Security detection method and system based on network application firewall

Abstract

The invention provides a security detection method and system based on a network application firewall (WAF). The method comprises the following steps: starting security detection processing under a current limiting model; analyzing at least one attribute parameter associated with the security detection in the first user request; aiming at each analyzed attribute parameter, executing the following steps: representing an analysis result of the attribute parameter by using a preset number; different analysis results of the attribute parameters correspond to different numbers; determining a risk probability of the first user request using each number representing a result of analysis of the attribute parameter of the first user request; and when the risk probability is greater than a preset risk probability threshold, performing security detection on the first user request, otherwise, not performing security detection and directly sending the first user request to the Web server. According to the method, security detection analysis is carried out according to the specific values / contents of the digits instead of the attribute parameters, so that computing resources are greatly saved and the efficiency is greatly improved on the premise of ensuring that which user requests need to be subjected to security detection are distinguished.

Description

Technical Field

[0001] One or more embodiments of the present invention relate to network communication technology, and in particular to a security detection method and system based on a network application firewall (WAF). Background Art

[0002] WAF, short for Web Application Firewall, is also known as a web application firewall or web application protection system in Chinese. It is also called a website application-level intrusion prevention system. The primary purpose of a WAF is to protect web applications from various network attacks. A WAF typically exists as a standalone software or hardware device, deployed between web servers and the internet, acting as a firewall.

[0003] Currently, the process of implementing security detection based on WAF includes: when a user request arrives, each user request is scanned and filtered simultaneously using a parallel processing method, each user request is analyzed and verified, invalid or attack-related requests are blocked or isolated, and valid and secure user requests can be forwarded to the Web server for processing.

[0004] To improve WAF detection performance, a non-blocking bypass strategy is currently employed. This strategy first specifies a detection time threshold for individual user requests. If the detection time for a user request exceeds the specified detection time threshold, detection of the user request is abandoned and the request is sent directly to the web server without completing security checks. With the continuous development of network applications, it is likely that a large number of user requests will be received at the same time. When computing resources are limited, the detection time for a large number of user requests will exceed the specified detection time. Consequently, a large number of user requests will be released without completing security checks and sent directly to the web server. This is equivalent to not performing security checks, significantly reducing security. Summary of the Invention

[0005] One or more embodiments of the present invention describe a WAF-based security detection method and system, which can perform security detection and analysis based on various numbers rather than the specific values / contents of various attribute parameters. While ensuring that which user requests require security detection can be distinguished, it greatly saves computing resources and greatly improves efficiency.

[0006] According to a first aspect, a WAF-based security detection method is provided, which predetermines at least one attribute parameter associated with security detection in a user request; the method further includes:

[0007] Start the security detection process under the current limiting model, which includes:

[0008] receiving a first user request;

[0009] Analyzing at least one attribute parameter associated with security detection in the first user request; wherein, analyzing a quantitative feature of the at least one attribute parameter;

[0010] For each attribute parameter analyzed, the following steps are performed: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes a quantitative feature; different analysis results of the attribute parameter correspond to different numbers;

[0011] determining a risk probability of the first user request using the respective numbers representing the analysis results of the attribute parameters of the first user request; and

[0012] When the risk probability is greater than the preset risk probability threshold, a security check is performed on the first user request; when the risk probability is not greater than the preset risk probability threshold, no security check is performed on the first user request, and the first user request is directly forwarded to the Web server.

[0013] The method further comprises:

[0014] Predefine the detection time threshold;

[0015] Determine whether a detection mode switch is currently required based on the detection time threshold. If so, execute the security detection processing under the startup current limiting model. Otherwise, do not execute the security detection processing under the startup current limiting model. Whenever a user request is received, a security check is performed on the user request.

[0016] The determining whether a detection mode switch is currently required based on the detection duration threshold includes:

[0017] Whenever a user request is received, it is determined whether the duration of the security check on the user request exceeds the detection duration threshold; if so, the user request is a timed-out request;

[0018] Count the number of timed-out requests in the first specified time period using a sliding window.

[0019] Determine whether the ratio of the number of timed-out requests in the first time period to the total number of user requests received in the first time period is greater than a preset ratio threshold,

[0020] If it is greater than, it is determined that the detection mode conversion is currently required; if it is not greater than, it is determined that the detection mode conversion is currently not required.

[0021] The at least one attribute parameter associated with security detection in the user request includes at least one of the following:

[0022] Request type, Uniform Resource Identifier (URI), request body HEADER, request parameters, request parameters in COOKIE, UA string, request body BODY.

