response to determining that the multiple application-side test case clusters include a set of application-side test case clusters having the same number of defective test cases, the probability value set of the test cases located at the starting position in the corresponding multiple intra-cluster test case sequences may be determined as a defect probability data set. The corresponding multiple intra-cluster test case sequences may be multiple intra-cluster test case sequences corresponding to the set of application-side test cases having the same number of defective test cases. Next, the defect probability value set may be sorted between clusters. The inter-cluster sorting may be performed in descending order of defect probability values. Finally, in response to determining that the multiple application-side test case clusters do not include a set of application-side test case clusters having the same number of defective test cases, the distance value located at the ending position in the corresponding multiple distance value sequences may be determined to obtain a defect distance value. The corresponding multiple distance value sequences may be clusters of multiple test cases that do not contain defects. Finally, the defect distance values are sorted by inter-cluster distance to obtain an inter-cluster application-side test case sequence. The inter-cluster distance sorting may be performed in descending order of distance values.

[0047] Sub-step 7, sampling and adjusting the above-mentioned inter-cluster application-side test case sequence to obtain an adjusted test case sequence. The above-mentioned adjusted test case sequence can be a test case sequence obtained by sampling the above-mentioned inter-cluster test cases. In practice, the above-mentioned execution subject can be first, sorting the test cases classified as defective in multiple application-side test case clusters from large to small according to the probability value, and then, for the application-side test cases in multiple application-side test case clusters classified as non-defective, selecting one application-side test case from the multiple application-side test case clusters in the order of the above-mentioned inter-cluster application-side test case sequence for sorting sampling adjustment.

[0048] Sub-step 8: Send the adjusted test case sequence to the initial data source test application for testing, and obtain an application-side test result. The application-side test result may indicate whether the response to inputting the adjusted test case sequence into the initial data source test application is consistent with the predicted result. The predicted result may be the desired result for each adjusted test case in the adjusted test case sequence.

[0049] Sub-step 9: In response to determining that the application-side test result indicates a successful test, the initial data source test application side is determined as the data source test application side.

[0050] In step 4, in response to determining that the application-side test result indicates a test failure, the initial data source test application is adjusted to obtain an adjusted data source test application, which serves as the data source test application, and the above test steps are executed again. The above adjustment may include adjusting the interface, request payload, etc. of the test application that ignores the application.

[0051] The above technical solution and its related contents serve as an inventive point of the embodiment of the present disclosure, which solves the second technical problem mentioned in the background technology: "Since a large number of test case sets are generated by expert experience, there is a certain degree of subjectivity, and the test on the data source test application end is not comprehensive, the quality of the test cases cannot be guaranteed and there is a certain degree of repeatability, resulting in a large test load on the data source test application end, and low accuracy of the application end simulation test, which in turn leads to low efficiency and security of data acquisition." The factors that lead to a large test load on the data source test application end, low accuracy of the application end simulation test, and low efficiency and security of data acquisition are often as follows: Since a large number of test case sets are generated by expert experience, there is a certain degree of subjectivity, and the test on the data source test application end is not comprehensive, the quality of the test cases cannot be guaranteed and there is a certain degree of repeatability. If the above factors are solved, the test load on the data source test application end can be reduced, the accuracy of the application end simulation test is low, and the efficiency and security of data acquisition can be improved. In order to achieve this effect, the present invention first generates an application-side test case set through platform demand information. Automatically generating test cases can avoid the subjectivity generated through expert experience, improve the objectivity and comprehensiveness of the application-side test case set, and facilitate the accuracy of subsequent testing of the data source test application end. Secondly, the above-mentioned test case sequence is subjected to text similarity calculation and statement coverage similarity processing, and the similarity of the application-side test case to the data source test application end is considered from the perspective of static text and dynamic statement coverage, which is conducive to improving the subsequent optimization effect of the test case sequence. Thirdly, the above-mentioned first similarity matrix and the above-mentioned second similarity matrix are weighted. From the perspective of static text and dynamic coverage statements, the similarity of the application-side test case can be more comprehensively evaluated, which is conducive to improving the accuracy of subsequent clustering processing. Then, according to the above-mentioned third similarity matrix, the above-mentioned test case sequence is clustered, and similar test cases are divided into the same cluster, which is convenient for faster identification of defects existing in the data source test application end. Subsequently, for each of the multiple application-side test case clusters, the following determination steps are performed: feature extraction is performed on the test case set within the cluster and then input into the defect prediction and classification model, and the application-side test cases within the cluster are sorted. This can accelerate the identification of defects in the data source test application, thereby improving testing efficiency. Then, intra-cluster sorting and inter-cluster sorting are performed on the multiple application-side test case clusters to prioritize test cases with defects, which is conducive to faster identification of defects in the data source test application, improving the detection rate of application-side test cases, and reducing the load on the data source test application.Afterwards, sampling adjustments are made to the inter-cluster test case sequence. By pre-testing the application-side test cases that are most likely to detect the data source test application, the number of application-side test cases can be reduced, the test rate for the data source test application can be increased, and the test load on the data source test application can be reduced. Finally, by adjusting the test case sequence's test results to determine whether to make application-side adjustments to the data source test application, the accuracy of the data source test application's response requests can be improved, the accuracy and efficiency of data acquisition can be enhanced, data security can be guaranteed, and the load on the data source test application's test cases can be reduced.

