Safety detection method and device for HTTP (Hyper Text Transport Protocol) request

Abstract

The invention discloses a security detection method and device for an HTTP (Hyper Text Transport Protocol) request, and relates to the technical field of network security. The method comprises the following steps: acquiring a current data segment of an HTTP request body; if the attack feature historical detection record of the request body exists, loading a historical detection state; scanning a current data fragment by using a pre-compiled regular feature library based on a historical detection state, if the current data fragment is completely matched with an attack feature, setting a regular matching mark to be true, otherwise, setting the regular matching mark to be false; when the security rule is not hit and the regular matching is true, HTTP request header condition verification is executed, and if the verification is passed, the hit state of the security rule is updated to be hit; if the regular matching is false, directly skipping request header verification and keeping an original hit state; and if the security rule hit state is hit, executing an interception operation. According to the method, the defects of length limitation and cross-block leak detection of traditional block type detection are overcome, HTTP request delay is avoided, the memory occupancy rate is reduced, and system resources are saved.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, in particular to a kind of HTTP request security detection method and device. BACKGROUND

[0002] Web application firewall (WAF) is mainly for the security protection of web application, such as detecting HTTP request traffic, so as to prevent web application from being attacked maliciously and reduce security risks. At present, the detection method of HTTP request body in WAF system is mostly block detection, that is, before detecting the HTTP request body, the HTTP request body is forced to be cut into fixed-length data blocks (such as 1MB / block), only the first or first N data blocks are scanned, and the subsequent content is ignored.

[0003] The block detection technology has the following defects: (1) When facing cross-block attack load and large file upload scene, the attack load will be cut into multiple data blocks and cannot form complete attack characteristics, resulting in missed detection; (2) The detection cannot be started until the entire data block is received, which increases the HTTP request delay and affects the business experience; (3) For large files, the complete data must be loaded into the memory, which may cause memory exhaustion risk and reduce system stability. SUMMARY

[0004] In view of the above defects or deficiencies in the prior art, the present application provides a kind of HTTP request security detection method and device, which can solve the above technical problems mentioned in the background art.

[0005] In one aspect of the present application, a kind of HTTP request security detection method is provided, comprising the following steps: Data receiving step: receiving and analyzing the current data segment of HTTP request body; History detection state acquisition step: if the HTTP request body has a history detection record of attack characteristics, load the history detection state of attack characteristics of the HTTP request body through data stack; Stream regular matching step: according to the history detection state, the history matching progress, history matching state and starting position of this time matching of attack characteristics are obtained, and the precompiled regular expression feature library is used to match the attack characteristics to be matched in the current data segment in multiple attack modes, if there is a completely matched attack characteristic, the request body regular matching mark variable value in the loaded history detection state is set to true, otherwise the request body regular matching mark variable value is set to false; The security rule matching step comprises the following steps: reading the value of the marked variable of the security rule hit state, if the value of the marked variable of the security rule hit state is not hit, then reading the value of the marked variable of the request body regular matching, if the value of the marked variable of the request body regular matching is true, then performing the HTTP request header condition verification, if the HTTP request header condition verification is passed, then updating the value of the marked variable of the security rule hit state to be hit, if the value of the marked variable of the request body regular matching is false, then not performing the HTTP request header condition verification, and not updating the value of the marked variable of the security rule hit state. The security decision execution step comprises the following steps: if the value of the marked variable of the security rule hit state is hit, then performing the interception operation.

[0006] Another aspect of the present application further provides a security detection device for HTTP request, comprising: The stream data receiving module is configured to receive and parse the current data segment of the HTTP request body. The historical detection state obtaining module is configured to, if the HTTP request body has a historical detection record of attack features, load the historical detection state of the attack features of the HTTP request body through a data stack. The stream regular matching module is configured to, according to the historical matching progress, the historical matching state and the starting position of the current matching of the attack features of the historical detection state, perform the matching of multiple attack modes on the attack features to be matched in the current data segment by using a precompiled regular expression feature library, if there is a completely matched attack feature, then set the value of the marked variable of the request body regular matching in the loaded historical detection state to be true, otherwise, set the value of the marked variable of the request body regular matching to be false. The security rule matching module is configured to read the value of the marked variable of the security rule hit state, if the value of the marked variable of the security rule hit state is not hit, then read the value of the marked variable of the request body regular matching, if the value of the marked variable of the request body regular matching is true, then perform the HTTP request header condition verification, if the HTTP request header condition verification is passed, then update the value of the marked variable of the security rule hit state to be hit, if the value of the marked variable of the request body regular matching is false, then not perform the HTTP request header condition verification, and not update the value of the marked variable of the security rule hit state. The security decision execution module is configured to, if the value of the marked variable of the security rule hit state is hit, then perform the interception operation.