[0023] The method of using a preset number to represent the analysis result of each attribute parameter analyzed includes at least one of the following:

[0024] When at least one attribute parameter associated with security detection includes a request type, analyzing a value of the request type in the first user request and recording a preset number corresponding to the value of the request type;

[0025] When at least one attribute parameter associated with the security detection includes a URI, analyzing and recording the number of characters in each string in the URI separated by each separator;

[0026] When at least one attribute parameter associated with security detection includes a HEADER header of the request body, analyzing and recording the number of HEADER headers of the request body;

[0027] When at least one attribute parameter associated with the security detection includes a request parameter, analyzing and recording the number of the request parameters;

[0028] When at least one attribute parameter associated with the security detection includes a request parameter in the cookie, analyzing and recording the number of request parameters in the cookie;

[0029] When at least one attribute parameter associated with security detection includes a UA string, analyzing and recording the length value of the client segment UA information in the UA;

[0030] When at least one attribute parameter associated with security detection includes a request body BODY, if the analysis shows that the first user request includes a request body BODY, a preset first number is recorded; if the analysis shows that the first user request does not include a request body BODY, a preset second number is recorded;

[0031] When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, analyzing a format of the request body BODY in the first user request and recording a preset number corresponding to the format of the request body BODY;

[0032] When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, the number of parameters in the request body BODY of the first user request is analyzed and recorded.

[0033] The step of analyzing the value of the request type in the first user request and recording the preset first number corresponding to the value of the request type includes:

[0034] If the request type in the first user request is analyzed to be a GET request for obtaining information, the number 1 is recorded; if the request type in the first user request is analyzed to be a PUT request for updating information, the number 2 is recorded; if the request type in the first user request is analyzed to be an OPTIONS request for a probe, the number 3 is recorded; if the request type in the first user request is analyzed to be a POST request for submitting a form, the number 4 is recorded;

[0035] and / or,

[0036] The step of analyzing the format of the request body BODY in the first user request and recording a preset number corresponding to the format of the request body BODY includes:

[0037] If the format of the request body BODY in the first user request is analyzed to be FORM-DATA, record the number 1; if the format of the request body BODY in the first user request is analyzed to be X-WWW-FORM-URLENCODED, record the number 2; if the format of the request body BODY in the first user request is analyzed to be JSON, record the number 3; if the format of the request body BODY in the first user request is analyzed to be XML, record the number 4; if the format of the request body BODY in the first user request is analyzed to be TEXT, record the number 5; if the format of the request body BODY in the first user request is analyzed to be a format other than the aforementioned formats, record the number 6.

[0038] The method further comprises:

[0039] Forming a log set in each of at least one site, the log set including logs of each user request received by the site within a preset time period;

[0040] For each user request recorded in the log collection, the following steps are performed: analyzing at least one attribute parameter associated with security detection in the user request; using a preset number to represent the analysis result of each attribute parameter analyzed; wherein different analysis results of the attribute parameter correspond to different numbers; concatenating the numbers representing the analysis results of the attribute parameters to represent the user request; and determining whether the user request is an attack request;

[0041] Generate training samples; each training sample includes a sample input and a label, the sample input includes: serial numbers used to represent a user request; the label includes: an identifier used to represent whether the user request is an offensive request; and

[0042] Use each training sample to train the classifier;

[0043] Then, determining the risk probability of the first user request by using the numbers representing the analysis results of the attribute parameters includes:

[0044] concatenating the numbers representing the analysis results of the attribute parameters of the first user request;

[0045] Inputting the concatenated numbers into the trained classifier;

[0046] Obtaining the risk probability of the first user request output by the classifier.

[0047] After receiving the first user request and before analyzing at least one attribute parameter associated with security detection in the first user request, the method further includes:

[0048] Determining whether a source IP address in the first user request is the same as a source IP address previously determined to be an attack request within a predetermined period of time, and if so, continuing to analyze at least one attribute parameter associated with security detection in the first user request;

[0049] or,

[0050] Determine whether the request type of the first user request is OPTIONS, which indicates a probe request. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the current process.

[0051] or,

[0052] Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If so, do not perform security check on the first user request, directly forward the first user request to the web server, and end the current process.

[0053] or,

[0054] Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If both are true, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the current process.

[0055] or,

[0056] Determine whether the number of requested parameters in the first user request is greater than a specified threshold, or whether the number of parameters in the request body BODY is greater than a specified threshold. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the current process.

[0057] According to a second aspect, a security detection system based on a network application firewall (WAF) is provided, the system comprising:

[0058] A startup module is configured to start security detection processing under the current limiting model;

[0059] a receiving module configured to receive a first user request after starting a security detection process under a current limiting model;

[0060] A digital skeleton generation module is configured to analyze at least one attribute parameter associated with security detection in the first user request; wherein the quantitative characteristics of the at least one attribute parameter are analyzed; and for each attribute parameter analyzed, performing the following steps: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes the quantitative characteristics; and different numbers are corresponding to different analysis results of the attribute parameter;

[0061] The security detection processing module is configured to use the various numbers representing the analysis results of the attribute parameters of the first user request to determine the risk probability of the first user request; when the risk probability is greater than a preset risk probability threshold, the first user request is subjected to a security check; when the risk probability is not greater than the preset risk probability threshold, the first user request is not subjected to a security check and the first user request is directly forwarded to the Web server.