[0052] Step 102: Create a data source request sandbox isolation environment based on the plaintext request location information.

[0053] In some embodiments, the execution entity may create a data source request sandbox isolation environment based on the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request method. The data source request sandbox isolation environment may be a code environment for performing non-invasive aspect-oriented programming in the original code of the data source test application. The creation may be performed using the after method in the sandbox.

[0054] As an example, the execution entity may utilize Spring AOP (Spring Aspect-Oriented Programming Dynamic Proxy) to create a data source request sandbox isolation environment based on the plaintext request location information.

[0055] Step 103: Perform byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain an enhanced plaintext data source request code.

[0056] In some embodiments, the execution entity may perform bytecode enhancement on the plaintext data source request code corresponding to the plaintext data source request information to obtain enhanced plaintext data source request code. The plaintext data source request code may be the original code related to the data source request in the data source test application. The enhanced plaintext data source request code may be code that implements input parameter recognition by class-isolating the original code.

[0057] As an example, the execution entity may utilize the bytecode manipulation and analysis framework ASM to perform bytecode enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain an enhanced plaintext data source request code.

[0058] Step 104 : Based on the enhanced plaintext data source request code, the data source request sandbox isolation environment is started.

[0059] In some embodiments, the above-mentioned execution subject can start the isolation environment of the above-mentioned data source request sandbox isolation environment according to the above-mentioned enhanced plaintext data source request code. Among them, the above-mentioned isolation environment startup can be achieved through the following steps: first, it is necessary to use the Attach interface or javaagent parameters to mount the proxy agent, and initialize the proxy agent. Secondly, the above-mentioned enhanced plaintext data source request code is appended to the startup class loader in the initialization for loader loading, so as to communicate with the original code. Then, in response to the successful code communication, the isolation environment of the above-mentioned data source request sandbox isolation environment is started.

[0060] In some optional implementations of some embodiments, starting the isolated environment for the data source request sandbox isolation environment based on the enhanced plaintext data source request code may include the following steps:

[0061] The first step is to perform spy-type method tracking on the enhanced plaintext data source request code to obtain the plaintext request spy-type code. The plaintext request spy-type code can be the user data collection code added after the plaintext data source request code. For example, the plaintext code request spy-type code can be the spy sandbox spy-type code in the sandbox.

[0062] The second step is to perform cross-cutting declarative loading on the above-mentioned plaintext request spy class code. The above-mentioned cross-cutting declarative loading can be loaded through dynamic proxy in the original code.

[0063] The third step is to establish code communication between the above plaintext request spy class code and the business original code in response to detecting that the above plaintext request spy class code is loaded successfully.

[0064] In the fourth step, in response to detecting that the code communication is successful, the data source request sandbox isolation environment is started.

[0065] In some optional implementations of some embodiments, the cross-cutting declarative loading of the plaintext request spy class code may include the following steps:

[0066] The first step is to construct an abstract syntax tree for the plaintext data source request code corresponding to the plaintext data source request information to obtain a test interface call syntax tree. The test interface call syntax tree can represent the tree structure of the call relationship between the call method set and the call object set included in the source code. In practice, the execution subject can first perform word segmentation on the source code file to obtain an interface syntax unit set. The interface syntax unit in the interface syntax unit set can be the smallest unit that cannot be divided in the source code file. For example, the interface syntax unit set can include but is not limited to at least one of the following: keywords, identifiers, operators, parameter values, strings, spaces, and comments. Then, the interface syntax unit set is subjected to syntax analysis to obtain an interface call syntax tree.

[0067] The second step is to parse the test interface call syntax tree to obtain an interface call connectivity graph. The interface call connectivity graph can be a directed graph that displays the call relationships and processes between nodes. The nodes included in the interface call connectivity graph include interface call method nodes and data nodes. The interface call method nodes can represent method calls and operators in an interface call. The data nodes can represent objects and parameter values in an interface call. Edges in the interface call connectivity graph can represent call relationships between interface call method nodes and data nodes.

[0068] The third step is to perform a breadth-first search on the interface call connectivity graph to obtain application interface parameter configuration information. The application interface parameter configuration information may be configuration information for test interface parameters. The interface parameter configuration information may include, but is not limited to, at least one of the following: interface address information, interface parameter name, interface type information, and interface parameter format.

[0069] The fourth step is to adopt the sandbox class loading parent delegation model and determine the parent request class loader of the above-mentioned plaintext request spy class code according to the above-mentioned application interface parameter configuration information. Among them, the above-mentioned sandbox class loading parent delegation model can be a model that is loaded by the classification loader built into the Java virtual machine through the loader, and is loaded by itself if the parent class loader cannot load. The above-mentioned parent request class loader can be the parent loader of the application class loader that loads the plaintext request spy class code. For example, the loaders built into the Java virtual machine include: the startup class loader, the extension class loader, the application class loader and the user-defined loader. The above-mentioned startup class loader is the class loader of the top-level parent class. It should be noted that by adopting the sandbox class loading parent delegation model, the code loaded by the class loader can have a hierarchical relationship with priority, ensuring that the data source test application end loads the same code when loading the enhanced plaintext data source request code, ensuring the security and uniformity of the loader loading, avoiding the problem of repeated loading, and reducing the load and security of the data source test application end.

