Unauthorized detection method and device

Abstract

The invention relates to the technical field of network security, and discloses an unauthorized detection method and device, and the method comprises the steps: obtaining the feature information of a plurality of pages before and after login under the condition that a plurality of login certificates are used for login; wherein each piece of feature information before and after page login in the plurality of pieces of feature information before and after page login corresponds to one login certificate; calculating a page login value corresponding to the feature information before and after login of each page; wherein the page login value is used for determining whether the page is successfully logged in; according to the method, the target page login value used for representing the successfully logged-in page is selected from all the page login values, and the unauthorized detection is carried out based on the target page login value, so that the detection efficiency can be improved, and the detection accuracy can also be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to an overreach detection method and device. BACKGROUND

[0002] With the expansion of business, the number of applications is increasing, and the complexity of applications is also increasing. Among many security problems, logical vulnerabilities are difficult to cover by automated scanning tools, and overreach is a common problem in logical vulnerabilities.

[0003] Current overreach detection still mainly relies on manual testing. For some complex business systems, personnel familiar with the business need to be involved, such as personnel who do not fully understand the complete business, and the detection results may be missed, and professional red team personnel need to be involved, which requires additional manpower and financial resources. SUMMARY

[0004] (I) Technical problems to be solved

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present application provides an overreach detection method and device, which solves the problems of missing and false detection caused by manual detection and the dependence on the experience of detection personnel in the prior art.

[0006] (II) Technical solutions

[0007] In order to achieve the above-mentioned purposes, the main technical solutions adopted by the present application include:

[0008] In a first aspect, the present application provides an overreach detection method, comprising: in the case of using multiple login credentials for login, acquiring multiple page pre-login and post-login feature information; wherein each page pre-login and post-login feature information in the multiple page pre-login and post-login feature information corresponds to one login credential; calculating a page login value corresponding to each page pre-login and post-login feature information; wherein the page login value is used to determine whether the page is successfully logged in; selecting a target page login value representing a successfully logged-in page from all page login values, and performing overreach detection based on the target page login value.

[0009] In one possible embodiment, each page pre-login and post-login feature information includes page pre-login and post-login label quantity information; and the page login value is obtained by calculating the cosine similarity of the page pre-login and post-login label quantity information corresponding to the same login credential.

[0010] In a possible embodiment, the privilege detection includes horizontal privilege detection; the privilege detection based on the target page login value includes: using the login credential corresponding to a first page login value to attempt to log in to a URL accessed by a login credential corresponding to a second page login value; the first page login value and the second page login value are equal; and in a case where the login credential corresponding to the first page login value can log in to the URL, it is determined that a horizontal privilege vulnerability exists.

[0011] In a possible embodiment, the privilege detection includes vertical privilege detection; the privilege detection based on the target page login value includes: using the login credential corresponding to a third page login value to attempt to log in to a URL accessed by a login credential corresponding to a fourth page login value; the third page login value is greater than the fourth page login value, and the fourth page login value is a page login value closest to the target value among all page login values; and in a case where the login credential corresponding to the third page login value can log in to the URL, it is determined that a vertical privilege vulnerability exists.

[0012] In a possible embodiment, the privilege detection includes cross-site privilege detection; the privilege detection method further includes: using a login credential capable of accessing a subdomain name to access a main domain name corresponding to the subdomain name; and in a case where the access is successful, it is determined that a cross-site privilege vulnerability exists.

[0013] In a possible embodiment, the privilege detection includes unauthorized privilege detection; the privilege detection method further includes: using a request that does not carry a login credential to access a URL that needs a credential to allow access; and in a case where the access is successful, it is determined that an unauthorized vulnerability exists.

[0014] In a second aspect, an embodiment of the present application provides a privilege detection device, including:

[0015] The acquisition module is configured to, in a case where a plurality of login credentials are used to log in, acquire a plurality of page login-before-and-after feature information; each piece of page login-before-and-after feature information corresponds to a login credential.

[0016] The calculation module is configured to calculate a page login value corresponding to each piece of page login-before-and-after feature information; the page login value is used to determine whether a page is successfully logged in.