[0007] The present application provides a security detection method and device for HTTP request, which has the following beneficial effects: (1) The application adopts flow segmentation technology, receives and detects multiple data segments of the HTTP request body, temporarily stores the detection state information of the current data segment by using a data stack, so that the CPU has time to process other tasks in the detection task suspension stage, and can quickly reload the detection state in the data stack when the subsequent data segment is received, so that the HTTP request body can continue subsequent matching under the previous feature matching progress. The pipeline architecture of receiving and detecting is constructed, which breaks through the length limitation and cross-block missed detection defects of the traditional block detection, and also avoids the delay of the HTTP request.

[0008] (2) After the current data segment of the HTTP request body is detected, the storage space of the current data segment is released, and only the detection state information of the data segment is temporarily stored. Since the detection state information is mostly a state pointer, it does not need to occupy too much storage space, so the memory occupation rate is greatly reduced, and the system stability is improved.

[0009] (3) The application prepositions the matching detection of the HTTP request body. If the HTTP request body has a matching attack feature, the matching detection of the HTTP request header is performed again. If the HTTP request body does not match the attack feature, the detection of the HTTP request header is not performed. In this way, not only is the detection of the subsequent data segments of the HTTP request body avoided due to the early detection of the HTTP request header and the non-matching attack feature of the request header, thereby causing the missed detection of the attack feature, but also the invalid detection times of the HTTP request header are greatly reduced, and the system resources are saved. BRIEF DESCRIPTION OF DRAWINGS

[0010] Other features, objects and advantages of the application will become more apparent with the following detailed description of non-limiting embodiments made with reference to the accompanying drawings: Figure 1 is a flow diagram of a security detection method of an HTTP request provided by an embodiment of the application; Figure 2 is a structural diagram of a security detection device of an HTTP request provided by an embodiment of the application; Figure 3 is a structural diagram of an electronic device provided by an embodiment of the application. DETAILED DESCRIPTION

[0011] To make the purposes, technical solutions and advantages of the embodiments of the application more clear, the technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are some of the embodiments of the application, but not all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0012] The terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in the description of the application and the appended claims, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0013] Referring to Figure 1 In one embodiment of the present application, a security detection method for HTTP request is provided, comprising the following steps: Data receiving step S101 receiving and parsing the current data segment of the HTTP request body.

[0014] The embodiment does not use the traditional HTTP request body block detection technology, but divides the HTTP request body into several continuous data segments, which are then sent to the WAF in sequence. The WAF system receives and parses each data segment in sequence and performs security detection. This process is referred to as streaming detection in the present application.

[0015] Specifically, when the HTTP request reaches the WAF system, a detection instance corresponding to the HTTP request is created, the data in the request header (header) and the current data segment of the request body (body) in the HTTP request is parsed, the fields and values that need to be matched are extracted, and a matching expression is constructed according to the extracted fields and values for subsequent regular matching operations.

[0016] Further, since the HTTP request body is divided into multiple data segments for streaming transmission, before parsing the current data segment, the integrity of the HTTP request body (or HTTP request) is preferably detected, and a request integrity mapping variable is set, so that the subsequent security rule detection step can make logical judgments according to the request integrity mapping variable.

[0017] Further, if the length of the HTTP request body is very long, there will be many data segments, which will greatly increase the detection time consumption, so it is necessary to limit the use of system resources by a single HTTP request from the detection time consumption dimension. Since the complete HTTP request body security detection in the traditional technology is changed to security detection of each data segment in sequence in the present application, before parsing the HTTP request, it is better to first verify the time consumption of all the detected data segments. If the total detection time consumption up to the current exceeds the time threshold, a timeout control (such as exiting the detection of the current data segment) is performed according to the timeout strategy, so as to reduce the occupation of system resources.

[0018] For example, the security detection time increment of each data segment of the HTTP request body is recorded, the time increments are accumulated to obtain the current overall security detection time of the HTTP request body, and if the overall security detection time of the HTTP request body is greater than or equal to a preset time threshold, the current security detection is stopped, and a release operation is performed.

[0019] Optionally, the timeout processing step can also be logically located in the security decision execution step, and the embodiment does not make a unique limitation in this regard.