[0070] In step 5, in response to determining that the parent request class loader is not the target parent request class loader, a parent request class loader of the parent request class loader is determined as the parent parent request loader, wherein the target parent request class loader may be the initiating class loader.

[0071] In step 6, in response to determining that the parent parent request loader is loading the target parent request class, the parent parent request loader is cross-cuttingly declaratively loaded to obtain a request loading result, wherein the request loading result can indicate whether the loading is successful.

[0072] In the seventh step, in response to determining that the above request loading result indicates that the loading is unsuccessful, the above plaintext request spy class code is cross-cuttingly loaded declaratively.

[0073] Step 105 , in response to detecting that the isolation environment is successfully started, information verification processing is performed on the above-mentioned plaintext data source request information to obtain a request information verification result.

[0074] In some embodiments, the execution entity may, in response to detecting that the isolation environment has been successfully started, perform information verification on the plaintext data source request information to obtain a request information verification result. The request information verification result may indicate whether the request code corresponding to the plaintext data source request information contains any anomalies.

[0075] In some optional implementations of some embodiments, performing information verification processing on the plaintext data source request information to obtain a request information verification result may include the following steps:

[0076] The first step is to convert the data source request code corresponding to the plaintext data source request information to obtain the converted data source request code. The data source request code can be a code of the data source request information written in Java. The converted data source request code can be Jimple intermediate code, which is used to simplify the data source request code and turn it into a code that is easy to analyze and optimize. In practice, the execution entity can use a bytecode parsing compiler to convert the data source request code corresponding to the plaintext data source request information to obtain the converted data source request code. The bytecode parsing compiler can be a Soot tool.

[0077] The second step is to determine a conditional judgment statement code set in the converted data source request code, wherein the conditional judgment statement in the conditional judgment statement code set may be a code statement containing judgment words and conditions.

[0078] The third step is to perform static code instrumentation on each conditional judgment statement code in the above-mentioned conditional judgment statement code set to obtain an instrumented conditional judgment statement code set. The instrumented conditional judgment statement in the above-mentioned instrumented conditional judgment statement code set may be a statement that inserts a virtual call statement before the above-mentioned conditional judgment statement code and sets the variable parameters involved in the conditional judgment statement code to the parameters in the virtual call statement. In practice, the above-mentioned execution entity may first perform the following setting steps for each conditional judgment statement code in the above-mentioned conditional judgment statement code set: Step 1: Insert a target virtual method call statement before the above-mentioned conditional judgment statement code to obtain a post-insertion judgment statement. Step 2: Set the variables involved in the above-mentioned conditional judgment statement code to the parameters of ifMethod(). Then, determine each obtained virtual method as a method in the target virtual class. Finally, set ifMethod() to a Sink API (Sink Application Programming Interface). Step 3: Insert a target virtual method call statement before the above-mentioned conditional judgment statement code to obtain a post-insertion judgment statement. It should be noted that the static taint analysis method can be used to determine the data source flow path from the specified data source start flow interface to the call statement corresponding to the ifMethod() virtual method.

[0079] The fourth step is to generate a data flow control flow chart for the plaintext data source request information based on the above-mentioned instrumentation condition judgment statement code set. The above-mentioned data flow control flow chart can represent a directed graph of the flow process of the data source request.

[0080] As an example, the execution subject may utilize the interface analysis method in the static control flow analysis method to generate a data flow control flowchart for the plaintext data source request information based on the instrumentation condition judgment statement code set.

[0081] The fifth step is to extract the out-of-domain context of the above-mentioned instrumented conditional judgment statement code set according to the above-mentioned data flow control flow chart to obtain an out-of-domain context information set, wherein the out-of-domain context information is information that controls the judgment result of the above-mentioned conditional judgment statement code set.

[0082] As an example, the execution entity can employ a static detection method to identify, within the instrumented conditional judgment statement code set, statement codes containing a data source initiation flow interface as the out-of-domain conditional judgment statement code set. The parameter set included in the out-of-domain conditional judgment statement code set can then be identified as the out-of-domain context information set.

[0083] The sixth step is to determine the conditional judgment statement code set corresponding to the above-mentioned out-of-domain context information set as the target conditional judgment statement code set.

[0084] In the seventh step, control flow dependency analysis is performed on the target conditional judgment statement code set to generate a conditional judgment scope for each target conditional judgment statement code in the target conditional judgment statement code set, thereby obtaining a conditional judgment scope set. The conditional judgment scope may represent the scope of the code context covered by the target conditional judgment statement code.

[0085] In the eighth step, based on the above conditional judgment range set, the above binary data source request code is subjected to intra-domain context extraction to obtain an intra-domain context information set, wherein the intra-domain context information represents the data flow within the conditional judgment range.

[0086] As an example, the execution entity may first determine each target conditional judgment statement code included in each conditional judgment scope set to obtain a conditional judgment statement code group set within the scope. Then, the execution entity may determine each data flow parameter included in the conditional judgment statement code group set within the scope as the intra-domain context information set.

[0087] In step 9, based on the in-domain context information set and the out-of-domain context information set, the plaintext data source request information is subjected to anomaly detection processing to obtain an anomaly detection result as the request information verification result. The anomaly detection result can indicate whether the data source request code is an abnormal result.