[0017] The privilege detection module is configured to select a target page login value used to represent a page that is successfully logged in from all page login values, and perform privilege detection based on the target page login value.

[0018] In a possible embodiment, each piece of page login-before-and-after feature information includes page login-before-and-after label quantity information; and the page login value is obtained by calculating a cosine similarity of the page login-before-and-after label quantity information corresponding to the same login credential.

[0019] In a possible embodiment, the privilege detection comprises horizontal privilege detection; the privilege detection module is specifically configured to: attempt to log in to a URL accessed by login credentials corresponding to a second page login value using login credentials corresponding to a first page login value; wherein the first page login value and the second page login value are equal; and determine that a horizontal privilege vulnerability exists in a case where the login credentials corresponding to the first page login value can log in to the URL.

[0020] In a possible embodiment, the privilege detection comprises vertical privilege detection; the privilege detection module is specifically configured to: attempt to log in to a URL accessed by login credentials corresponding to a fourth page login value using login credentials corresponding to a third page login value; wherein the third page login value is greater than the fourth page login value, and the fourth page login value is a page login value closest to a target value among all page login values; and determine that a vertical privilege vulnerability exists in a case where the login credentials corresponding to the third page login value can log in to the URL.

[0021] In a third aspect, an embodiment of the present application also provides an electronic device, which comprises: a memory configured to store a computer program; and a processor configured to execute the computer program stored in the memory, and when the computer program is executed, the processor is configured to execute the privilege detection method described above.

[0022] In a fourth aspect, an embodiment of the present application also provides a computer readable storage medium, which comprises computer instructions, and when the computer instructions are run on an electronic device, the electronic device is caused to execute the privilege detection method described above.

[0023] (III) Advantages

[0024] The present application has the following advantages:

[0025] The embodiments of the present application provide a privilege detection method and device, which can avoid missing detection, false detection and dependence on experience of detection personnel caused by traditional manual detection, so that the detection efficiency and detection accuracy can be improved.

[0026] In order to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly introduced as follows. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0028] Figure 1 A schematic diagram of an application scenario provided by the embodiments of the present application is shown.

[0029] Figure 2 A flow chart of an over-authorization detection method provided by the embodiments of the present application is shown.

[0030] Figure 3 A structural block diagram of an over-authorization detection device provided by the embodiments of the present application is shown.

[0031] Figure 4 A structural block diagram of an electronic device provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0032] In order to better explain the present application, in order to facilitate understanding, the present application will be described in detail by specific embodiments in combination with the drawings.

[0033] In order to solve the problems of missing, false detection and dependence on experience of detection personnel caused by manual detection in the prior art, the embodiments of the present application propose an over-authorization detection method and device, by acquiring feature information before and after login of multiple pages in the case of using multiple login credentials to log in, and calculating a page login value corresponding to the feature information before and after login of each page for determining whether the page is successfully logged in, and selecting a target page login value representing a successfully logged-in page from all page login values, and performing over-authorization detection based on the target page login value, which can avoid missing, false detection and dependence on experience of detection personnel caused by traditional manual detection, so as to not only improve the detection efficiency, but also improve the detection accuracy.

[0034] In order to better understand the above technical solutions, the exemplary embodiments of the present application will be described in more detail below with reference to the drawings. Although the exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more clear and thorough understanding of the present application, and to enable the scope of the present application to be completely conveyed to those skilled in the art.

[0035] Please refer to Figure 1 , Figure 1 A schematic diagram of an application scenario provided by the embodiments of the present application is shown. As Figure 1As shown, the application scenario includes an access device, an intermediate device, and a server. The intermediate device is connected with the access device and the server respectively.

[0036] It should be understood that the specific device of the intermediate device can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0037] For example, the intermediate device can be an intermediate gateway device, or an intermediate server, etc.

[0038] It should be noted that, although Figure 1 Although one access device and one intermediate device are taken as an example for description, it should be understood by those skilled in the art that more access devices and more intermediate devices can be included, and the embodiments of the present application are not limited thereto.