[0062] According to a third aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any embodiment of the present invention is implemented.

[0063] It can be seen that the various embodiments of the present invention have at least the following beneficial effects: the embodiments of the present invention propose a new approach to determine which user requests are subject to security checks and which user requests do not need security checks in the current limiting mode. First, the various attribute parameters associated with security checks in the user request are pre-determined, that is, it is determined which attribute parameters need to be analyzed, rather than analyzing all attribute parameters. Second, during the analysis, the quantitative characteristics of these attribute parameters are mainly analyzed, such as whether they exist, how many there are, and their length, rather than the specific values / contents of these attribute parameters. In other words, the analysis results are mainly quantitative characteristics. Third, the analysis results (i.e., quantitative characteristics) are represented in a simple form of numbers. Finally, it is only necessary to perform security check analysis based on the numbers, rather than the specific values / contents of the attribute parameters. Therefore, while ensuring that it is possible to accurately distinguish which user requests need to be security checked, it can greatly save computing resources and greatly improve efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0065] Figure 1 It is a schematic diagram of a system architecture applied in one embodiment of the present invention.

[0066] Figure 2 This is a flowchart of a WAF-based security detection method in one embodiment of the present invention.

[0067] Figure 3 FIG. 4 is a flowchart of a process for detecting mode conversion in one embodiment of the present invention.

[0068] Figure 4 This is a schematic diagram showing an embodiment of the present invention in which numbers are used to represent analysis results of attribute parameters associated with security detection in a user request.

[0069] Figure 5 It is a structural diagram of a WAF-based security detection system in one embodiment of the present invention. DETAILED DESCRIPTION

[0070] The solution provided by the present invention is described below with reference to the accompanying drawings.

[0071] First, it should be noted that the terms used in the embodiments of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. As used in the embodiments of the present invention and the appended claims, the singular forms "a," "the," and "the" are intended to include the plural forms, unless the context clearly indicates otherwise.

[0072] It should be understood that the term "and / or" as used herein is merely a description of the relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A exists alone, A and B exist simultaneously, or B exists alone. Furthermore, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0073] In order to facilitate understanding of the method provided by the present invention, the system architecture involved and applicable to the present invention is first described. Figure 1 As shown in , the system includes users, sites configured with WAF, and web servers.

[0074] See also Figure 1 In the current limiting mode, when a user request arrives, the site equipped with WAF uses a parallel processing method to scan and filter each user request at the same time, analyze and verify each user request, block or isolate invalid or attacking requests, and forward valid and safe user requests to the Web server for processing.

[0075] Figure 2 This is a flowchart of a WAF-based security detection method in one embodiment of the present invention. Figure 1 and Figure 2 , the method comprising:

[0076] Step 201: predetermine at least one attribute parameter associated with security detection in a user request.

[0077] Step 203: Start the security detection process under the current limiting model.

[0078] See also Figure 2 The security detection process under the current limiting model includes the following steps 205 to 211.

[0079] Step 205: receiving a first user request;

[0080] Step 207: Analyze at least one attribute parameter associated with security detection in the first user request; analyze the quantitative characteristics of the at least one attribute parameter; for each attribute parameter analyzed, perform the following steps: use a preset number to represent the analysis result of the attribute parameter; the analysis result includes the quantitative characteristics; different analysis results of the attribute parameter correspond to different numbers;

[0081] Step 209: Determine the risk probability of the first user request using the numbers representing the analysis results of the attribute parameters of the first user request;

[0082] Step 211: When the risk probability is greater than the preset risk probability threshold, a security check is performed on the first user request; when the risk probability is not greater than the preset risk probability threshold, no security check is performed on the first user request, and the first user request is directly forwarded to the Web server.

[0083] In current limiting mode, it is not possible to perform security checks on all incoming user requests. Figure 2 It can be seen from the method shown that, in the embodiment of the present invention, a new idea is proposed to determine which user requests are to be security checked and which user requests do not need to be security checked.

[0084] Under the circumstance of limited computing resources, in the method of the embodiment of the present invention, first, each attribute parameter associated with security detection in the user request is determined in advance, that is, which attribute parameters need to be analyzed, rather than all attribute parameters are analyzed, thereby reducing the occupation of computing resources; secondly, the analysis is mainly based on the quantitative characteristics of these attribute parameters, which can be represented by: the presence or absence of an attribute parameter (for example, the presence of this attribute parameter is represented by the number 1, and the absence of this attribute parameter is represented by the number 0), the number of parameters in an attribute parameter, the number of characters in an attribute parameter, etc., rather than taking up more computing resources to analyze the specific values / contents of these attribute parameters, that is, the analysis result is mainly the quantitative characteristics, thereby further reducing the occupation of computing resources; thirdly, the analysis result (i.e., quantitative characteristics) is represented by a simple form of numbers; finally, security detection analysis only needs to be performed based on each number, rather than based on the specific value / content of each attribute parameter. It can be seen that the method of the embodiment of the present invention can greatly save computing resources and greatly improve efficiency under the premise of ensuring that which user requests need to be security detected can be accurately distinguished.

