A method and apparatus for security detection of HTTP requests

Abstract

This invention discloses a security detection method and apparatus for HTTP requests, relating to the field of network security technology. The method includes: acquiring the current data segment of the HTTP request body; if historical detection records of attack characteristics exist for the request body, loading the historical detection status; scanning the current data segment using a pre-compiled regular expression feature library based on the historical detection status; if a complete match with the attack characteristics is found, setting the regular expression matching flag to true; otherwise, setting it to false; when a security rule is not hit and the regular expression match is true, performing HTTP request header condition verification; if successful, updating the security rule hit status to "hit"; if the regular expression match is false, skipping the request header verification and maintaining the original hit status; if the security rule hit status is "hit", performing an interception operation. This invention overcomes the length limitations and cross-block missed detection defects of traditional block-based detection, avoids HTTP request latency, reduces memory usage, and saves system resources.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a security detection method and device for HTTP request. BACKGROUND

[0002] Web Application Firewall (WAF) is mainly used for security protection of web application, such as detecting HTTP request traffic, so as to prevent web application from being attacked maliciously and reduce security risks. At present, the detection method of HTTP request body in WAF system is mostly block detection, that is, before detecting the HTTP request body, the HTTP request body is forced to be cut into fixed-length data blocks (such as 1MB / block), only the first or first N data blocks are scanned, and the subsequent content is ignored.

[0003] The block detection technology has the following defects:

[0004] (1) When facing cross-block attack load and large file upload scene, the attack load will be cut into multiple data blocks and cannot form complete attack characteristics, resulting in missed detection;

[0005] (2) The detection cannot be started until the entire data block is received, which increases the HTTP request delay and affects the business experience;

[0006] (3) For large files, the complete data must be loaded into the memory, which may cause memory exhaustion risk and reduce system stability. SUMMARY

[0007] In view of the above defects or deficiencies in the prior art, the present application provides a security detection method and device for HTTP request, which can solve the above technical problems mentioned in the background art.

[0008] In one aspect of the present application, a security detection method for HTTP request is provided, comprising the following steps:

[0009] Data receiving step: receiving and parsing the current data segment of the HTTP request body;

[0010] History detection state obtaining step: if there is a history detection record of attack characteristics of the HTTP request body, loading the history detection state of the attack characteristics of the HTTP request body through data stack;

[0011] The flow regular matching step is: according to the historical detection state, the historical matching progress, the historical matching state and the starting position of this time matching of the attack feature are acquired, the pre-compiled regular expression feature library is used to match the attack feature to be matched in the current data segment in multiple attack modes, if there is a completely matched attack feature, the request body regular matching mark variable value in the loaded historical detection state is set to true, otherwise the request body regular matching mark variable value is set to false;

[0012] The security rule matching step is: the mark variable value of the security rule hit state is read, if the mark variable value of the security rule hit state is not hit, the request body regular matching mark variable value is read, if the request body regular matching mark variable value is true, the HTTP request header condition verification is performed, if the HTTP request header condition verification is passed, the mark variable value of the security rule hit state is updated to be hit, if the request body regular matching mark variable value is false, the HTTP request header condition verification is not performed, and the mark variable value of the security rule hit state is not updated.

[0013] The security decision execution step is: if the mark variable value of the security rule hit state is hit, the interception operation is performed.

[0014] Another aspect of the application also provides a security detection device of an HTTP request, comprising:

[0015] The flow data receiving module is used for receiving and analyzing the current data segment of the HTTP request body.

[0016] The historical detection state acquisition module is used for loading the attack feature historical detection state of the HTTP request body through a data stack if the HTTP request body has the attack feature historical detection record.

[0017] The flow regular matching module is used for acquiring the historical matching progress, the historical matching state and the starting position of this time matching of the attack feature according to the historical detection state, using the pre-compiled regular expression feature library to match the attack feature to be matched in the current data segment in multiple attack modes, if there is a completely matched attack feature, the request body regular matching mark variable value in the loaded historical detection state is set to true, otherwise the request body regular matching mark variable value is set to false.

[0018] The security rule matching module is configured to read the value of the marked variable of the security rule hit state, read the value of the request body regular matching marked variable if the value of the marked variable of the security rule hit state is not hit, perform HTTP request header condition verification if the value of the request body regular matching marked variable is true, update the value of the marked variable of the security rule hit state to hit if the HTTP request header condition verification is passed, do not perform the HTTP request header condition verification and do not update the value of the marked variable of the security rule hit state if the value of the request body regular matching marked variable is false.