[0088] Optionally, performing anomaly detection processing on the plaintext data source request information based on the intra-domain context information set and the extra-domain context information set to obtain an anomaly detection result as the request information verification result may include the following steps:

[0089] The first step is to perform feature extraction on the intra-domain context information set and the extra-domain context information set to obtain an intra-domain feature information set and an extra-domain feature information set. The intra-domain feature information in the intra-domain feature information set may represent information about features of the intra-domain context information. The extra-domain feature information in the extra-domain feature information set may represent information about features in the extra-domain context information. The extra-domain feature information set may include extra-domain privacy data, extra-domain reflection mechanism information, and extra-domain Uniform Resource Locator (URL) call information. The intra-domain feature information set may include extra-domain privacy data, intra-domain dynamic loading information, intra-domain reflection mechanism information, intra-domain URL call information, and intra-domain conditional judgment branch similarity. The intra-domain conditional judgment branch similarity may represent the degree of difference between two conditional judgment branches within a conditional judgment scope. The greater the intra-domain conditional judgment branch similarity, the greater the likelihood that the extra-domain conditional judgment statement code corresponding to the intra-domain context information contains an anomaly. The intra-domain conditional judgment branch similarity may be obtained by the following steps: The first step is to determine the union and intersection of the parameter sets included in the two conditional judgment branches within the conditional judgment scope. The second step is to determine the ratio of the intersection to the union. The third step is to determine the difference between a preset value and the ratio, which is used as the domain condition to determine the branch similarity. The preset value can be a pre-set value. For example, the preset value can be 1.

[0090] The second step is to perform feature embedding on the above-mentioned in-domain feature information set and the above-mentioned out-of-domain feature information set to obtain an out-of-domain feature vector set and an in-domain feature vector set. The in-domain feature vectors in the above-mentioned in-domain feature vector set may represent the in-domain feature information in the form of a vector. The out-of-domain feature vectors in the above-mentioned out-of-domain feature vector set may represent the out-of-domain feature information in the form of a vector. In practice, the above-mentioned execution entity may use a text embedding algorithm to perform feature embedding on the above-mentioned in-domain feature information set and the above-mentioned out-of-domain feature information set to obtain an out-of-domain feature vector set and an in-domain feature vector set.

[0091] The third step is to determine the feature similarity between each out-of-domain feature vector in the out-of-domain feature vector set and each in-domain feature vector in the in-domain feature vector set to obtain a feature similarity group set.

[0092] In the fourth step, at least one in-domain feature vector and at least one out-domain feature vector are selected from the in-domain feature vector set and the out-domain feature vector set, each of which has a corresponding feature similarity greater than or equal to a preset similarity threshold. The preset similarity threshold may be a preset maximum similarity value. For example, the preset similarity threshold may be 0.8.

[0093] Step 5: Optimize the code anomaly detection model to obtain an optimized code anomaly detection model. The optimized code anomaly detection model can be a model that selects parameters that best match the code anomaly detection model and the information verification scenario. The code anomaly detection model can be a deep network model that determines whether the input data source request code is an anomaly. The code anomaly detection model can be a random forest anomaly detection model.

[0094] In the sixth step, the at least one in-domain feature vector and the at least one out-of-domain feature vector are input into the trained optimized code anomaly detection model to obtain an anomaly detection result as a request information verification result.

[0095] In some optional implementations of some embodiments, the above-mentioned optimization of the code anomaly detection model to obtain the optimized code anomaly detection model may include the following steps:

[0096] The first step is to initialize the parameter set of the code anomaly detection model to obtain an initial parameter set as the initial ant colony and the initial ant lion colony, wherein the initial parameter set includes at least one of the following: a penalty factor and a kernel function parameter. The parameters in the parameter set can characterize the generalization performance of the code anomaly detection model to improve the classification accuracy of the code anomaly detection model. The penalty factor can characterize the trade-off between controlling the complexity of the code anomaly detection model and the accuracy of anomaly classification. The kernel function parameter can characterize the complexity and structure of the mapping of the training sample data of the code anomaly detection model to the high-dimensional feature space. The initialized ant colony can be an ant colony initial position information set obtained by initializing the position of the ant colony. The initialized ant lion colony can be an ant lion initial position information set obtained by initializing the position of the ant lion colony. The initialization process can be an initialization performed using a tent chaos mapping algorithm.