[0020] Stream regular matching step S102 If the HTTP request body has a historical detection record of an attack feature, the historical detection state of the attack feature of the HTTP request body is loaded through a data stack.

[0021] Specifically, the security detection process of the HTTP request body of the application is: data receiving-data parsing-detection execution-result generation. When the detection execution link does not produce a terminal state, it is necessary to return to the data receiving link again to wait for the arrival of subsequent data segments. Because the data receiving link and the detection execution link occur in different components, and when the security detection is executed, it is uncertain when the subsequent data segments will arrive. At this time, if the traditional way of continuous cyclic waiting is adopted until the data segments arrive or the timeout is exited, the CPU computing resources will be continuously and invalidly occupied, resulting in a sharp decline in system performance. Therefore, the technical means adopted by the application is to suspend the entire security detection process of the HTTP request, release the CPU to process other detection requests, and then wake up the process to continue execution when the subsequent HTTP request body data segments of the HTTP request arrive. In order to achieve this purpose, the application temporarily stores the current detection state information in a data stack (a kind of data cache space) when the current data segment does not match the attack feature. In this way, when the subsequent data segments are detected, the data stack is reloaded to wake up the process, and then the process can continue to match and detect the attack feature from the last matching end position according to the historical detection state.

[0022] Further, the historical detection state includes but is not limited to: historical matching feature information, historical matching state, historical matching progress, starting position of next matching, request body regular matching flag variable, etc.

[0023] Stream regular matching step S103 According to the historical detection state, the historical matching progress, the historical matching state, and the starting position of the current matching are obtained, a precompiled regular expression feature library is used to match the attack features to be matched in the current data segment in multiple attack modes, if there is a completely matched attack feature, the request body regular matching flag variable value in the loaded historical detection state is set to true, otherwise the request body regular matching flag variable value is set to false.

[0024] Specifically, by waking up the security detection process, the data in the loaded data stack is read, and the historical detection state of the HTTP request body can be obtained. From the historical detection state, it can be known that the previous data segment has matched the attack characteristics to what extent during regular matching, and from where the subsequent matching should continue. According to the historical detection state, the pre-compiled regular expression feature library is used to match the attack characteristics in the current data segment. The pre-compiled regular expression feature library contains regular expressions of various types of attack characteristics known in advance, and the parsed data in the current data segment can be matched with various attack characteristics through the pre-compiled regular expression feature library. If there is a complete matching attack characteristic, the request body regular matching flag variable value in the loaded historical detection state is set to 1 (1 represents true), otherwise the request body regular matching flag variable value is set to 0 (0 represents false), that is, no complete attack characteristic is matched.

[0025] For example: The attack characteristics to be matched are abc, but a is divided into the previous data segment, and bc is divided into the next data segment. The data stack saves the historical detection state, which records the feature matching progress (such as the number of bytes or characters that have been matched), feature information (such as which attack characteristics), and matching state (such as complete match, partial match, and complete non-match) and other information. Suppose the previous data segment has matched a in the attack characteristics abc, and the next data segment is to be detected, the data stack is reloaded, and the progress of the last feature matching is "a is matched" from the data stack. Then the current data segment starts to match from b and continues until bc is matched. At this time, it can be concluded that "the request body contains data that completely matches the attack characteristics abc, so the request body contains suspected attack malicious data", and the request header is further detected.

[0026] Security rule matching step S104: The value of the flag variable of the security rule hit state is read, and if the value of the flag variable of the security rule hit state is not hit, the value of the request body regular matching flag variable is read, and if the value of the request body regular matching flag variable is true, the HTTP request header condition verification is performed, and if the HTTP request header condition verification is passed, the value of the flag variable of the security rule hit state is updated to hit. If the value of the request body regular matching flag variable is false, the HTTP request header condition verification is not performed, and the value of the flag variable of the security rule hit state is not updated.

[0027] Specifically, when detecting the HTTP request, the conventional technology usually detects the HTTP request header first, and then detects the HTTP request body, and the matching rule of each attack feature is matched only once, if the HTTP request header is not matched, the HTTP request body is not matched (that is, the request header and the request body are matched at the same time, which is safe matching, and if either of the request header and the request body is not matched, the latter does not need to be detected). The reason why the conventional technology detects the HTTP request header first is that the reception and detection of the HTTP request body take a long time, while the detection of the HTTP request header takes a short time, so the HTTP request header is detected first to give sufficient buffer time for the reception and detection of the HTTP request body. However, the present application sequentially detects each data segment of the HTTP request body in a streaming manner, and the matching rule of each attack feature is repeatedly executed several times (in the case of no timeout, the data segment is repeated several times). Since the HTTP request header is repeatedly detected each time the data segment of the HTTP request body is detected, if the HTTP request header is detected first and is not matched with the attack feature, the default logic does not execute the detection of the subsequent data segment, at this time, if the attack feature exists in the data segment, the attack feature is missed.