[0085] In one embodiment of the present invention, the following four processing flows are proposed:

[0086] 1. Detection mode conversion;

[0087] 2. Request mode conversion;

[0088] 3. Classifier construction;

[0089] 4. Construct a filter.

[0090] The first process, "Detection Mode Switching," determines whether to enable the safety detection mode under the rate limiting model. Without the safety detection mode, every incoming user request can be subjected to a safety detection. However, when computing resources are insufficient, the safety detection mode under the rate limiting model must be enabled, requiring only some user requests to be subjected to safety detection.

[0091] For the second processing flow "request mode conversion": the purpose of turning on the current limiting mode is to reduce the consumption of computing resources. If a relatively resource-consuming operation is used when performing security checks on user requests, the result will be more harm than good. Therefore, an embodiment of the present invention proposes a new form of user request conversion, which can use fewer computing resources to perform security checks on user requests after conversion (that is, the analysis results of attribute parameters associated with security checks in user requests expressed in digital form), thereby reducing additional overhead on computing resources. The embodiment of the present invention locates / represents a user request by the quantitative characteristics of the attribute parameters of the user request.

[0092] For the third processing flow "classifier construction": the purpose of this process is to pre-build a classifier, so that when security detection under the current limiting model is subsequently enabled, the pre-built classifier can be used (and based on the analysis results of the attribute parameters associated with security detection in the user request expressed in digital form) to determine whether a user request needs security detection.

[0093] Regarding the fourth processing flow, "Constructing a Filter," this process further reduces computing resource usage when enabling security checks under the rate-limiting model. Site attacks often exhibit biased behavior. For example, requests with the OPTIONS method generally do not represent attack behavior. Pre-built filters can make a preliminary determination of whether a user request requires security checking. If the preliminary determination is that a security check is necessary, the classifier is then used to determine whether the user request requires security checking based on the individual numbers. This reduces the use of the classifier and further reduces computing resource usage.

[0094] The following combination Figure 2 The process shown in FIG. 1 illustrates the four processing processes mentioned above one by one.

[0095] The first step is to perform preprocessing, which includes step 201 and the "classifier construction" process.

[0096] For step 201: predetermine at least one attribute parameter associated with security detection in the user request.

[0097] In one embodiment of the present invention, at least one attribute parameter associated with security detection in a user request may include at least one of the following: request type, Uniform Resource Identifier (URI), request body HEADER header, request parameters, request parameters in COOKIE, UA string (User Agent String), and request body BODY.

[0098] Among them, URI is a string used to identify the name of an Internet resource. This identification allows users to interact with any resource (including local and Internet resources) through a specific protocol. URI is defined by a scheme that includes a certain syntax and related protocols. Every resource available on the Web, such as HTML documents, images, video clips, programs, etc., is located by a URI. The User Agent String (UA string for short) is a key tool that contains detailed information about the client browser, such as the browser name, version, operating system, etc.

[0099] For the "classifier construction" process, the process includes the following steps:

[0100] Step 1: forming a log set at each of at least one site, the log set including logs of user requests received by the site within a preset time period;

[0101] Step 3: For each user request recorded in the log collection, the following steps are performed: analyzing at least one attribute parameter associated with security detection in the user request; analyzing the quantitative characteristics of the at least one attribute parameter; using a preset number to represent the analysis result of each attribute parameter analyzed; the analysis result includes a quantitative characteristic; different analysis results of the attribute parameter correspond to different numbers; concatenating the numbers representing the analysis results of the attribute parameters to represent the user request; and determining whether the user request is an attack request;

[0102] Step 5: Generate training samples. Each training sample includes a sample input and a label. The sample input includes: a series of numbers used to represent a user request; the label includes: an identifier used to represent whether the user request is an offensive request.

[0103] Step 7: Use each training sample to train the classifier.

[0104] The process from step 1 to step 7 above is explained with an example.

[0105] Detection decisions are made through a set of log analysis and decision-making modules located at the edge of the network. In the log analysis module, the logs are first classified and processed according to the different sites. Each site forms a log set R, which contains the request logs of this site within one month. The request body in the log is disassembled, and the request attributes obtained after disassembly are statistically obtained, including the above-mentioned attribute parameters: request source IP, request method, length of request URI, number of parameters in HEADER, length of UA, number of parameters in Cookie, length of each section in URI, etc. The present invention obtains and uses simple data statistics and does not perform statistical analysis on the detailed string content to reduce the consumption of computing resources.

[0106] In the decision module, the data in the log set R is divided into attack requests and normal requests according to historical request results to obtain training samples, and the ADABOOST algorithm is used to learn the obtained training samples.