[0097] The second step is to generate a model fitness function for the above-mentioned code anomaly detection model. The above-mentioned model fitness function can characterize the classification accuracy performance of the above-mentioned code anomaly detection model. The above-mentioned model fitness function may include: a classification hyperplane function and a classification category discrimination function. The above-mentioned classification hyperplane constraint function may characterize the function of finding the optimal classification hyperplane to maximize the classification interval. The above-mentioned classification hyperplane constraint function is based on the principle of structural risk minimization, aiming to balance the complexity and classification error rate of the above-mentioned code anomaly detection model. The above-mentioned classification hyperplane function may include: a classification hyperplane objective function and a classification hyperplane constraint function. The above-mentioned classification hyperplane objective function can be ω can represent the normal vector of the hyperplane. It can represent the maximum interval between any two sample data. ||ω|| 2 It can represent the square of the normal vector of the hyperplane. C can represent the penalty factor. ξ i Can be a non-negative relaxation factor, representing the classification error allowed for the i-th sample partition. l can represent the number of training samples for the anomaly detection model in the above code. It can be used to express the degree of penalty for misclassified training samples. The above classification hyperplane constraint function can be y i Can represent the classification label of the i-th training sample. b can be a bias term, which represents the degree of translation of the hyperplane. The above classification category discriminant function can be The fitness function of the above model can be. f(x) can represent the classification category discriminant function. sgn() can represent the sign function. α i It can be expressed as a Lagrange multiplier. K(x i , x) can represent sample x i And the Gaussian radial basis kernel function of sample x, the Gaussian radial basis kernel function can be Among them, σ can represent the kernel function parameter. j Can represent the classification label of the jth training sample. x can represent the training sample of the anomaly detection model in the above code. i It can represent the i-th training sample. j It can represent the jth training sample. It can be a classification bias term that characterizes the degree of translation of the translation hyperplane. Can represent sample x i and sample x j Gaussian radial basis kernel function.

[0098] The third step is to perform the following determination steps based on the initialization of the ant colony and the initialization of the ant lion colony:

[0099] Sub-step 1: Substitute the initialized ant colony and the initialized ant lion colony into the above model fitness function to obtain the ant colony fitness function value set and the ant lion fitness function value set.

[0100] Sub-step 2: Select the antlion fitness function value with the largest value from the antlion fitness function value set as the target antlion fitness function value, and determine the antlion corresponding to the target antlion fitness function value as the target antlion.

[0101] Sub-step 3: Determine the initialization ant lion corresponding to each initialization ant in the initialization ant colony as the associated ant lion group. In practice, the execution entity may use a roulette wheel selection algorithm to determine the initialization ant lion corresponding to each initialization ant in the initialization ant colony as the associated ant lion group.

[0102] Sub-step 4: updating the position of the initialized ant colony based on the associated ant lion colony and the target ant lion to obtain an updated ant colony. The position of each updated ant in the updated ant colony may be a position information in which the ant's random walk range is gradually reduced due to the random walk of the target ant lion and the associated ant lion.

[0103] As an example, the execution entity may perform the following update steps for each initialized ant in the initialized ant colony: determine the associated ant lion of the initialized ant colony. The updated ant is determined as the sum of the product of the associated ant lion and a first weight threshold, and the product of the target ant lion and a second weight threshold. The first weight threshold can be obtained by the following steps: first, determine the ratio of the number of executions of the determination step to a preset execution threshold, and the cosine value of π, as the number cosine value. Second, determine the sum of the number cosine value and a first preset factor threshold as a first numerical sum. The first preset factor threshold may be a preset maximum factor threshold that characterizes the ant lion's search for the ant. The first preset factor threshold may be 0.7. Third, determine the sum of the first preset factor threshold and a second preset factor threshold as a second numerical sum. The second preset factor threshold may be a preset minimum factor threshold that characterizes the ant lion's search for the ant. The first preset factor threshold may be 0.2. Then, the ratio of the sum of the first numerical value and the product of the sum of the second numerical value to 2 is determined. Finally, the sum of the ratio value and the preset threshold is determined as the first weight threshold. The preset threshold may be a pre-set value. For example, the preset threshold may be 0.2. The second weight threshold may be the difference between 1 and the first weight threshold. This step can make the search range of the constructed ant lion and ant colony more consistent with the search range of ant colonies and ant lions in nature by presetting the weight threshold, thereby enhancing the solution efficiency and reducing the probability of falling into a local end to a certain extent.

[0104] Sub-step 5: Substitute the updated ant colony into the above model fitness function to obtain the updated fitness function value set of the ant colony.

[0105] Sub-step 6: Compare each ant colony's updated fitness function value in the ant colony's updated fitness function value set with the ant lion's fitness function value corresponding to the ant colony's updated fitness function value in the ant lion's fitness function value set to obtain a comparison result set.

[0106] Sub-step 7: Based on the comparison result set, the updated ant colony and the initial ant lion colony are updated to obtain a target updated ant colony and an updated ant lion colony. The target updated ant colony can be the position information set of the remaining ants after some ants are captured by ant lions and the remaining ants randomly wander around. The updated ant lions can be the position information of all ant lions randomly wandering around after the ant lions capture the ant and use the ant's position as the ant lion's refined position.

[0107] As an example, the execution entity may first, in response to determining at least one comparison result in the comparison result set representing an ant colony's updated fitness function value greater than the corresponding ant lion's fitness function value, determine the position information of each ant corresponding to the updated fitness function value of each ant colony corresponding to the at least one comparison result as the position information of each corresponding ant lion. Then, the updated ant colony is removed from the at least one updated ant corresponding to the at least one comparison result, and the target updated ant colony is determined. Finally, the ant lions corresponding to the position information of each ant lion and at least one initialized ant lion whose updated fitness function value representing the ant colony is less than or equal to the corresponding ant lion fitness function value are determined as the updated ant lion colony.

[0108] Sub-step 8: Determine the number of times the above determination step has been performed.

[0109] Sub-step 9: In response to determining that the number of executions is greater than or equal to a preset execution threshold, the target update ant colony and the update ant lion colony are determined as the target parameter set of the code anomaly detection model, thereby obtaining an optimized code anomaly detection model. The preset execution threshold may be a pre-set maximum number of iterations of the determination step. For example, the preset execution threshold may be 100.