[0028] In order to solve the above technical problems, the present application detects the HTTP request body first, that is, the data segment of the HTTP request body is detected first, if the data segment is matched with the attack feature, the detection of the HTTP request header is executed, if the current data segment of the HTTP request body is not matched with the attack feature, the detection of the HTTP request header is not executed in this round. Through the matching logic of the present application, not only the detection of the subsequent data segment is avoided due to the detection of the HTTP request header not matched with the attack feature, thereby causing the attack feature to be missed, but also the detection times of the HTTP request header are greatly reduced, the system resources are significantly saved, and the system performance is improved.

[0029] In order to realize the above assumption, the present application designs a safety rule matching method which meets the above matching logic. The safety rule matching method uses a "safety rule hit state marking variable value" to represent whether the above matching logic is completely met. If met, the marking variable value is set to 1, indicating that the attack feature exists in the HTTP request, which is detected according to the above matching logic, at this time, the corresponding operation (such as interception, release, etc.) can be executed according to the safety decision. If not met, the marking variable value is set to 0, indicating that the attack feature does not exist in the HTTP request according to the above matching logic until the current data segment, if the data segment has not been received (whether the end flag of the HTTP request body is received can be determined), the current detection state needs to be temporarily stored through the data stack, and the storage space of the current data segment is released, and the subsequent detection is continued.

[0030] Further, the initial value of the marking variable of the security rule hit state can be set to 0, and 0 indicates that the matching logic of the security rule is not hit. At this time, it is necessary to determine whether the detection result of the current HTTP request header and request body is sufficient to make the value of the marking variable of the security rule hit state become 1, and 1 indicates that the matching logic of the security rule is hit.

[0031] Specifically, the request body regular matching marking variable value is read, and if the request body regular matching marking variable value is 1 (1 indicates true, that is, there is a matching attack feature in the request body), then the HTTP request header condition verification (for example, http.host == 'www.test.com') is performed, and if the HTTP request header condition verification is passed, that is, there is a matching attack feature in the request header, the value of the marking variable of the security rule hit state is updated from 0 to 1, which indicates that after the security detection of the data segment of the HTTP request body and the HTTP request header in this round, it is found that there is a matching attack feature in the HTTP request, and the result is obtained in strict accordance with the order of "first matching detection of the HTTP request body, and then matching detection of the HTTP request header".

[0032] Suppose that the read request body regular matching marking variable value is 0 (0 indicates false, that is, there is no matching attack feature in the current data segment of the request body), and since the attack feature is not matched in the HTTP request body at this time, the HTTP request header does not need to be detected (the attack feature is matched in the request header and the request body, which indicates that the HTTP request has an attack feature). However, this does not mean that the HTTP request body does not contain a matching attack feature, because there may be a data segment with an attack feature later, and the HTTP request body may not have been detected at this time. Therefore, the system determines whether the HTTP request body is received completely by judging whether the end flag of the HTTP request body is received, and if not, the current detection state of the HTTP request body is temporarily stored in the data stack as a new historical detection state for detecting the subsequent data segment of the HTTP request body, and the storage space of the current data segment of the HTTP request body is released.

[0033] In summary, since the storage space of each data segment is released after the matching detection is completed in this step, and the temporary storage state is mostly a state pointer, which does not require excessive storage space, the memory occupancy rate of the request body stream segment detection method composed of the "current data segment detection - detection state temporary storage - storage space release - subsequent data segment loading data stack" of the application is greatly reduced, and the system stability is steadily improved. In addition, the security rule matching logic of "first matching detection of HTTP request body, and then matching detection of HTTP request header" makes the system not miss the detection of attack features, and greatly reduces the repeated detection times of the HTTP request header.

[0034] Security decision execution step S105 If the value of the mark variable of the security rule hit state is hit, an interception operation is performed.