[0107] Training is performed based on the attribute parameters obtained after the above decomposition. Different attribute parameters are given the same weight at the beginning of training.

[0108] D_1=(w_11…w_1n), w_1i=1 / n, i=1,2,3…n

[0109] By learning the training data set D_1, we can get one of the basic classifiers:

[0110] G_1(x):y→(-1,+1)

[0111] Calculate the error rate of classification using G_1(x) training set:

[0112] e_1=P(G_1(x_i)≠y_i)

[0113] The weights are adjusted based on the obtained value of e_1. Finally, a new set of weights is obtained. Parameters with low correlation now account for a smaller proportion, while parameters with high correlation account for a larger proportion. This final adjustment results in a classifier that predicts the security of user requests for the current site.

[0114] in,

[0115]

[0116] Every G m (x i ) is a weak classifier, α m is the weight of the classifier, and each attribute parameter x is obtained i The optimal classifier representation of .

[0117]

[0118] w(x) represents the comprehensive score after all attribute parameters participate in the classification, N represents the number of attribute parameters used in the operation, β i Indicates the weight of the i-th attribute parameter in the overall operation.

[0119] Finally, the value of w(x) is compared with the threshold. If it is greater than the specified threshold, it will be detected, otherwise it will not be detected.

[0120] Step 2: Execute the "Detection Mode Conversion" process:

[0121] Before step 203, the method further comprises:

[0122] Predefine the detection time threshold;

[0123] According to the detection time threshold, it is determined whether the detection mode conversion is needed at present. If yes, the safety detection processing under the startup current limiting model in step 203 is executed. Figure 2 Otherwise, the security detection processing under the startup current limiting model in step 203 is not performed. Instead, whenever a user request is received, a security detection is performed on the user request, and the process of the present invention is terminated.

[0124] The determination of whether a detection mode switch is required is based on the detection duration threshold, including:

[0125] Whenever a user request is received, it is determined whether the duration of the security check on the user request exceeds the detection duration threshold; if so, the user request is a timed-out request;

[0126] Count the number of timed-out requests in the first specified time period using a sliding window.

[0127] Determine whether the ratio of the number of timed-out requests in the first time period to the total number of user requests received in the first time period is greater than a preset ratio threshold,

[0128] If it is greater than, it is determined that the detection mode conversion is currently required; if it is not greater than, it is determined that the detection mode conversion is currently not required.

[0129] The following example again illustrates the process of detecting mode switching.

[0130] The rule engine needs to perform a large number of regular matching operations, which is a computationally intensive task and consumes a lot of CPU resources. The usage of CPU and memory directly affects the detection efficiency of the rule engine. Therefore, in the embodiment of the present invention, the CPU and memory usage is not counted. Instead, the detection time of each incoming user request is directly counted by the rule engine under the current situation. In the present invention, the time consumed by each user request detection is counted, see Figure 3 , the steps for switching detection modes according to the consumed time are as follows:

[0131] The acceptable request detection time is defined as m. If the detection time exceeds m, it indicates that the request detection has timed out.

[0132] Count the number of timed-out requests in the specified time t_1 using a sliding window;

[0133] If the ratio of the number of timed-out requests to the total number of requests exceeds the specified threshold y, it indicates a high load situation and traffic control is required;

[0134] During traffic control, the control duration is set to t_2. When the control duration is longer than t_2, the current timeout request ratio is counted again based on a sliding duration.

[0135] If the ratio of the previous timeout requests falls below the threshold y, traffic control is canceled, request detection returns to normal, and the next timeout statistics cycle is started.

[0136] The third step is to execute the process of constructing the filter:

[0137] After receiving the first user request in step 203 and before executing step 205, the method further includes:

[0138] Determine whether the source IP address in the first user request is the same as the source IP address of the attack request determined to be the same within the predetermined time period. If so, continue to step 205. Otherwise, directly forward the first user request to the Web server, and end the process of the present invention.

[0139] or,

[0140] Determine whether the request type of the first user request is OPTIONS, which indicates a probe request. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and terminate the process of the present invention. Otherwise, continue to step 205.

[0141] or,

[0142] Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If so, do not perform security check on the first user request and directly forward the first user request to the Web server, terminating the process of the present invention. Otherwise, proceed to step 205.

[0143] or,

[0144] Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If both are true, do not perform security check on the first user request and directly forward the first user request to the Web server, terminating the process of the present invention. Otherwise, proceed to step 205.

[0145] or,

[0146] Determine whether the number of requested parameters in the first user request is greater than a specified threshold, or whether the number of parameters in the request body BODY is greater than a specified threshold. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and terminate the process of the present invention. Otherwise, continue to execute step 205.

[0147] The third step is completed.

[0148] Next, step 205 is executed: a first user request is received.

[0149] The user request in the embodiment of the present invention is an HTTP request.