[0019] The security decision execution module is configured to perform an interception operation if the value of the marked variable of the security rule hit state is hit.

[0020] The HTTP request security detection method and device provided by the application have the following beneficial effects:

[0021] (1) The application adopts a streaming segmentation technology, receives and detects multiple data segments of an HTTP request body, temporarily stores detection state information of a current data segment in a data stack, so that the CPU has time to process other tasks in a detection task suspension stage, and can quickly reload the detection state in the data stack when a subsequent data segment is received, so that the HTTP request body can continue subsequent matching based on previous feature matching progress. A pipeline architecture of receiving and detecting in parallel is constructed, the length limitation of traditional block detection and the cross-block detection defect are broken, and the HTTP request delay is also avoided.

[0022] (2) After the current data segment of the HTTP request body is detected, the storage space of the current data segment is released, and only the detection state information of the data segment is temporarily stored. Since the detection state information is mostly a state pointer, it does not need to occupy too much storage space, so the memory occupation rate is greatly reduced, and the system stability is improved.

[0023] (3) The application prepositions the matching detection of the HTTP request body. If the HTTP request body has a matched attack feature, the matching detection of the HTTP request header is performed again. If the HTTP request body does not match the attack feature, the detection of the HTTP request header is not performed. In this way, not only is the detection of the subsequent data segments of the HTTP request body avoided due to the early detection of the HTTP request header and the non-matching of the attack feature in the request header, but also the invalid detection times of the HTTP request header are greatly reduced, and the system resources are saved. BRIEF DESCRIPTION OF DRAWINGS

[0024] Other features, objects and advantages of the application will become more apparent from the following detailed description of non-limiting embodiments made with reference to the accompanying drawings:

[0025] Figure 1 is a flow diagram of a security detection method of an HTTP request provided by an embodiment of the present application;

[0026] Figure 2 is a structural diagram of a security detection device of an HTTP request provided by an embodiment of the present application;

[0027] Figure 3 is a structural diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in a clear and complete manner with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0029] The terms used in the embodiments of the present application are merely for the purpose of describing specific embodiments and are not intended to limit the present application. The singular forms “a”, “an” and “the” used in the embodiments of the present application are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0030] Referring to Figure 1 , an embodiment of the present application provides a security detection method of an HTTP request, comprising the following steps:

[0031] Data receiving step S101 receiving and parsing a current data segment of an HTTP request body.

[0032] The present embodiment does not use the traditional HTTP request body block detection technology, but divides the HTTP request body into a plurality of continuous data segments, and then sends them to the WAF in sequence. The WAF system receives and parses each data segment in sequence and performs security detection. This process is referred to as streaming detection by the present application.

[0033] Specifically, when an HTTP request arrives at the WAF system, a detection instance corresponding to the HTTP request is created, the data in the request header (header) and the current data segment of the request body (body) in the HTTP request is parsed, the fields and values that need to be matched are extracted, and a matching expression is constructed according to the extracted fields and values, which is used for subsequent regular matching operations.

[0034] Further, since the HTTP request body is divided into multiple data segments for streaming, before parsing the current data segment, it is preferred to detect whether the HTTP request body (or HTTP request) is complete and set the request integrity mapping variable, so that the subsequent security rule detection step makes logical judgment according to the request integrity mapping variable.

[0035] Further, if the length of the HTTP request body is very long, there will be many data segments, which will greatly increase the detection time consumption, so it is necessary to limit the use of system resources by a single HTTP request from the detection time consumption dimension. Since the complete HTTP request body security detection in the prior art is changed to security detection of each data segment in turn in the present application, it is best to verify the time consumption of all detected data segments before parsing the HTTP request. If the total detection time consumption up to the current time exceeds the time threshold, then the timeout control (such as exiting the detection of the current data segment) is performed according to the timeout strategy, so as to reduce the occupation of system resources.

[0036] For example, the security detection time increment of each data segment of the HTTP request body is recorded, and the time increments are accumulated to obtain the current security detection overall time consumption of the HTTP request body. If the security detection overall time consumption of the HTTP request body is greater than or equal to the preset time threshold, the current security detection is stopped, and a release operation is performed.

[0037] Optionally, the timeout processing step can also be logically located in the security decision execution step, and the present embodiment does not make a unique limitation thereto.

