An overreach detection method and apparatus

Abstract

The application relates to the technical field of network security, and discloses an overreach detection method and device, which comprises the following steps: in the case of using multiple login credentials to log in, acquiring multiple page pre-login and post-login feature information; wherein each piece of page pre-login and post-login feature information corresponds to one login credential; calculating a page login value corresponding to each piece of page pre-login and post-login feature information; wherein the page login value is used for determining whether a page is successfully logged in; selecting a target page login value used for indicating a successfully logged-in page from all the page login values, and performing overreach detection based on the target page login value, so that the detection efficiency and the detection accuracy can be improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an unauthorized access detection method and apparatus. Background Technology

[0002] As business expands, the number of applications increases, and their complexity also grows. Among the many security issues, logical vulnerabilities are difficult for automated scanning tools to cover, and privilege escalation is a common problem among logical vulnerabilities.

[0003] Currently, unauthorized access detection mainly relies on manual testing. For some complex business systems, personnel familiar with the business need to participate. If there are no personnel who are fully aware of the complete business, the detection results may be incomplete. In addition, professional red team personnel are required, which requires additional manpower and financial resources. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides an unauthorized detection method and apparatus, which solves the problems of omissions, false detections and dependence on the experience of detection personnel caused by manual detection in the prior art.

[0006] (II) Technical Solution

[0007] To achieve the above objectives, the main technical solutions adopted by the present invention include:

[0008] In a first aspect, embodiments of the present invention provide an unauthorized access detection method, comprising: when logging in using multiple login credentials, acquiring multiple page login-before-login feature information; wherein each page login-before-login feature information corresponds to a login credential; calculating a page login value corresponding to each page login-before-login feature information; wherein the page login value is used to determine whether the page login was successful; selecting a target page login value from all page login values ​​to represent a successful page login, and performing unauthorized access detection based on the target page login value.

[0009] In one possible embodiment, the feature information before and after page login includes the number of tags before and after page login; the page login value is obtained by the cosine similarity of the number of tags before and after page login corresponding to the same login credential.

[0010] In one possible embodiment, privilege escalation detection includes horizontal privilege escalation detection; privilege escalation detection based on the target page login value includes: attempting to log in to a URL accessed by the login credentials corresponding to the first page login value; wherein the first page login value and the second page login value are equal; if the login credentials corresponding to the first page login value can log in to the URL, it is determined that a horizontal privilege escalation vulnerability exists.

[0011] In one possible embodiment, privilege escalation detection includes vertical privilege escalation detection; privilege escalation detection based on the target page login value includes: attempting to log in to a URL accessed by the login credentials corresponding to the third page login value; wherein the third page login value is greater than the fourth page login value, and the fourth page login value is the page login value closest to the target value among all page login values; if the login credentials corresponding to the third page login value can log in to the URL, it is determined that a vertical privilege escalation vulnerability exists.

[0012] In one possible embodiment, the privilege escalation detection includes cross-site privilege escalation detection; the privilege escalation detection method further includes: using login credentials that can access the subdomain to access the main domain corresponding to the subdomain; if the access is successful, it is determined that a cross-site privilege escalation vulnerability exists.

[0013] In one possible embodiment, the privilege escalation detection includes unauthorized privilege escalation detection; the privilege escalation detection method further includes: using a request without login credentials to access a URL that requires credentials to be allowed; and if the access is successful, determining that an unauthorized vulnerability exists.

[0014] Secondly, embodiments of the present invention provide an unauthorized access detection device, comprising:

[0015] The acquisition module is used to acquire feature information before and after login on multiple pages when multiple login credentials are used to log in; each of the feature information before and after login on multiple pages corresponds to a login credential.

[0016] The calculation module is used to calculate the page login value corresponding to the feature information before and after each page login; the page login value is used to determine whether the page login was successful.

[0017] The privilege escalation detection module is used to select the target page login value from all page login values ​​to indicate a successful login page, and to perform privilege escalation detection based on the target page login value.

[0018] In one possible embodiment, the feature information before and after page login includes the number of tags before and after page login; the page login value is obtained by the cosine similarity of the number of tags before and after page login corresponding to the same login credential.