[0039] Continuing to refer to Figure 2 , Figure 2 A flow chart of an unauthorized access detection method provided by an embodiment of the present application is shown. It should be understood that the unauthorized access detection method can be applied to an intermediate device; the unauthorized access detection method includes:

[0040] In step S210, in the case of using multiple login credentials for login, multiple page pre-login and post-login feature information is acquired. Each piece of page pre-login and post-login feature information corresponds to one login credential.

[0041] Specifically, the intermediate device can divide the request traffic passing through the device into HTTPS traffic (which is encrypted) and HTTP traffic (which is not encrypted). For the HTTP traffic, the two-layer TCP traffic can be interpreted by tracking and recombining, the HTTP protocol is recognized, and the login form is further separated and recognized. When the login form is recognized in the TCP stream of the IP, the TCP in the response direction thereof is further tracked, and the response condition corresponding to the request is analyzed by TCP recombination. If the login form is not found, the TCP stream is abandoned. For the HTTPS traffic, due to the characteristics of the secure sockets layer, it is difficult to directly recombine the HTTP content from the TCP stream, so the reverse proxy mode is used, the HTTPS is decrypted by loading the private key of the domain name, the HTTP content is extracted, and the login result is monitored by recognizing the login form. That is, both of them use the response status code and the response content as the judgment standard to determine whether the current login credential is trusted (login is successful). The login credential can include the username, password, and other information for verifying the user identity.

[0042] In the case where it is determined that the login credential is a trusted login credential, the page pre-login and post-login feature information can be acquired.

[0043] It should be understood that the information contained in the page login before and after feature information can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0044] Optionally, by analyzing the response service of the trusted login, according to the possible situation of login, it is divided into 302 mode and direct response mode. Among them, the 302 mode refers to 302 jump after login regardless of success or failure. In this case, jump tracking is performed, the page after jump is analyzed, and the page before jump is compared with the page after jump; the direct response mode refers to that after login, if successful, the page after login success is directly responded, and if failed, the failure page or the login page is responded. Whether it is 302 mode or direct response mode, the page login before and after label quantity information (i.e. each page login before and after feature information includes page login before and after label quantity information) can be obtained, and the page login before and after label quantity information can include the number of page labels before login and the number of labels after login.

[0045] Optionally, the intermediate device includes page login before and after label quantity similarity, page login before and after structure similarity, page login before and after text change degree, and page login before and after API change value in each page login before and after feature information. Among them, the page login before and after label quantity similarity refers to calculating the cosine similarity of the total number of labels before login and the total number of labels after login; the page login before and after structure similarity refers to calculating the similarity of the entire page DOM tree (structure) before login and after login; the page login before and after text change degree refers to calculating the similarity (such as word vector cosine similarity) of the keywords and text before login and after login. For example, the similarity of the keywords before and after login can be used as the page login before and after text change degree; the page login before and after API change value can be obtained by counting how many accessible function interfaces (APIs) are added after login.

[0046] Step S220, calculating the page login value corresponding to each page login before and after feature information. Among them, the page login value is used to determine whether the page is successfully logged in.

[0047] It should be understood that the specific calculation process of the page login value can be set according to actual needs, and the embodiments of the present application are not limited thereto.

[0048] Optionally, in the case where the page login before and after feature information includes the page login before and after label quantity information, the page login value is obtained by calculating the cosine similarity of the page login before and after label quantity information corresponding to the same login credential.

[0049] Optionally, when the feature information before and after page login includes the similarity of the number of tags before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, the page login value is obtained by weighted fusion of the similarity of the number of tags before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, and the weights corresponding to the above four values ​​can be determined after dynamic adjustment.

[0050] The formula for calculating the real-time tag weight W_tag, which corresponds to the similarity in the number of tags before and after page login, is as follows:

[0051] W_tag=W_base_tag×(1+α×(C_tag-C_avg_tag));

[0052] In the formula, W_tag represents the real-time tag weight; W_base_tag represents the initial weight corresponding to the similarity of the number of tags before and after page login. That is, for different types of access devices, there are initial weights for the similarity of the number of tags before and after page login, the initial weights for the structural similarity before and after page login, the initial weights for the text change before and after page login, and the initial weights for the API change value before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_tag represents the real-time confidence level of the similarity of the number of tags before and after page login; C_avg_tag represents the historical average confidence level of all C_tags in the same type of access devices.