[0038] Stream regular matching step S102 If the HTTP request body has a historical detection record of attack features, the historical detection state of the attack features of the HTTP request body is loaded through the data stack.

[0039] Specifically, the security detection process of the HTTP request body of the present application is: data receiving-data parsing-performing detection-generating results. When the performing detection link does not generate a terminal state, it is necessary to return to the data receiving link and wait for the arrival of subsequent data segments. Because the data receiving link and the performing detection link occur in different components, and when performing security detection, it is uncertain when the subsequent data segments will arrive, at this time, if the traditional way of continuous cycle waiting is adopted until the data segments arrive or timeout, the CPU computing resources will be continuously occupied, which will cause the system performance to decrease sharply. Therefore, the technical means adopted by the present application is: suspending the entire HTTP request security detection process, giving up the CPU to process other detection requests, until the HTTP request has subsequent HTTP request body data segments, and then waking up the process to continue execution. In order to achieve this purpose, when the current data segment does not match the attack characteristics, the present application temporarily stores the current detection state information through the data stack (a kind of data cache space), so that when detecting the subsequent incoming data segments, the data stack is reloaded, and the process is woken up, and then the historical detection state can be continued from the last matching end position to continue matching the attack characteristics according to the historical detection state.

[0040] Further, the historical detection state includes but is not limited to: historical matching feature information, historical matching state, historical matching progress, next matching starting position, request body regular matching mark variable and the like.

[0041] Stream regular matching step S103 According to the historical detection state, the historical matching progress, the historical matching state and the starting position of this matching are obtained, the pre-compiled regular expression feature library is used to match the attack characteristics in the current data segment, if there is a completely matched attack characteristic, the request body regular matching mark variable value in the loaded historical detection state is set to true, otherwise the request body regular matching mark variable value is set to false.

[0042] Specifically, by reading the data in the loaded data stack through the wake-up security detection process, the historical detection state of the HTTP request body can be obtained. From the historical detection state, it can be known that the previous data segment has matched the attack characteristics to what extent during regular matching, and from where the subsequent matching should continue. According to the historical detection state, the pre-compiled regular expression feature library is used to match the attack characteristics in the current data segment. The pre-compiled regular expression feature library contains regular expressions of various types of attack characteristics known in advance, and the parsed data in the current data segment can be matched with various attack characteristics through the pre-compiled regular expression feature library. If there is a complete matching attack characteristic, the request body regular matching flag variable value in the loaded historical detection state is set to 1 (1 represents true), otherwise the request body regular matching flag variable value is set to 0 (0 represents false), that is, no complete attack characteristic is matched.

[0043] For example:

[0044] The attack characteristics to be matched are abc, but a is divided into the previous data segment, and bc is divided into the next data segment. The data stack saves the historical detection state, which records the feature matching progress (such as the number of bytes or characters that have been matched), feature information (such as which attack characteristic), and matching state (such as complete matching, partial matching, and complete non-matching) and other information. Suppose the previous data segment has matched a in the attack characteristic abc, and the next data segment is to be detected, the data stack is reloaded, and the progress of the last feature matching is "a is matched" from the data stack. Then the current data segment starts to match from b and continues until bc is matched. At this time, it can be concluded that "the request body contains data that completely matches the attack characteristic abc, so the request body contains suspected attack malicious data", and the request header is further detected.

[0045] Security rule matching step S104: The value of the flag variable of the security rule hit state is read, and if the value of the flag variable of the security rule hit state is not hit, the value of the request body regular matching flag variable is read, and if the value of the request body regular matching flag variable is true, the HTTP request header condition verification is performed, and if the HTTP request header condition verification is passed, the value of the flag variable of the security rule hit state is updated to hit. If the value of the request body regular matching flag variable is false, the HTTP request header condition verification is not performed, and the value of the flag variable of the security rule hit state is not updated.

[0046] Specifically, when detecting the HTTP request, the conventional technology usually detects the HTTP request header first, and then detects the HTTP request body, and the matching rule of each attack feature is matched only once, if the HTTP request header is not matched, the HTTP request body is not matched and detected (that is, the request header and the request body are matched with the attack feature at the same time, which is safe matching, and if any one of the request header and the request body is not matched, the latter does not need to be detected). The reason why the conventional technology detects the HTTP request header first is that the receiving and detection of the HTTP request body take a long time, while the detection of the HTTP request header takes a short time, so the HTTP request header is detected first to give sufficient buffer time for the receiving and detection of the HTTP request body. However, the present application sequentially detects each data segment of the HTTP request body in a streaming manner, and the matching rule of each attack feature is repeatedly executed several times (in the case of no timeout, the data segment is repeated several times). Since the HTTP request header is repeatedly detected each time the data segment of the HTTP request body is detected, if the HTTP request header is detected first and is not matched with the attack feature, the default logic does not execute the detection of the subsequent data segment, at this time, if the attack feature exists in the data segment, the attack feature will be missed.