[0150] Next, step 207 is executed: at least one attribute parameter associated with the security check in the first user request is analyzed; wherein, the quantitative characteristics of at least one attribute parameter are analyzed; for each attribute parameter analyzed, the following is executed: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes the quantitative characteristics; wherein different analysis results of the attribute parameter correspond to different numbers.

[0151] In embodiments of the present invention, quantitative features can represent: the presence or absence of an attribute parameter (for example, the presence of this attribute parameter is represented by the number 1, and the absence of this attribute parameter is represented by the number 0), the number of parameters in an attribute parameter, the number of characters in an attribute parameter, etc. Embodiments of the present invention primarily analyze the quantitative features of these attribute parameters, rather than consuming more computing resources to analyze the specific values / contents of these attribute parameters. In other words, the analysis results are primarily quantitative features, thereby further reducing the use of computing resources.

[0152] The processing flow of the request mode conversion is as follows: In one embodiment of the present invention, in step 207, for each attribute parameter analyzed, a preset number is used to represent the analysis result of the attribute parameter, including at least one of the following:

[0153] When at least one attribute parameter associated with security detection includes a request type, analyzing a value of the request type in the first user request and recording a preset number corresponding to the value of the request type;

[0154] When at least one attribute parameter associated with the security detection includes a URI, analyzing and recording the number of characters in each string in the URI separated by each separator;

[0155] When at least one attribute parameter associated with security detection includes a HEADER header of the request body, analyzing and recording the number of HEADER headers of the request body;

[0156] When at least one attribute parameter associated with the security detection includes a request parameter, analyzing and recording the number of the request parameters;

[0157] When at least one attribute parameter associated with the security detection includes a request parameter in the cookie, analyzing and recording the number of request parameters in the cookie;

[0158] When at least one attribute parameter associated with security detection includes a UA string, analyzing and recording the length value of the client segment UA information in the UA;

[0159] When at least one attribute parameter associated with security detection includes a request body BODY, if the analysis shows that the first user request includes a request body BODY, a preset first number is recorded; if the analysis shows that the first user request does not include a request body BODY, a preset second number is recorded;

[0160] When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, analyzing a format of the request body BODY in the first user request and recording a preset number corresponding to the format of the request body BODY;

[0161] When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, the number of parameters in the request body BODY of the first user request is analyzed and recorded.

[0162] In one embodiment of the present invention, analyzing the value of the request type in the first user request and recording a preset first number corresponding to the value of the request type include: if it is analyzed that the request type in the first user request is a request GET for obtaining information, then recording the number 1; if it is analyzed that the request type in the first user request is a request PUT for updating information, then recording the number 2; if it is analyzed that the request type in the first user request is a request OPTIONS for a probe, then recording the number 3; if it is analyzed that the request type in the first user request is a request POST for submitting a form, then recording the number 4.

[0163] In one embodiment of the present invention, the format of the request body BODY in the first user request is analyzed and a preset number corresponding to the format of the request body BODY is recorded, including: if the format of the request body BODY in the first user request is analyzed to be FORM-DATA, the number 1 is recorded; if the format of the request body BODY in the first user request is analyzed to be X-WWW-FORM-URLENCODED, the number 2 is recorded; if the format of the request body BODY in the first user request is analyzed to be JSON, the number 3 is recorded; if the format of the request body BODY in the first user request is analyzed to be XML, the number 4 is recorded; if the format of the request body BODY in the first user request is analyzed to be TEXT, the number 5 is recorded; if the format of the request body BODY in the first user request is analyzed to be a format other than the aforementioned formats, the number 6 is recorded.

[0164] For example, see Figure 4 In the embodiment of the present invention, the expression method of user request is defined as follows:

[0165] The first digit: request type / request method, 1 for GET, 2 for PUT, 3 for OPTIONS, 4 for POST;

[0166] The second digit: indicates the number of characters in the URI separated by " / ";

[0167] The third bit: the number of HEADER headers in the request body;

[0168] Fourth: the number of request parameters, such as Figure 4 The parameter following the "?" symbol;

[0169] Fifth: the number of request parameters in the cookie, such as Figure 4 The number of parameters separated by semicolons;

[0170] The sixth bit: the length of the UA information in the client segment of the UA;

[0171] The seventh bit: whether there is a BODY body. If there is a BODY body, this bit is represented by 1, and if there is no BODY body, it is represented by 0;

[0172] The eighth digit: BODY format. If the BODY format is FORM-DATA, the digit is 1; if the BODY format is X-WWW-FORM-URLENCODED, the digit is 2; if the BODY format is JSON, the digit is 4; if the BODY format is XML, the digit is 5; if the BODY format is TEXT, the digit is 6; other types are represented by 7.

[0173] Ninth digit: the number of parameters in the BODY body, for example Figure 4 The number of "example" in .