[0053] Furthermore, the formula for calculating C_tag is: Sim_tag × Penalty. Where Sim_tag represents the similarity in the number of tags before and after page login, and Penalty represents the penalty factor.

[0054] Furthermore, the process of determining the Penalty is as follows: calculate the change rate of the number of tags before and after page login. If it is determined that the change rate of the number of tags is outside the threshold range of the historical change rate of the same type of device, then the value range of the Penalty is determined to be 0.2 to 0.5; if it is determined that the change rate of the number of tags is within the threshold range of the historical change rate of the same type of device, then the value of the Penalty is determined to be 1.0.

[0055] Therefore, applying a penalty factor to abnormal feature changes can effectively filter out misjudgments caused by partial page redesigns.

[0056] Furthermore, the formula for calculating the real-time structural weight W_struct corresponding to the structural similarity before and after page login is as follows:

[0057] W_struct=W_base_struct×(1+α×(C_struct-C_avg_struct));

[0058] In the formula, W_struct represents the real-time structural weight; W_base_struct represents the initial weight corresponding to the structural similarity before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_struct represents the real-time confidence level corresponding to the structural similarity before and after page login; C_avg_struct represents the historical average confidence level of all C_structs in the same type of access device.

[0059] Furthermore, the formula for calculating C_struct is: Sim_struct + β × Func_Gain. Here, Sim_struct represents the structural similarity before and after page login, β represents the gain coefficient, which ranges from 0.1 to 0.3, and Func_Gain represents the proportion of newly added nodes that match preset functional keywords.

[0060] Furthermore, the process of determining Func_Gain is as follows: determine all newly added nodes after login, and determine whether the class attribute or id attribute of each newly added node contains predefined functional keywords, so as to determine the number of nodes containing predefined functional keywords, and use the quotient obtained by dividing the number of nodes with predefined functional keywords by the total number of newly added nodes as Func_Gain.

[0061] Therefore, a functional keyword gain term (Func_Gain) is introduced into the structural similarity calculation. When a new node contains keywords such as "policy configuration" and "log management", the confidence level is increased to distinguish malicious pages from functional extensions after permission upgrades.

[0062] In addition, the formula for calculating the real-time text weight W_text corresponding to the degree of text change before and after page login is:

[0063] W_text=W_base_text×(1+α×(C_text-C_avg_text));

[0064] In the formula, W_text represents the real-time text weight; W_base_text represents the initial weight corresponding to the change in text before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_text represents the real-time confidence level corresponding to the change in text before and after page login; C_avg_text represents the historical average confidence level of all C_texts in the same type of access device.

[0065] Furthermore, the formula for calculating C_text is:

[0066] min(1, Base1+Reward_user+Reward_perm). Where min means taking the minimum value, Base1 means the degree of text change before and after login, Reward_user means the hit value of the current account username, and Reward_perm means the hit value of the preset high-authority words (which are set according to actual needs, for example, it can be "system settings").

[0067] Furthermore, if the page detects that the current account username is present after login, the Reward_user is set to 0.3; if a preset high-privilege word is detected, the Reward_perm is set to 0.2.

[0068] In addition, the formula for calculating the real-time API weight W_API of the API change value before and after page login is:

[0069] W_API=W_base_API×(1+α×(C_API-C_avg_API));

[0070] In the formula, W_API represents the real-time API weight; W_base_API represents the initial weight corresponding to the API change value before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_API represents the real-time confidence level of the API change value before and after page login; C_avg_API represents the historical average confidence level of all C_APIs in the same type of access device.

[0071] Furthermore, the API changes before and after page login include the number of newly added regular APIs and the number of newly added sensitive APIs. Sensitive APIs refer to interfaces that may leak data or perform high-risk operations, and they can be identified through a pre-defined rule base. The calculation formula for C_API is: min(1, Base2 × 0.1 + 0.25 × N_sensitive). Where min represents taking the minimum value, Base2 represents the number of newly added regular APIs, and N_sensitive represents the number of newly added sensitive APIs.

[0072] Furthermore, after obtaining the four real-time weights W_tag, W_struct, W_text, and W_API, these four values ​​can be normalized to obtain normalized W_tag, normalized W_struct, normalized W_text, and normalized W_API.