[0047] In order to solve the above technical problems, the present application detects the HTTP request body first, that is, the data segment of the HTTP request body is detected first, if the data segment is matched with the attack feature, the detection of the HTTP request header is executed, if the current data segment of the HTTP request body is not matched with the attack feature, the detection of the HTTP request header is not executed in this round. Through the matching logic of the present application, not only the detection of the subsequent data segment is avoided due to the detection of the HTTP request header not matched with the attack feature, thereby causing the attack feature to be missed, but also the detection times of the HTTP request header are greatly reduced, the system resources are significantly saved, and the system performance is improved.

[0048] In order to realize the above assumption, the present application designs a safety rule matching method which meets the above matching logic. The safety rule matching method uses a "safety rule hit state marking variable value" to represent whether the above matching logic is completely met. If met, the marking variable value is set to 1, indicating that the attack feature exists in the HTTP request, which is detected according to the above matching logic, at this time, the corresponding operation (such as interception, release, etc.) can be executed according to the safety decision. If not met, the marking variable value is set to 0, indicating that the attack feature does not exist in the HTTP request according to the above matching logic until the current data segment, if the data segment has not been received (whether the end flag of the HTTP request body is received can be determined), the current detection state needs to be temporarily stored through the data stack, and the storage space of the current data segment is released, and the subsequent detection is continued.

[0049] Further, the initial value of the marking variable of the security rule hit state can be set to 0, and 0 indicates that the matching logic of the security rule is not hit. At this time, it is necessary to determine whether the detection result of the current HTTP request header and request body is sufficient to make the value of the marking variable of the security rule hit state become 1, and 1 indicates that the matching logic of the security rule is hit.

[0050] Specifically, the request body regular matching marking variable value is read, and if the request body regular matching marking variable value is 1 (1 indicates true, that is, there is a matching attack feature in the request body), then the HTTP request header condition verification (for example, http.host == 'www.test.com') is performed, and if the HTTP request header condition verification is passed, that is, there is a matching attack feature in the request header, the value of the marking variable of the security rule hit state is updated from 0 to 1, which indicates that after the security detection of the data segment of the HTTP request body and the HTTP request header in this round, it is found that there is indeed a matching attack feature in the HTTP request, and the result is obtained in strict accordance with the order of "first matching detection of the HTTP request body, and then matching detection of the HTTP request header".

[0051] Suppose that the read request body regular matching marking variable value is 0 (0 indicates false, that is, there is no matching attack feature in the current data segment of the request body), and since the attack feature is not matched in the HTTP request body at this time, the HTTP request header also does not need to be detected (the attack feature is matched in the request header and the request body, which indicates that the HTTP request has an attack feature). However, this does not mean that the HTTP request body does not contain a matching attack feature, because there may be a data segment with an attack feature later, and the HTTP request body may not have been detected at this time. Therefore, the system determines whether the HTTP request body is received completely by judging whether an end flag of the HTTP request body is received, and if not, the current detection state of the HTTP request body is temporarily stored in the data stack as a new historical detection state for detecting the subsequent data segment of the HTTP request body, and the storage space of the current data segment of the HTTP request body is released.

[0052] In summary, since the storage space of each data segment is released after the matching detection is completed in this step, and the temporary storage state is mostly a state pointer, which does not require excessive storage space, the memory occupancy rate of the request body stream segment detection method composed of the "current data segment detection - detection state temporary storage - storage space release - subsequent data segment loading data stack" of the application is greatly reduced, and the system stability is steadily improved. In addition, the security rule matching logic of "first matching detection of HTTP request body, and then matching detection of HTTP request header" makes the system not miss the detection of attack features, and greatly reduces the repeated detection times of the HTTP request header.

[0053] Security decision execution step S105 If the value of the mark variable of the security rule hit state is hit, an interception operation is performed.