[0110] In the fourth step, in response to determining that the number of executions is less than the above-mentioned preset execution threshold, the target update ant colony and the update ant lion colony are determined to be the initialization ant colony and the initialization ant lion colony, and the sum of the number of executions and the preset threshold is determined to be the number of executions, so as to perform the above-mentioned determination step again. Among them, the above-mentioned preset threshold can be a pre-set threshold. For example, the above-mentioned preset threshold can be 1. It should be noted that by using ant colonies and ant lion colonies to perform cyclic iterative processing on the relevant parameters of the above-mentioned code anomaly detection model, the accuracy of the code anomaly detection model in identifying code anomalies can be improved, and the code anomaly detection model can be made more in line with the information detection scenario, thereby improving the security of the data source test application end, improving the security of the acquired data, and reducing the risk of data leakage stored in the data source test application end.

[0111] Step 106 : In response to determining that the request information verification result indicates that the verification has passed, input parameter identification is performed on the plaintext data source request information to obtain a data source request interface input parameter set.

[0112] In some embodiments, in response to determining that the request information verification result indicates that the verification has passed, the execution entity may identify input parameters of the plaintext data source request information to obtain a data source request interface input parameter set. The data source request interface input parameter parameters in the data source request interface input parameter set may be parameters of the requested data source.

[0113] Step 107: Obtain request data corresponding to the encrypted data source request information from the data source test application terminal according to the input parameter set of the data source request interface.

[0114] In some embodiments, the execution entity may obtain the request data corresponding to the encrypted data source request information from the data source test application based on the input parameter set of the data source request interface. The request data may be data stored in the data source test application obtained by the encrypted data source request information.

[0115] Optionally, after step 107, the execution subject may further perform the following steps:

[0116] In response to determining that the request information verification result indicates that the verification has failed, the data request for the encrypted data source request information is terminated.

[0117] The aforementioned embodiments of the present disclosure have the following beneficial effects: The data acquisition method based on encrypted requests in some embodiments of the present disclosure obtains data corresponding to an encrypted data source request through a non-intrusive code method, which can reduce intrusion into the original code, omit the decryption step of the encrypted data source request information, improve data acquisition efficiency, and reduce the load on the data source test application. Specifically, the reason for the heavy load on the relevant data source test application, low data source acquisition efficiency, long acquisition time, and low data security is that decryption requires a large number of calculations and the decryption steps are complex, which can easily lead to low accuracy in identifying the input parameters after decryption. This results in a heavy load on the data source test application, low data source acquisition efficiency, long acquisition time, and low data security. Based on this, the image segmentation method in some embodiments of the present disclosure can first, in response to detecting encrypted data source request information sent to a test interface of the data source test application, determine the plaintext request location information of the plaintext data source request information corresponding to the encrypted data source request information. This facilitates the subsequent creation of a data source request sandbox isolation environment. Secondly, based on the plaintext request location information, a data source request sandbox isolation environment is created, wherein the data source request sandbox isolation environment is a non-intrusive embedded environment created for the plaintext data source request method. Here, code can be non-invasively embedded without affecting the original code, improving the scalability and maintainability of the data source testing application, thereby increasing the stability of the data source testing application. Next, bytecode enhancement is performed on the plaintext data source request code corresponding to the plaintext data source request information to obtain enhanced plaintext data source request code. Non-invasively performing bytecode enhancement on the original code can improve the stability, maintainability, and scalability of the data source testing application. Subsequently, the data source request sandbox isolation environment is launched based on the enhanced plaintext data source request code. This achieves isolation from the original code and non-invasive code embedding. Next, in response to detecting successful launch of the isolation environment, information verification is performed on the plaintext data source request information to obtain a request information verification result. This allows detection of malicious code injection in the plaintext data source request information, thereby improving the security of the request and, in turn, the security of the private data source data, reducing the risk of data leakage. Then, in response to determining that the request information verification result indicates verification has passed, input parameter identification is performed on the plaintext data source request information to obtain a data source request interface input parameter set. Here, identifying the plaintext input parameters eliminates the decryption step of the encrypted parameters, reducing the extensive mathematical operations involved in the encryption step, reducing the complexity of input parameter identification and the computational load on the data source test application. Finally, based on the input parameter set of the data source request interface, the data source test application retrieves the request data corresponding to the encrypted data source request information.By simulating a real data source server through the data source test application, the security of real data can be improved. The test interface can also be independently tested, isolating the test environment that has dependencies on the test interface, improving test accuracy and data acquisition efficiency. Consequently, this encrypted request-based data acquisition method obtains the data corresponding to the encrypted data source request through a code-free method, reducing intrusion into the original code, omitting the decryption step of the encrypted data source request information, improving data acquisition efficiency, and reducing the load on the data source test application.

[0118] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a data acquisition device based on an encryption request. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the data acquisition device based on encryption request can be specifically applied to various electronic devices.