[0073] Subsequently, the normalized W_tag, normalized W_struct, normalized W_text, and normalized W_API, along with their corresponding values, are weighted and fused to obtain the page login value.

[0074] Step S230: Select the target page login value from all page login values ​​to represent the successful login page, and perform unauthorized access detection based on the target page login value.

[0075] It should be understood that the specific process of selecting the target page login value to represent the successful login page from all page login values ​​can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0076] Optionally, if the page login value is obtained by using the cosine similarity of the number of tags before and after the login for the same login credential, it can be determined whether the page login value is equal to 1. Furthermore, if the page login value is equal to 1, it indicates login failure; if the page login value is not equal to 1, it indicates successful login. Also, the closer the page login value is to the target value (i.e., -1), the higher the corresponding privileges.

[0077] Optionally, if the page login value is obtained by weighted fusion of the similarity of the number of tags before and after page login, the structural similarity of the page before and after page login, the degree of text change before and after page login, and the API change value before and after page login, it can be determined whether the page login value is greater than a preset threshold. If it is greater than the preset threshold, it indicates successful login; otherwise, login fails. The specific value of the preset threshold can be set according to actual needs, and this application embodiment is not limited to this.

[0078] It should also be understood that the specific process of performing unauthorized access detection based on the login value of the target page can also be set according to actual needs, and the embodiments of this application are not limited thereto.

[0079] Optionally, when the page login value is obtained by the cosine similarity of the number of tags before and after the login for the same login credential, the horizontal privilege escalation detection process is as follows: using the login credential corresponding to the first page login value, attempt to log in to the URL accessed by the login credential corresponding to the second page login value; wherein the first page login value and the second page login value are equal; if the login credential corresponding to the first page login value can log in to the URL, a horizontal privilege escalation vulnerability is determined to exist.

[0080] Furthermore, the vertical privilege escalation detection process is as follows: using the login credentials corresponding to the login value on the third page, attempt to log in to the URL accessed by the login credentials corresponding to the login value on the fourth page; wherein, the login value on the third page is greater than the login value on the fourth page, and the login value on the fourth page is the login value on the page that is closest to the target value among all the login values; if the login credentials corresponding to the login value on the third page can log in to the URL, it is determined that a vertical privilege escalation vulnerability exists.

[0081] Optionally, if the page login value is obtained by weighted fusion of the similarity of tag quantity before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, it is also necessary to calculate the permission value R corresponding to each login credential. That is, the login value is used to determine whether the login was successful, and then the permission value R is used to determine the corresponding permission. Specifically, the formula for calculating the permission value R is:

[0082] R=γ×P_base_x+λ×Evol_x;

[0083] P_base_x = 0.6 × (density of permission keywords) + 0.4 × (percentage of sensitive function tags);

[0084] Permission keyword density = number of detected keywords / total number of words on the page × 100;

[0085] Percentage of sensitive function tags = (Sensitive function tags / Total number of tags) × 100;

[0086] Evol_x = 0.4 × (1 - Sim_struct)^0.3 × (Resource Change Rate) + 0.3 × (API Addition Strength);

[0087] Resource change rate = Number of newly added resources / Total number of resources;

[0088] API addition intensity = min(1, 0.5 × number of new ordinary APIs + 1.0 × number of new sensitive APIs) / 10;

[0089] In the formula, γ and λ are both weighting coefficients, and λ > γ. For example, λ is 0.7 and γ is 0.3; P_base_x represents the content permission score; Evol_x represents the feature evolution intensity value; the keywords involved in the number of detected keywords can be set according to actual needs; sensitive function tags refer to HTML elements that carry sensitive operations (such as deletion / modification / unauthorized access); Sim_struct represents the structural similarity of the page before and after login; the number of newly added resources can refer to the number of resources added and deleted after successful login. Among them, the resources can refer to .js, .css, and .png; the number of newly added ordinary APIs and the number of newly added sensitive APIs can be found in the relevant descriptions above.