[0019] In one possible embodiment, the privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection module is specifically configured to: attempt to log in to a URL accessed by the login credentials corresponding to the login value of the first page using the login credentials corresponding to the login value of the second page; wherein the login values ​​of the first page and the second page are equal; if the login credentials corresponding to the login value of the first page can log in to the URL, it is determined that a horizontal privilege escalation vulnerability exists.

[0020] In one possible embodiment, the privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection module is specifically configured to: attempt to log in to a URL accessed by the login credentials corresponding to ...

[0021] Thirdly, embodiments of this application also provide an electronic device, the electronic device comprising: a memory for storing a computer program; and a processor for executing the computer program stored in the memory, wherein when the computer program is executed, the processor is configured to execute an unauthorized access detection method as described above.

[0022] Fourthly, embodiments of this application also provide a computer-readable storage medium including computer instructions that, when executed on an electronic device, cause the electronic device to perform an unauthorized access detection method as described above.

[0023] (III) Beneficial Effects

[0024] The beneficial effects of this invention are:

[0025] This invention proposes an unauthorized access detection method and apparatus. When multiple login credentials are used for login, multiple page login-before-login feature information is acquired. A page login value corresponding to each page login-before-login feature information is calculated to determine whether the login was successful. A target page login value representing a successful login is selected from all page login values, and unauthorized access detection is performed based on the target page login value. This avoids missed detections, false detections, and reliance on the experience of detection personnel caused by traditional manual detection. Therefore, it not only improves detection efficiency but also detection accuracy.

[0026] To make the above-mentioned objectives, features and advantages to be achieved by the embodiments of this application more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0027] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 A schematic diagram illustrating an application scenario provided by an embodiment of this application is shown;

[0029] Figure 2 A flowchart of an unauthorized access detection method provided in an embodiment of this application is shown;

[0030] Figure 3 This paper shows a structural block diagram of an overreach detection device provided in an embodiment of this application;

[0031] Figure 4 A structural block diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0032] To better explain and facilitate understanding of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0033] To address the issues of omissions, false positives, and reliance on the experience of testing personnel caused by manual detection in existing technologies, this invention proposes an unauthorized access detection method and apparatus. By acquiring multiple page login feature information before and after login when multiple login credentials are used, and calculating the page login value corresponding to each page login feature information to determine whether the login was successful, the method selects a target page login value from all page login values ​​to represent a successful login, and performs unauthorized access detection based on the target page login value. This avoids the omissions, false positives, and reliance on the experience of testing personnel caused by traditional manual detection, thus improving both detection efficiency and accuracy.

[0034] To better understand the above technical solutions, exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present invention are shown in the drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the present invention can be understood more clearly and thoroughly, and that the scope of the present invention can be fully conveyed to those skilled in the art.

[0035] Please see Figure 1 , Figure 1 A schematic diagram illustrating an application scenario provided by an embodiment of this application is shown. For example... Figure 1As shown, this application scenario includes an access device, an intermediate device, and a server. The intermediate device is connected to both the access device and the server.

[0036] It should be understood that the specific equipment of the intermediate device can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0037] For example, the intermediate device can be an intermediate gateway device or an intermediate server, etc.

[0038] It should be noted here that, although Figure 1 This description uses one access device and one intermediate device as an example, but those skilled in the art should understand that it may include more access devices and more intermediate devices, and the embodiments of this application are not limited thereto.

[0039] See also Figure 2 , Figure 2 A flowchart of an unauthorized access detection method provided in an embodiment of this application is shown. It should be understood that this unauthorized access detection method can be applied to intermediate devices; the unauthorized access detection method includes:

[0040] Step S210: When logging in using multiple login credentials, obtain feature information before and after login for multiple pages. Each of the feature information before and after login for a given page corresponds to a single login credential.