[0174] According to the above definitions from the first to the ninth position, the processing method of step 207 is used. Figure 4 The HTTP request / user request shown can be expressed as Figure 4 ”4-424-4-1-1-14-1-4-2” shown in .

[0175] Next, step 209 is performed: using the numbers representing the analysis results of the attribute parameters of the first user request to determine the risk probability of the first user request.

[0176] The process of this step 209 includes:

[0177] concatenating the numbers representing the analysis results of the attribute parameters of the first user request;

[0178] Inputting the concatenated numbers into the trained classifier;

[0179] Obtaining the risk probability of the first user request output by the classifier.

[0180] Next, step 211 is executed: when the risk probability is greater than the preset risk probability threshold, a security check is performed on the first user request; when the risk probability is not greater than the preset risk probability threshold, no security check is performed on the first user request, and the first user request is directly forwarded to the Web server.

[0181] One embodiment of the present invention further provides a WAF-based security detection system, which includes:

[0182] A startup module 501 is configured to start a safety detection process under a current limiting model;

[0183] The receiving module 502 is configured to receive a first user request after starting the security detection process under the current limiting model;

[0184] The digital skeleton generation module 503 is configured to analyze at least one attribute parameter associated with security detection in the first user request; wherein the quantitative characteristics of the at least one attribute parameter are analyzed; and for each attribute parameter analyzed, the following steps are performed: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes the quantitative characteristics; and different numbers are corresponding to different analysis results of the attribute parameter;

[0185] The security detection processing module 504 is configured to use the various numbers representing the analysis results of the attribute parameters of the first user request to determine the risk probability of the first user request; when the risk probability is greater than the preset risk probability threshold, the first user request is subjected to a security check; when the risk probability is not greater than the preset risk probability threshold, the first user request is not subjected to a security check, and the first user request is directly forwarded to the Web server.

[0186] An embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed in a computer, the computer is caused to execute the method in any one of the embodiments in the specification.

[0187] An embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method in any embodiment of the specification is implemented.

[0188] It should be understood that the structures illustrated in the embodiments of the present invention do not constitute specific limitations on the apparatus of the embodiments of the present invention. In other embodiments of the present invention, the apparatus may include more or fewer components than shown, or may combine or separate certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0189] The various embodiments of the present invention are described in a progressive manner. Similar portions between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the device embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0190] Those skilled in the art will appreciate that in one or more of the above examples, the functions described in the present invention may be implemented using hardware, software, widgets, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0191] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A security detection method based on a network application firewall (WAF), characterized in that: Predetermining at least one attribute parameter associated with security detection in a user request; The method further includes: Start the security detection process under the current limiting model, which includes: receiving a first user request; Analyzing at least one attribute parameter associated with security detection in the first user request; wherein, analyzing a quantitative feature of the at least one attribute parameter; For each attribute parameter analyzed, the following steps are performed: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes a quantitative feature; different analysis results of the attribute parameter correspond to different numbers; determining a risk probability of the first user request using the respective numbers representing the analysis results of the attribute parameters of the first user request; and When the risk probability is greater than the preset risk probability threshold, a security check is performed on the first user request; when the risk probability is not greater than the preset risk probability threshold, no security check is performed on the first user request, and the first user request is directly forwarded to the Web server.

2. The method according to claim 1, characterized in that The method further comprises: Predefine the detection time threshold; Determine whether a detection mode switch is currently required based on the detection time threshold. If so, execute the security detection processing under the startup current limiting model. Otherwise, do not execute the security detection processing under the startup current limiting model. Whenever a user request is received, a security check is performed on the user request.

3. The method according to claim 2, characterized in that The determining whether a detection mode switch is currently required based on the detection duration threshold includes: Whenever a user request is received, it is determined whether the duration of the security check on the user request exceeds the detection duration threshold; if so, the user request is a timed-out request; Count the number of timed-out requests in the first specified time period using a sliding window. Determine whether the ratio of the number of timed-out requests in the first time period to the total number of user requests received in the first time period is greater than a preset ratio threshold, If it is greater than, it is determined that the detection mode conversion is currently required; if it is not greater than, it is determined that the detection mode conversion is currently not required.

4. The method according to claim 1, wherein The at least one attribute parameter associated with security detection in the user request includes at least one of the following: Request type, Uniform Resource Identifier (URI), request body HEADER, request parameters, request parameters in COOKIE, UA string, request body BODY.