[0119] like Figure 2 As shown, a data acquisition device 200 based on an encrypted request includes: a determination unit 201, a creation unit 202, a byte code enhancement unit 203, an isolation environment startup unit 204, an information verification unit 205, an input parameter identification unit 206, and an acquisition unit 207. The determination unit 201 is configured to: in response to detecting encrypted data source request information sent to a test interface of a data source test application end, determine the plaintext request location information of the plaintext data source request information corresponding to the encrypted data source request information. The creation unit 202 is configured to: create a data source request sandbox isolation environment based on the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request method. The byte code enhancement unit 203 is configured to: perform byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain the enhanced plaintext data source request code. The isolation environment startup unit 204 is configured to: start the data source request sandbox isolation environment based on the enhanced plaintext data source request code. The information verification unit 205 is configured to: in response to detecting that the isolation environment is successfully started, perform information verification processing on the above-mentioned plaintext data source request information to obtain a request information verification result. The input parameter identification unit 206 is configured to: in response to determining that the above-mentioned request information verification result indicates that the verification has passed, perform input parameter identification on the above-mentioned plaintext data source request information to obtain a data source request interface input parameter set. The acquisition unit 207 is configured to: according to the above-mentioned data source request interface input parameter set, obtain the request data corresponding to the above-mentioned encrypted data source request information from the above-mentioned data source test application end.

[0120] It is understandable that the units recorded in the data acquisition device 200 based on the encryption request and the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the data acquisition device 200 based on encryption request and the units included therein, and will not be described in detail here.

[0121] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0122] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0123] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0124] In particular, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from a network via the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are performed.

[0125] It should be noted that in some embodiments of the present disclosure, the computer-readable medium mentioned above may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0126] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0127] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to detecting encrypted data source request information sent to a test interface of a data source test application, determines plaintext request location information of plaintext data source request information corresponding to the encrypted data source request information; creates a data source request sandbox isolation environment based on the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request method; performs byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain enhanced plaintext data source request code; starts the data source request sandbox isolation environment based on the enhanced plaintext data source request code; in response to detecting that the isolation environment is successfully started, performs information verification processing on the plaintext data source request information to obtain a request information verification result; in response to determining that the request information verification result indicates that the verification has passed, performs input parameter identification on the plaintext data source request information to obtain a data source request interface input parameter set; and obtains request data corresponding to the encrypted data source request information from the data source test application based on the data source request interface input parameter set.

[0128] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0129] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0130] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, they may be described as: a processor comprising a determination unit, a creation unit, a byte code enhancement unit, an isolation environment startup unit, an information verification unit, an input parameter identification unit, and an acquisition unit. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, the determination unit may also be described as "a unit that determines the plaintext request location information of the plaintext data source request information corresponding to the above-mentioned encrypted data source request information in response to detecting the encrypted data source request information of the test interface sent to the data source test application end."

[0131] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0132] The above description is only an illustration of some preferred embodiments of the present disclosure and the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure.

Claims

1. A data acquisition method based on an encryption request, comprising: In response to detecting encrypted data source request information sent to the test interface of the data source test application, determining plaintext request location information of plaintext data source request information corresponding to the encrypted data source request information; Creating a data source request sandbox isolation environment according to the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request information; performing byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain an enhanced plaintext data source request code; According to the enhanced plaintext data source request code, the data source request sandbox isolation environment is started; In response to detecting that the isolation environment is successfully started, performing information verification processing on the plaintext data source request information to obtain a request information verification result; In response to determining that the request information verification result indicates that the verification has passed, performing input parameter identification on the plaintext data source request information to obtain a data source request interface input parameter set; According to the data source request interface input parameter set, request data corresponding to the encrypted data source request information is obtained from the data source test application end.

2. The method according to claim 1, wherein The method further comprises: In response to determining that the request information verification result indicates that the verification has failed, the data request of the encrypted data source request information is terminated.

3. The method according to claim 1, wherein The step of starting an isolated environment for the data source request sandbox isolation environment according to the enhanced plaintext data source request code includes: Perform spy method tracking on the enhanced plaintext data source request code to obtain the plaintext request spy code; Perform cross-cutting declarative loading of the plaintext request spy class code; In response to detecting that the plaintext request spy class code is successfully loaded, establishing code communication between the plaintext request spy class code and the business original code; In response to detecting that the code communication is successful, the data source request sandbox isolation environment is started.

4. The method according to claim 3, wherein: The cross-cutting declarative loading of the plaintext request spy class code includes: Constructing an abstract syntax tree for the plaintext data source request code corresponding to the plaintext data source request information to obtain a test interface call syntax tree; Parsing the test interface call syntax tree to obtain an interface call connectivity graph; Performing a breadth-first search on the interface call connectivity graph to obtain application interface parameter configuration information; Adopting a sandbox class loading parent delegation model, determining the parent request class loader of the plaintext request spy class code according to the application interface parameter configuration information; In response to determining that the parent request class loader is not the target parent request class loader, determining a parent request class loader of the parent request class loader as a parent parent request loader; In response to determining that the parent parent request loader is loading the target parent request class, performing cross-cutting declarative loading on the parent parent request loader to obtain a request loading result; In response to determining that the request loading result indicates that the loading was unsuccessful, cross-cutting declarative loading is performed on the plaintext request spy class code.