[0041] Specifically, this intermediate device can divide request traffic passing through it into HTTPS traffic (which is encrypted) and HTTP traffic (which is unencrypted). For HTTP traffic, the Layer 2 TCP traffic can be interpreted through tracing and reassembly to identify the HTTP protocol and further separate and identify the login form. When a login form is detected in the TCP stream of a given IP address, the TCP response direction is traced further, and the response to the request is analyzed through TCP reassembly. If no login form is found, the TCP stream is abandoned. For HTTPS traffic, due to the characteristics of Secure Sockets Layer (SSL), it is difficult to directly reassemble the HTTP content from the TCP stream. Therefore, a reverse proxy mode is used. By loading the domain's private key, HTTPS is first decrypted, and then the HTTP content is extracted. The login result is monitored by identifying the login form. In other words, both methods use the response status code and response content as criteria to determine whether the current login credentials are trustworthy (login successful). The login credentials may include username, password, and other information to verify the user's identity.

[0042] If the login credentials are confirmed to be reliable, characteristic information about the page before and after login can be obtained.

[0043] It should be understood that the information contained in the feature information before and after page login can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0044] Optionally, by analyzing the response business of trusted login, based on the common login scenarios, it can be divided into 302 mode and direct response mode. 302 mode refers to a 302 redirect after login regardless of success or failure. In this case, redirection tracking is performed, and the redirected page is analyzed and compared with the page before the redirect. Direct response mode refers to directly responding to the login success page if successful, and responding to either the failure page or the login page if unsuccessful. Regardless of whether it's 302 mode or direct response mode, the number of tags before and after login on the page can be obtained (i.e., each page's pre- and post-login feature information includes the number of tags before and after login), and this tag count information can include the number of tags before login and the number of tags after login.

[0045] Optionally, the intermediate device includes the following feature information for each page before and after login: similarity of tag quantity, structural similarity, text change, and API change. Tag quantity similarity refers to the cosine similarity between the total number of tags before and after login; structural similarity refers to the similarity of the entire page's DOM tree (structure) before and after login; text change refers to the similarity of keywords and text on the page before and after login (e.g., using word vector cosine similarity). For example, the keyword similarity before and after login can be used as the text change; and the API change can be calculated by counting how many new accessible APIs were added after login.

[0046] Step S220: Calculate the page login value corresponding to the feature information before and after page login for each page. The page login value is used to determine whether the page login was successful.

[0047] It should be understood that the specific calculation process of the login value on the page can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0048] Optionally, if the feature information before and after page login includes the number of tags before and after page login, the page login value is obtained by the cosine similarity of the number of tags before and after page login corresponding to the same login credential.

[0049] Optionally, when the feature information before and after page login includes the similarity of the number of tags before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, the page login value is obtained by weighted fusion of the similarity of the number of tags before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, and the weights corresponding to the above four values ​​can be determined after dynamic adjustment.

[0050] The formula for calculating the real-time tag weight W_tag, which corresponds to the similarity in the number of tags before and after page login, is as follows:

[0051] W_tag=W_base_tag×(1+α×(C_tag-C_avg_tag));

[0052] In the formula, W_tag represents the real-time tag weight; W_base_tag represents the initial weight corresponding to the similarity of the number of tags before and after page login. That is, for different types of access devices, there are initial weights for the similarity of the number of tags before and after page login, the initial weights for the structural similarity before and after page login, the initial weights for the text change before and after page login, and the initial weights for the API change value before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_tag represents the real-time confidence level of the similarity of the number of tags before and after page login; C_avg_tag represents the historical average confidence level of all C_tags in the same type of access devices.

[0053] Furthermore, the formula for calculating C_tag is: Sim_tag × Penalty. Where Sim_tag represents the similarity in the number of tags before and after page login, and Penalty represents the penalty factor.

[0054] Furthermore, the process of determining the Penalty is as follows: calculate the change rate of the number of tags before and after page login. If it is determined that the change rate of the number of tags is outside the threshold range of the historical change rate of the same type of device, then the value range of the Penalty is determined to be 0.2 to 0.5; if it is determined that the change rate of the number of tags is within the threshold range of the historical change rate of the same type of device, then the value of the Penalty is determined to be 1.0.

[0055] Therefore, applying a penalty factor to abnormal feature changes can effectively filter out misjudgments caused by partial page redesigns.

[0056] Furthermore, the formula for calculating the real-time structural weight W_struct corresponding to the structural similarity before and after page login is as follows:

[0057] W_struct=W_base_struct×(1+α×(C_struct-C_avg_struct));

[0058] In the formula, W_struct represents the real-time structural weight; W_base_struct represents the initial weight corresponding to the structural similarity before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_struct represents the real-time confidence level corresponding to the structural similarity before and after page login; C_avg_struct represents the historical average confidence level of all C_structs in the same type of access device.