[0090] Subsequently, all permission values ​​R can be normalized to the interval [-1, 1]. Then, all normalized permission values ​​R can be clustered into multiple groups. For example, the absolute value of the difference between two normalized permission values ​​R can be calculated. If the absolute value is less than or equal to a preset value, the two normalized permission values ​​R belong to the same cluster; otherwise, they belong to different clusters. Furthermore, the permission of the cluster containing the smallest normalized permission value R is set as the highest permission group, and all normalized permission values ​​R within the same cluster have the same permissions.

[0091] Therefore, test accounts are automatically grouped based on R values ​​(such as G_att high-privilege group / G_low low-privilege group), avoiding the rigidity of traditional role presets and adapting to enterprise-customized permission systems.

[0092] Furthermore, the horizontal privilege escalation detection process is as follows: select two login credentials corresponding to normalized permission values ​​R from the same cluster group for horizontal privilege escalation detection. If login is successful, it is determined that a horizontal privilege escalation vulnerability exists.

[0093] Furthermore, the vertical privilege escalation detection process is as follows: Login credentials corresponding to the normalized privilege value R selected from the cluster group corresponding to the highest privilege group, and login credentials corresponding to the normalized privilege value R selected from any other cluster group other than that cluster group, are used for vertical privilege escalation detection. If login is successful, then a horizontal privilege escalation vulnerability is confirmed to exist.

[0094] In addition, privilege escalation detection includes cross-site privilege escalation detection; privilege escalation detection methods also include: using login credentials that can access subdomains to access the main domain corresponding to the subdomain; if the access is successful, it is determined that there is a cross-site privilege escalation vulnerability.

[0095] In addition, privilege escalation detection includes unauthorized privilege escalation detection; privilege escalation detection methods also include: using a request without login credentials to access a URL that requires credentials to be allowed; if the access is successful, it is determined that an unauthorized vulnerability exists.

[0096] Furthermore, if a vulnerability is identified, logs can be logged and alerts can be issued.

[0097] In summary, by utilizing the above technical solutions, this application embodiment obtains multiple page login before and after feature information when logging in using multiple login credentials, calculates the page login value corresponding to each page login before and after feature information for determining whether the page login was successful, selects the target page login value from all page login values ​​to represent the successful login page, and performs unauthorized access detection based on the target page login value. This avoids missed detections, false detections, and reliance on the experience of detection personnel caused by traditional manual detection, thereby improving both detection efficiency and detection accuracy.

[0098] Furthermore, this application achieves anti-interference identification through a confidence dynamic compensation mechanism (penalty / gain term) and permission evolution strength quantization (Evol_x).

[0099] It should be understood that the above-described unauthorized access detection method is merely exemplary, and those skilled in the art can make various modifications based on the above method, and the modified solutions also fall within the protection scope of this application.

[0100] Please see Figure 3 , Figure 3 This diagram illustrates a structural block diagram of an unauthorized access detection device 300 provided in an embodiment of this application. It should be understood that the unauthorized access detection device 300 is capable of performing the various steps in the above method embodiments. The specific functions of the unauthorized access detection device 300 can be found in the description above; detailed descriptions are omitted here to avoid repetition. The unauthorized access detection device 300 includes at least one software function module that can be stored in memory or embedded in the operating system (OS) of the unauthorized access detection device 300 in the form of software or firmware. Specifically, the unauthorized access detection device 300 includes:

[0101] The acquisition module 310 is used to acquire feature information before and after login on multiple pages when multiple login credentials are used to log in; wherein, each feature information before and after login on multiple pages corresponds to a login credential.

[0102] The calculation module 320 is used to calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful.

[0103] The unauthorized access detection module 330 is used to select the target page login value from all page login values ​​to indicate a successful login page, and to perform unauthorized access detection based on the target page login value.

[0104] In one possible embodiment, the feature information before and after page login includes the number of tags before and after page login; the page login value is obtained by the cosine similarity of the number of tags before and after page login corresponding to the same login credential.

[0105] In one possible embodiment, the privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection module 330 is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

[0106] In one possible embodiment, the privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection module 330 is specifically configured to: attempt to log in to a URL accessed by the login credentials corresponding to ...