5. The method according to claim 1, wherein The performing information verification processing on the plaintext data source request information to obtain the request information verification result includes: Performing code conversion on the data source request code corresponding to the plaintext data source request information to obtain a converted data source request code; Determining a conditional judgment statement code set in the converted data source request code; Performing static code instrumentation processing on each conditional judgment statement code in the conditional judgment statement code set to obtain an instrumented conditional judgment statement code set; Generating a data flow control flow chart for the plaintext data source request information according to the instrumentation condition judgment statement code set; According to the data flow control flow chart, extracting the extraterritorial context of the instrumentation condition judgment statement code set to obtain an extraterritorial context information set, wherein the extraterritorial context information is information that controls the judgment result of the condition judgment statement code set; Determine a conditional judgment statement code set corresponding to the out-of-domain context information set as a target conditional judgment statement code set; Performing control flow dependency analysis on the target condition judgment statement code set to generate a condition judgment range for each target condition judgment statement code in the target condition judgment statement code set, thereby obtaining a condition judgment range set; According to the conditional judgment range set, the data source request code is subjected to intra-domain context extraction to obtain an intra-domain context information set, wherein the intra-domain context information represents the data flow situation within the conditional judgment range; According to the in-domain context information set and the out-of-domain context information set, anomaly detection processing is performed on the plaintext data source request information to obtain an anomaly detection result as a request information verification result.

6. The method according to claim 5, wherein: The performing anomaly detection processing on the plaintext data source request information according to the in-domain context information set and the out-of-domain context information set to obtain an anomaly detection result as the request information verification result includes: Performing feature extraction on the in-domain context information set and the out-of-domain context information set to obtain an in-domain feature information set and an out-of-domain feature information set; Performing feature embedding on the in-domain feature information set and the out-of-domain feature information set to obtain an out-of-domain feature vector set and an in-domain feature vector set; Determine the feature similarity of each out-of-domain feature vector in the out-of-domain feature vector set and each in-domain feature vector in the in-domain feature vector set to obtain a feature similarity group set; Filtering at least one in-domain feature vector and at least one out-domain feature vector whose corresponding feature similarity is greater than or equal to a preset similarity threshold from the in-domain feature vector set and the out-domain feature vector set; Optimize the code anomaly detection model to obtain an optimized code anomaly detection model; The at least one in-domain feature vector and the at least one out-of-domain feature vector are input into the trained optimized code anomaly detection model to obtain an anomaly detection result as a request information verification result.

7. The method according to claim 6, wherein: The code anomaly detection model is optimized to obtain an optimized code anomaly detection model, including: Initializing a parameter set of the code anomaly detection model to obtain an initial parameter set as an initialization ant colony and an initialization ant lion colony, wherein the initial parameter set includes at least one of the following: a penalty factor and a kernel function parameter; Generating a model fitness function for the code anomaly detection model; Based on the initialization of the ant colony and the initialization of the ant lion colony, the following determination steps are performed: Substituting the initialized ant colony and the initialized ant lion colony into the model fitness function to obtain an ant colony fitness function value set and an ant lion fitness function value set; Selecting the ant lion fitness function value with the largest value from the ant lion fitness function value set as the target ant lion fitness function value, and determining the ant lion corresponding to the target ant lion fitness function value as the target ant lion; Determine the initialized ant lion corresponding to each initialized ant in the initialized ant colony, and obtain the associated ant lion group; According to the associated ant lion group and the target ant lion, the position of the initialized ant colony is updated to obtain the updated ant colony; Substituting the updated ant colony into the model fitness function to obtain an updated fitness function value set of the ant colony; Compare each ant colony's updated fitness function value in the ant colony's updated fitness function value set with the ant lion's fitness function value corresponding to the ant colony's updated fitness function value in the ant lion's fitness function value set to obtain a comparison result set; According to the comparison result set, the updated ant colony and the initial ant lion colony are updated to obtain the target updated ant colony and the updated ant lion colony; determining a number of times the determining step has been performed; In response to determining that the number of executions is greater than or equal to a preset execution threshold, determining the target update ant colony and the update ant lion colony as a target parameter set of the code anomaly detection model to obtain an optimized code anomaly detection model; In response to determining that the number of executions is less than the preset execution threshold, the target update ant colony and the update ant lion colony are determined to be the initialization ant colony and the initialization ant lion colony, and the sum of the number of executions and the preset threshold is determined to be the number of executions, so as to perform the determination step again.

8. A data acquisition device based on an encryption request, comprising: a determining unit configured to, in response to detecting encrypted data source request information sent to the test interface of the data source test application, determine plaintext request location information of plaintext data source request information corresponding to the encrypted data source request information; a creating unit configured to create a data source request sandbox isolation environment according to the plaintext request location information, wherein the data source request sandbox isolation environment is a non-invasive embedded environment created for the plaintext data source request information; a byte code enhancement unit configured to perform byte code enhancement processing on the plaintext data source request code corresponding to the plaintext data source request information to obtain an enhanced plaintext data source request code; an isolation environment startup unit, configured to start the isolation environment for the data source request sandbox isolation environment according to the enhanced plaintext data source request code; an information verification unit configured to, in response to detecting that the isolation environment is successfully started, perform information verification processing on the plaintext data source request information to obtain a request information verification result; an input parameter identification unit configured to, in response to determining that the request information verification result indicates that the verification has passed, identify input parameters of the plaintext data source request information to obtain a data source request interface input parameter set; The acquiring unit is configured to acquire request data corresponding to the encrypted data source request information from the data source test application end according to the input parameter set of the data source request interface.

9. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images