[0059] Furthermore, the formula for calculating C_struct is: Sim_struct + β × Func_Gain. Here, Sim_struct represents the structural similarity before and after page login, β represents the gain coefficient, which ranges from 0.1 to 0.3, and Func_Gain represents the proportion of newly added nodes that match preset functional keywords.

[0060] Furthermore, the process of determining Func_Gain is as follows: determine all newly added nodes after login, and determine whether the class attribute or id attribute of each newly added node contains predefined functional keywords, so as to determine the number of nodes containing predefined functional keywords, and use the quotient obtained by dividing the number of nodes with predefined functional keywords by the total number of newly added nodes as Func_Gain.

[0061] Therefore, a functional keyword gain term (Func_Gain) is introduced into the structural similarity calculation. When a new node contains keywords such as "policy configuration" and "log management", the confidence level is increased to distinguish malicious pages from functional extensions after permission upgrades.

[0062] In addition, the formula for calculating the real-time text weight W_text corresponding to the degree of text change before and after page login is:

[0063] W_text=W_base_text×(1+α×(C_text-C_avg_text));

[0064] In the formula, W_text represents the real-time text weight; W_base_text represents the initial weight corresponding to the change in text before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_text represents the real-time confidence level corresponding to the change in text before and after page login; C_avg_text represents the historical average confidence level of all C_texts in the same type of access device.

[0065] Furthermore, the formula for calculating C_text is:

[0066] min(1, Base1+Reward_user+Reward_perm). Where min means taking the minimum value, Base1 means the degree of text change before and after login, Reward_user means the hit value of the current account username, and Reward_perm means the hit value of the preset high-authority words (which are set according to actual needs, for example, it can be "system settings").

[0067] Furthermore, if the page detects that the current account username is present after login, the Reward_user is set to 0.3; if a preset high-privilege word is detected, the Reward_perm is set to 0.2.

[0068] In addition, the formula for calculating the real-time API weight W_API of the API change value before and after page login is:

[0069] W_API=W_base_API×(1+α×(C_API-C_avg_API));

[0070] In the formula, W_API represents the real-time API weight; W_base_API represents the initial weight corresponding to the API change value before and after page login; α is an adjustment factor, and the value of α ranges from 0.3 to 0.7; C_API represents the real-time confidence level of the API change value before and after page login; C_avg_API represents the historical average confidence level of all C_APIs in the same type of access device.

[0071] Furthermore, the API changes before and after page login include the number of newly added regular APIs and the number of newly added sensitive APIs. Sensitive APIs refer to interfaces that may leak data or perform high-risk operations, and they can be identified through a pre-defined rule base. The calculation formula for C_API is: min(1, Base2 × 0.1 + 0.25 × N_sensitive). Where min represents taking the minimum value, Base2 represents the number of newly added regular APIs, and N_sensitive represents the number of newly added sensitive APIs.

[0072] Furthermore, after obtaining the four real-time weights W_tag, W_struct, W_text, and W_API, these four values ​​can be normalized to obtain normalized W_tag, normalized W_struct, normalized W_text, and normalized W_API.

[0073] Subsequently, the normalized W_tag, normalized W_struct, normalized W_text, and normalized W_API, along with their corresponding values, are weighted and fused to obtain the page login value.

[0074] Step S230: Select the target page login value from all page login values ​​to represent the successful login page, and perform unauthorized access detection based on the target page login value.

[0075] It should be understood that the specific process of selecting the target page login value to represent the successful login page from all page login values ​​can be set according to actual needs, and the embodiments of this application are not limited thereto.

[0076] Optionally, if the page login value is obtained by using the cosine similarity of the number of tags before and after the login for the same login credential, it can be determined whether the page login value is equal to 1. Furthermore, if the page login value is equal to 1, it indicates login failure; if the page login value is not equal to 1, it indicates successful login. Also, the closer the page login value is to the target value (i.e., -1), the higher the corresponding privileges.