[0035] Specifically, if the value of the mark variable of the security rule hit state is 1 (1 represents that the security rule is hit), it indicates that the attack feature in the current HTTP request has been detected according to the security rule matching logic of "first matching detection of HTTP request body, and then matching detection of HTTP request header", and at this time, even if there is an attack feature in the subsequent data segment, it is not necessary to detect again, because as long as one attack feature is detected, the system needs to intercept the HTTP request. Therefore, when the value of the mark variable of the security rule hit state is hit, the system directly performs the interception operation.

[0036] Further, if the value of the mark variable of the security rule hit state is not hit, and the HTTP request body is received completely, it indicates that there is no attack feature in the HTTP request, and at this time, the system directly performs the pass operation.

[0037] Still further, if the value of the mark variable of the security rule hit state is not hit, and the security policy with a higher priority than the security rule detection is effective, the system directly skips the subsequent security rule detection step and directly executes the security policy with a higher priority. For example, although the current HTTP request does not hit the matching attack feature, its IP address falls into the IP blacklist, which is a security policy with a higher priority, so the system will not continue to detect the attack feature in the HTTP request, but directly intercepts the HTTP request according to the IP address in the blacklist.

[0038] Referring to Figure 2Another embodiment of the present application also provides a HTTP request security detection device 200, comprising: a streaming data receiving module 201, a history detection state obtaining module 202, a streaming regular matching module 203, a security rule matching module 204 and a security decision executing module 205. The HTTP request security detection device 200 can execute the HTTP request security detection method in the method embodiment.

[0039] Specifically, the HTTP request security detection device 200 comprises: The streaming data receiving module 201 is configured to receive and parse a current data segment of a HTTP request body. The history detection state obtaining module 202 is configured to, if there is a history detection record of attack features of the HTTP request body, load a history detection state of attack features of the HTTP request body through a data stack. The streaming regular matching module 203 is configured to, according to the history detection state, obtain a history matching progress, a history matching state and a starting position of this time matching of attack features, match attack features in the current data segment with a pre-compiled regular expression feature library in multiple attack modes, if there is a completely matched attack feature, set a request body regular matching flag variable value in the loaded history detection state to true, otherwise set the request body regular matching flag variable value to false. The security rule matching module 204 is configured to read a flag variable value of a security rule hit state, if the flag variable value of the security rule hit state is not hit, read the request body regular matching flag variable value, if the request body regular matching flag variable value is true, execute an HTTP request header condition verification, if the HTTP request header condition verification is passed, update the flag variable value of the security rule hit state to hit, if the request body regular matching flag variable value is false, do not execute the HTTP request header condition verification, and do not update the flag variable value of the security rule hit state. The security decision executing module 205 is configured to, if the flag variable value of the security rule hit state is hit, execute an interception operation.

[0040] It should be noted that the HTTP request security detection device 200 provided in the embodiment corresponds to the technical solution which can be used to execute the method embodiments, and the implementation principle and technical effects thereof are similar to those of the method, which will not be described here.

[0041] Figure 3This is a schematic diagram of the structure of an electronic device 300 provided in another embodiment of the present invention, which is used to implement the HTTP request security detection method in the method embodiment. The electronic device 300 in this embodiment of the present invention may include but is not limited to a smartphone, tablet computer, PC, laptop computer, WAF server, etc. Figure 3 The electronic device 300 shown is merely an example and should not limit the functions and scope of use of the embodiments of the present invention.

[0042] like Figure 3 As shown, electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments of the present invention according to programs stored in read-only memory (ROM) 302 or programs loaded from storage device 308 into random access memory (RAM) 303. RAM 303 also stores various programs and data required for the operation of electronic device 300. Processing device 301, ROM 302, and RAM 303 are interconnected via bus 305. Input / output (I / O) interface 304 is also connected to bus 305.

[0043] Typically, the following devices may be connected to the I / O interface 304: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead.

[0044] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of the present invention is not limited to technical solutions formed by specific combinations of the above-mentioned technical features. It also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents, without departing from the above-mentioned disclosure. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A method for security detection of HTTP requests, characterized in that: The following steps are involved: Data receiving step: receiving and parsing the current data segment of the HTTP request body; A historical detection status acquisition step: if the HTTP request body contains a historical detection record of the attack feature, the historical detection status of the attack feature of the HTTP request body is loaded through the data stack; Streaming regular expression matching step: obtaining the historical matching progress, historical matching status, and starting position of the current match of the attack signature according to the historical detection status, and using a pre-compiled regular expression signature library to match the attack signature to be matched in the current data segment against multiple attack patterns. If a completely matching attack signature exists, the value of the request body regular expression matching flag variable in the loaded historical detection status is set to true; otherwise, the value of the request body regular expression matching flag variable is set to false. Security rule matching step: read the flag variable value of the security rule hit status, if the flag variable value of the security rule hit status is not hit, then read the request body regular match flag variable value, if the request body regular match flag variable value is true, then perform HTTP request header condition verification, if the HTTP request header condition verification passes, then update the flag variable value of the security rule hit status to hit, if the request body regular match flag variable value is false, then do not perform HTTP request header condition verification, and do not update the flag variable value of the security rule hit status; Security decision execution step: If the value of the marker variable of the security rule hit status is hit, the interception operation is executed.