[0054] Specifically, if the value of the mark variable of the security rule hit state is 1 (1 represents that the security rule is hit), it indicates that the attack features in the current HTTP request have been detected according to the security rule matching logic of "first matching detection of HTTP request body, and then matching detection of HTTP request header", and at this time, even if there are attack features in the subsequent data segment, there is no need to detect again, because as long as one attack feature is detected, the system will intercept the HTTP request. Therefore, when the value of the mark variable of the security rule hit state is hit, the system directly performs the interception operation.

[0055] Further, if the value of the mark variable of the security rule hit state is not hit, and the HTTP request body is received completely, it indicates that there is no attack feature in the HTTP request, and at this time, the system directly performs the pass operation.

[0056] Still further, if the value of the mark variable of the security rule hit state is not hit, and a security policy with a higher priority than the security rule detection is effective, the system directly skips the subsequent security rule detection step and directly executes the security policy with a higher priority. For example, although the current HTTP request does not hit the matching attack features, its IP address falls into the IP blacklist, which is a security policy with a higher priority, so the system will not continue to detect the attack features in the HTTP request, but directly intercepts the HTTP request according to the IP address in the blacklist.

[0057] Referring to Figure 2Another embodiment of the present application also provides a security detection device 200 for HTTP request, comprising: a streaming data receiving module 201, a history detection state obtaining module 202, a streaming regular matching module 203, a security rule matching module 204 and a security decision executing module 205. The security detection device 200 for HTTP request can execute the security detection method for HTTP request in the method embodiment.

[0058] Specifically, the security detection device 200 for HTTP request comprises:

[0059] The streaming data receiving module 201 is configured to receive and parse a current data segment of a HTTP request body.

[0060] The history detection state obtaining module 202 is configured to, if there is a history detection record of attack features of the HTTP request body, load a history detection state of attack features of the HTTP request body through a data stack.

[0061] The streaming regular matching module 203 is configured to, according to the history detection state, obtain a history matching progress, a history matching state and a starting position of this time matching of attack features, match attack features in the current data segment with a pre-compiled regular expression feature library in multiple attack modes, if there is a completely matched attack feature, set a request body regular matching flag variable value in the loaded history detection state to true, otherwise set the request body regular matching flag variable value to false.

[0062] The security rule matching module 204 is configured to read a flag variable value of a security rule hit state, if the flag variable value of the security rule hit state is not hit, read the request body regular matching flag variable value, if the request body regular matching flag variable value is true, execute an HTTP request header condition verification, if the HTTP request header condition verification is passed, update the flag variable value of the security rule hit state to hit, if the request body regular matching flag variable value is false, do not execute the HTTP request header condition verification, and do not update the flag variable value of the security rule hit state.

[0063] The security decision executing module 205 is configured to, if the flag variable value of the security rule hit state is hit, execute an interception operation.

[0064] It should be noted that the security detection device 200 for HTTP request provided in the embodiment can be used to execute the technical solutions of the method embodiments, and the implementation principle and technical effects thereof are similar to those of the method, which will not be described here.

[0065] Figure 3This is a schematic diagram of an electronic device 300 according to another embodiment of the present invention. The electronic device 300 is used to implement the HTTP request security detection method in the method embodiment. The electronic device 300 in the embodiments of the present invention may include, but is not limited to, smartphones, tablet computers, PCs, laptops, WAF servers, etc. Figure 3 The electronic device 300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0066] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes to implement the methods of the embodiments described herein, based on a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing device 301, ROM 302, and RAM 303 are interconnected via a bus 305. An input / output (I / O) interface 304 is also connected to the bus 305.

[0067] Typically, the following devices can be connected to I / O interface 304: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0068] The above description is merely a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure in this invention is not limited to the specific combination of the above-described technical features, but should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this invention.

Claims

1. A security detection method of HTTP request, characterized in that, The method comprises the following steps: a data receiving step of receiving and parsing a current data segment of an HTTP request body; a history detection state obtaining step of loading a history detection state of an attack feature of the HTTP request body through a data stack if the HTTP request body has a history detection record of the attack feature; a streaming regular matching step of obtaining a history matching progress, a history matching state and a starting position of this time matching of the attack feature according to the history detection state, and matching the attack feature to be matched in the current data segment in multiple attack modes by using a pre-compiled regular expression feature library, setting a request body regular matching mark variable value in the loaded history detection state to true if there is a completely matched attack feature, or setting the request body regular matching mark variable value to false; a security rule matching step of reading a mark variable value of a security rule hit state, reading the request body regular matching mark variable value if the mark variable value of the security rule hit state is not hit, updating the mark variable value of the security rule hit state to hit if the HTTP request header condition verification is passed when the request body regular matching mark variable value is true, not performing the HTTP request header condition verification and not updating the mark variable value of the security rule hit state when the request body regular matching mark variable value is false; a security decision executing step of performing an interception operation if the mark variable value of the security rule hit state is hit.