5. The method according to claim 4, characterized in that The method of using a preset number to represent the analysis result of each attribute parameter analyzed includes at least one of the following: When at least one attribute parameter associated with security detection includes a request type, analyzing a value of the request type in the first user request and recording a preset number corresponding to the value of the request type; When at least one attribute parameter associated with the security detection includes a URI, analyzing and recording the number of characters in each string in the URI separated by each separator; When at least one attribute parameter associated with security detection includes a HEADER header of the request body, analyzing and recording the number of HEADER headers of the request body; When at least one attribute parameter associated with the security detection includes a request parameter, analyzing and recording the number of the request parameters; When at least one attribute parameter associated with the security detection includes a request parameter in the cookie, analyzing and recording the number of request parameters in the cookie; When at least one attribute parameter associated with security detection includes a UA string, analyzing and recording the length value of the client segment UA information in the UA; When at least one attribute parameter associated with security detection includes a request body BODY, if the analysis shows that the first user request includes a request body BODY, a preset first number is recorded; if the analysis shows that the first user request does not include a request body BODY, a preset second number is recorded; When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, analyzing a format of the request body BODY in the first user request and recording a preset number corresponding to the format of the request body BODY; When at least one attribute parameter associated with security detection includes a request body BODY, and the first user request includes a request body BODY, the number of parameters in the request body BODY of the first user request is analyzed and recorded.

6. The method according to claim 5, characterized in that The step of analyzing the value of the request type in the first user request and recording the preset first number corresponding to the value of the request type includes: If the request type in the first user request is analyzed to be a GET request for obtaining information, the number 1 is recorded; if the request type in the first user request is analyzed to be a PUT request for updating information, the number 2 is recorded; if the request type in the first user request is analyzed to be an OPTIONS request for a probe, the number 3 is recorded; if the request type in the first user request is analyzed to be a POST request for submitting a form, the number 4 is recorded; and / or, The step of analyzing the format of the request body BODY in the first user request and recording a preset number corresponding to the format of the request body BODY includes: If the format of the request body BODY in the first user request is analyzed to be FORM-DATA, record the number 1; if the format of the request body BODY in the first user request is analyzed to be X-WWW-FORM-URLENCODED, record the number 2; if the format of the request body BODY in the first user request is analyzed to be JSON, record the number 3; if the format of the request body BODY in the first user request is analyzed to be XML, record the number 4; if the format of the request body BODY in the first user request is analyzed to be TEXT, record the number 5; if the format of the request body BODY in the first user request is analyzed to be a format other than the aforementioned formats, record the number 6.

7. The method according to claim 1, characterized in that The method further comprises: Forming a log set in each of at least one site, the log set including logs of each user request received by the site within a preset time period; For each user request recorded in the log collection, the following steps are performed: analyzing at least one attribute parameter associated with security detection in the user request; using a preset number to represent the analysis result of each attribute parameter analyzed; wherein different analysis results of the attribute parameter correspond to different numbers; concatenating the numbers representing the analysis results of the attribute parameters to represent the user request; and determining whether the user request is an attack request; Generate training samples; each training sample includes a sample input and a label, the sample input includes: serial numbers used to represent a user request; the label includes: an identifier used to represent whether the user request is an offensive request; and Use each training sample to train the classifier; Then, determining the risk probability of the first user request by using the numbers representing the analysis results of the attribute parameters includes: concatenating the numbers representing the analysis results of the attribute parameters of the first user request; Inputting the concatenated numbers into the trained classifier; Obtaining the risk probability of the first user request output by the classifier.

8. The method according to claim 1, characterized in that After receiving the first user request and before analyzing at least one attribute parameter associated with security detection in the first user request, the method further includes: Determine whether the source IP address in the first user request is the same as the source IP address of an attack request determined to be the same within a predetermined period of time; if so, continue to analyze at least one attribute parameter associated with security detection in the first user request; otherwise, terminate the process; or, Determine whether the request type of the first user request is OPTIONS, a request representing a probe; if so, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the process; otherwise, continue to analyze at least one attribute parameter associated with security check in the first user request; or, Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the process. or, Determine whether the request type of the first user request is a GET request for obtaining information and whether the first user request does not contain any request parameters. If both are true, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the process. or, Determine whether the number of requested parameters in the first user request is greater than a specified threshold, or whether the number of parameters in the request body BODY is greater than a specified threshold. If so, do not perform security check on the first user request, directly forward the first user request to the Web server, and end the process.

9. The security detection system based on the network application firewall WAF is characterized by: The system includes: A startup module is configured to start security detection processing under the current limiting model; a receiving module configured to receive a first user request after starting a security detection process under a current limiting model; A digital skeleton generation module is configured to analyze at least one attribute parameter associated with security detection in the first user request; wherein the quantitative characteristics of the at least one attribute parameter are analyzed; and for each attribute parameter analyzed, performing the following steps: using a preset number to represent the analysis result of the attribute parameter; wherein the analysis result includes the quantitative characteristics; and different numbers are corresponding to different analysis results of the attribute parameter; The security detection processing module is configured to use the various numbers representing the analysis results of the attribute parameters of the first user request to determine the risk probability of the first user request; when the risk probability is greater than a preset risk probability threshold, the first user request is subjected to a security check; when the risk probability is not greater than the preset risk probability threshold, the first user request is not subjected to a security check and the first user request is directly forwarded to the Web server.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 8 is implemented.

Images