2. A method for detecting HTTP requests according to claim 1, characterized in that: It also includes the detection status temporary storage step: If the value of the request body regular match flag variable is false and the HTTP request body has not been received completely, the current detection status of the HTTP request body is temporarily stored in the data stack as a new historical detection status for reference when detecting subsequent data segments of the HTTP request body, and the storage space of the current data segment of the HTTP request body is released.

3. The method for security detection of an HTTP request according to claim 1, wherein: The security decision execution step further includes: If the flag variable value of the security rule hit status is not hit and the HTTP request body has been received completely, the release operation is performed.

4. The method for security detection of an HTTP request according to claim 1, wherein: The security decision execution step further includes: If the value of the flag variable of the security rule hit status is miss, and a security policy with a higher priority than the security rule detection is in effect, the subsequent security rule detection step is skipped and the security policy with a higher priority is directly executed.

5. The method for security detection of HTTP requests according to claim 1, wherein: It also includes timeout handling steps: Record the incremental time consumption of security detection of each data fragment of the HTTP request body, accumulate the incremental time consumption to obtain the current overall time consumption of security detection of the HTTP request body; if the overall time consumption of security detection of the HTTP request body is greater than or equal to the preset time threshold, stop the current security detection and perform the release operation.

6. A security detection device for HTTP requests, characterized in that: include: Streaming data receiving module, used to receive and parse the current data segment of the HTTP request body; a historical detection status acquisition module, configured to load the historical detection status of the attack feature of the HTTP request body through a data stack if the HTTP request body contains a historical detection record of the attack feature; A streaming regular expression matching module is used to obtain the historical matching progress, historical matching status, and starting position of the current match of the attack feature according to the historical detection status, and use a pre-compiled regular expression feature library to match the attack feature to be matched in the current data segment against multiple attack patterns. If a completely matching attack feature exists, the value of the request body regular expression matching flag variable in the loaded historical detection status is set to true; otherwise, the value of the request body regular expression matching flag variable is set to false; A security rule matching module is used to read the flag variable value of the security rule hit status. If the flag variable value of the security rule hit status is a miss, the request body regular match flag variable value is read. If the request body regular match flag variable value is true, the HTTP request header condition verification is performed. If the HTTP request header condition verification passes, the flag variable value of the security rule hit status is updated to hit. If the request body regular match flag variable value is false, the HTTP request header condition verification is not performed, and the flag variable value of the security rule hit status is not updated. The security decision execution module is used to execute an interception operation if the value of the mark variable of the security rule hit status is hit.

7. The HTTP request security detection device according to claim 6, characterized in that: Also includes: The detection status temporary storage module is used to temporarily store the current detection status of the HTTP request body to the data stack if the value of the request body regular match flag variable is false and the HTTP request body has not been completely received, as a new historical detection status for reference when detecting subsequent data segments of the HTTP request body, and release the storage space of the current data segment of the HTTP request body.

8. The HTTP request security detection device according to claim 6, characterized in that: The security decision execution module is also used to: If the flag variable value of the security rule hit status is not hit and the HTTP request body has been received completely, the release operation is performed.

9. The HTTP request security detection device according to claim 6, characterized in that: The security decision execution module is also used to: If the value of the flag variable of the security rule hit status is miss, and a security policy with a higher priority than the security rule detection is in effect, the subsequent security rule detection step is skipped and the security policy with a higher priority is directly executed.

10. The HTTP request security detection device according to claim 6, characterized in that: Also includes: The timeout processing module is used to record the security detection time increment of each data fragment of the HTTP request body, accumulate the time increments, and obtain the current overall security detection time of the HTTP request body. If the overall security detection time of the HTTP request body is greater than or equal to the preset time threshold, the current security detection is stopped and the release operation is performed.

Images