[0107] Since the apparatus described in the above embodiments of the present invention is an apparatus used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the methods described in the above embodiments of the present invention, and therefore will not be described again here. All apparatuses used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0108] Figure 4 A structural block diagram of an electronic device 400 provided in an embodiment of this application is shown. Figure 4 As shown, the electronic device 400 may include one or more of the following components: a processor 410 and a memory 420 coupled to the processor 410, wherein the memory 420 may store one or more computer programs, which may be configured to implement the methods described in the above embodiments when executed by one or more processors 410.

[0109] Processor 410 may include one or more processing cores. Processor 410 connects to various parts within the electronic device 400 using various interfaces and lines, and performs various functions and processes data of the electronic device 400 by running or executing instructions, programs, code sets, or instruction sets stored in memory 420, and by calling data stored in memory 420. Optionally, processor 410 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 410 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 410 and may be implemented separately using a communication chip.

[0110] The memory 420 may include random access memory (RAM) or read-only memory (ROM). The memory 420 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 420 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described above. The data storage area may also store data created by the electronic device 400 during use.

[0111] Understandably, electronic device 400 may include more or fewer structural elements than those shown in the above block diagram, such as power supply, input buttons, camera, speaker, screen, Wi-Fi (Wireless Fidelity) module, Bluetooth module, sensor, etc., and may not be limited herein.

[0112] This application discloses a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the above-described unauthorized access detection method.

[0113] This application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program can be executed by a processor to implement the above-described unauthorized access detection method.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0116] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0117] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0118] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0119] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A method for detecting unauthorized access, characterized in that, include: When multiple login credentials are used to log in, multiple page login before and after feature information is obtained; wherein, each page login before and after feature information corresponds to one login credential. Calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful; Select the target page login value from all the page login values ​​to indicate a successful login page, and perform unauthorized access detection based on the target page login value.

2. The unauthorized access detection method according to claim 1, characterized in that, The feature information before and after login for each page includes the number of tags before and after login; the page login value is obtained by the cosine similarity of the number of tags before and after login for the same login credential.

3. The unauthorized access detection method according to claim 2, characterized in that, The privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection based on the login value of the target page includes: Attempt to log in to the URL accessed by the login credentials corresponding to the login value on the first page using the login credentials corresponding to the login value on the second page; wherein the login values ​​on the first page and the login values ​​on the second page are equal; If the login credentials corresponding to the login value on the first page are able to log in to the URL, a horizontal privilege escalation vulnerability is identified.

4. The unauthorized access detection method according to claim 2, characterized in that, The privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection based on the login value of the target page includes: Attempt to log in to the URL accessed by the login credentials corresponding to the login credentials corresponding to the login credentials corresponding to the login credentials of the third page; wherein the login credentials of the third page are greater than the login credentials of the fourth page, and the login credentials of the fourth page are the page login credentials that are closest to the target value among all the page login credentials; If the login credentials corresponding to the login value on the third page are able to log in to the URL, a vertical privilege escalation vulnerability is identified.

5. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes cross-site privilege escalation detection; the privilege escalation detection method further includes: Access the main domain corresponding to the subdomain using login credentials that allow access to the subdomain; If the access is successful, a cross-site privilege escalation vulnerability is confirmed.

6. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes unauthorized privilege escalation detection; the privilege escalation detection method further includes: Access a URL that requires credentials to be accessed using a request that does not include login credentials; If access is successful, an unauthorized vulnerability is identified.

7. An overstepping authority detection device, characterized in that, include: The acquisition module is used to acquire feature information before and after login of multiple pages when logging in using multiple login credentials; wherein, each of the feature information before and after login of multiple pages corresponds to one of the login credentials; The calculation module is used to calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful. The unauthorized access detection module is used to select the target page login value representing a successful login page from all the page login values, and to perform unauthorized access detection based on the target page login value.

8. The unauthorized access detection device according to claim 7, characterized in that, The feature information before and after login for each page includes the number of tags before and after login; the page login value is obtained by the cosine similarity of the number of tags before and after login for the same login credential.

9. The unauthorized access detection device according to claim 8, characterized in that, The privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection module is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

10. The unauthorized access detection device according to claim 8, characterized in that, The privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection module is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

Images