2. The method of claim 1, wherein the HTTP request is a GET request. The method further comprises a detection state temporary storage step: if the request body regular matching mark variable value is false and the HTTP request body is not received completely, temporarily storing a current detection state of the HTTP request body in the data stack as a new history detection state for detecting a subsequent data segment of the HTTP request body, and releasing a storage space of the current data segment of the HTTP request body.

3. The method of claim 1, wherein the HTTP request is a GET request. The security decision executing step further comprises: performing a pass operation if the mark variable value of the security rule hit state is not hit and the HTTP request body is received completely.

4. The method of claim 1, wherein the HTTP request is a GET request. The security decision executing step further comprises: if the mark variable value of the security rule hit state is not hit and a security policy with a higher priority than the security rule detection is effective, skipping subsequent security rule detection steps and directly executing the security policy with the higher priority.

5. The method of claim 1, wherein the HTTP request is a POST request. The method further comprises a timeout processing step: recording a security detection time consumption increment of each data segment of the HTTP request body, accumulating the time consumption increment to obtain a whole security detection time consumption of the HTTP request body, and stopping the current security detection and performing a pass operation if the whole security detection time consumption of the HTTP request body is greater than or equal to a preset time threshold.

6. An apparatus for security detection of an HTTP request, characterized by, The method comprises: a streaming data receiving module for receiving and parsing a current data segment of an HTTP request body; a history detection state obtaining module for loading a history detection state of an attack feature of the HTTP request body through a data stack if the HTTP request body has a history detection record of the attack feature; a streaming regular matching module for obtaining a history matching progress, a history matching state and a starting position of this time matching of the attack feature according to the history detection state, and matching the attack feature to be matched in the current data segment in multiple attack modes by using a pre-compiled regular expression feature library, setting a request body regular matching mark variable value in the loaded history detection state to true if there is a completely matched attack feature, or setting the request body regular matching mark variable value to false; The flow regular matching module is configured to acquire a history matching progress, a history matching state and a starting position of the current matching of an attack feature according to the history detection state, and to perform matching of the attack feature in the current data segment by using a pre-compiled regular expression feature library in multiple attack modes, and if there is a completely matched attack feature, to set a request body regular matching flag variable value in the loaded history detection state to true, or to set the request body regular matching flag variable value to false. The security rule matching module is configured to read a flag variable value of a security rule hit state, and if the flag variable value of the security rule hit state is not hit, to read the request body regular matching flag variable value, and if the request body regular matching flag variable value is true, to perform HTTP request header condition verification, and if the HTTP request header condition verification is passed, to update the flag variable value of the security rule hit state to hit, and if the request body regular matching flag variable value is false, not to perform the HTTP request header condition verification, and not to update the flag variable value of the security rule hit state. The security decision execution module is configured to perform an interception operation if the flag variable value of the security rule hit state is hit.

7. The apparatus for detecting security of an HTTP request according to claim 6, wherein, Further comprising: The detection state temporary storage module is configured to temporarily store the current detection state of the HTTP request body to the data stack as a new history detection state for reference when detecting a subsequent data segment of the HTTP request body if the request body regular matching flag variable value is false and the HTTP request body is not received completely, and to release a storage space of the current data segment of the HTTP request body.

8. The apparatus for detecting security of an HTTP request according to claim 6, wherein, The security decision execution module is further configured to: perform a pass operation if the flag variable value of the security rule hit state is not hit and the HTTP request body is received completely.

9. The apparatus for detecting security of an HTTP request according to claim 6, wherein, The security decision execution module is further configured to: skip subsequent security rule detection steps and directly execute a security policy with a higher priority than the security rule detection if the flag variable value of the security rule hit state is not hit and the security policy with the higher priority is effective.

10. The apparatus for detecting security of an HTTP request according to claim 6, wherein, Further comprising: The timeout processing module is configured to record a security detection time consumption increment of each data segment of the HTTP request body, to accumulate the time consumption increments to obtain a whole security detection time consumption of the HTTP request body, and to stop the current security detection and perform a pass operation if the whole security detection time consumption of the HTTP request body is greater than or equal to a preset time threshold.

Images