[0077] Optionally, if the page login value is obtained by weighted fusion of the similarity of the number of tags before and after page login, the structural similarity of the page before and after page login, the degree of text change before and after page login, and the API change value before and after page login, it can be determined whether the page login value is greater than a preset threshold. If it is greater than the preset threshold, it indicates successful login; otherwise, login fails. The specific value of the preset threshold can be set according to actual needs, and this application embodiment is not limited to this.

[0078] It should also be understood that the specific process of performing unauthorized access detection based on the login value of the target page can also be set according to actual needs, and the embodiments of this application are not limited thereto.

[0079] Optionally, when the page login value is obtained by the cosine similarity of the number of tags before and after the login for the same login credential, the horizontal privilege escalation detection process is as follows: using the login credential corresponding to the first page login value, attempt to log in to the URL accessed by the login credential corresponding to the second page login value; wherein the first page login value and the second page login value are equal; if the login credential corresponding to the first page login value can log in to the URL, a horizontal privilege escalation vulnerability is determined to exist.

[0080] Furthermore, the vertical privilege escalation detection process is as follows: using the login credentials corresponding to the login value on the third page, attempt to log in to the URL accessed by the login credentials corresponding to the login value on the fourth page; wherein, the login value on the third page is greater than the login value on the fourth page, and the login value on the fourth page is the login value on the page that is closest to the target value among all the login values; if the login credentials corresponding to the login value on the third page can log in to the URL, it is determined that a vertical privilege escalation vulnerability exists.

[0081] Optionally, if the page login value is obtained by weighted fusion of the similarity of tag quantity before and after page login, the structural similarity before and after page login, the text change before and after page login, and the API change value before and after page login, it is also necessary to calculate the permission value R corresponding to each login credential. That is, the login value is used to determine whether the login was successful, and then the permission value R is used to determine the corresponding permission. Specifically, the formula for calculating the permission value R is:

[0082] R=γ×P_base_x+λ×Evol_x;

[0083] P_base_x = 0.6 × (density of permission keywords) + 0.4 × (percentage of sensitive function tags);

[0084] Permission keyword density = number of detected keywords / total number of words on the page × 100;

[0085] Percentage of sensitive function tags = (Sensitive function tags / Total number of tags) × 100;

[0086] Evol_x = 0.4 × (1 - Sim_struct)^0.3 × (Resource Change Rate) + 0.3 × (API Addition Strength);

[0087] Resource change rate = Number of newly added resources / Total number of resources;

[0088] API addition intensity = min(1, 0.5 × number of new ordinary APIs + 1.0 × number of new sensitive APIs) / 10;

[0089] In the formula, γ and λ are both weighting coefficients, and λ > γ. For example, λ is 0.7 and γ is 0.3; P_base_x represents the content permission score; Evol_x represents the feature evolution intensity value; the keywords involved in the number of detected keywords can be set according to actual needs; sensitive function tags refer to HTML elements that carry sensitive operations (such as deletion / modification / unauthorized access); Sim_struct represents the structural similarity of the page before and after login; the number of newly added resources can refer to the number of resources added and deleted after successful login. Among them, the resources can refer to .js, .css, and .png; the number of newly added ordinary APIs and the number of newly added sensitive APIs can be found in the relevant descriptions above.

[0090] Subsequently, all permission values ​​R can be normalized to the interval [-1, 1]. Then, all normalized permission values ​​R can be clustered into multiple groups. For example, the absolute value of the difference between two normalized permission values ​​R can be calculated. If the absolute value is less than or equal to a preset value, the two normalized permission values ​​R belong to the same cluster; otherwise, they belong to different clusters. Furthermore, the permission of the cluster containing the smallest normalized permission value R is set as the highest permission group, and all normalized permission values ​​R within the same cluster have the same permissions.

[0091] Therefore, test accounts are automatically grouped based on R values ​​(such as G_att high-privilege group / G_low low-privilege group), avoiding the rigidity of traditional role presets and adapting to enterprise-customized permission systems.

[0092] Furthermore, the horizontal privilege escalation detection process is as follows: select two login credentials corresponding to normalized permission values ​​R from the same cluster group for horizontal privilege escalation detection. If login is successful, it is determined that a horizontal privilege escalation vulnerability exists.

[0093] Furthermore, the vertical privilege escalation detection process is as follows: Login credentials corresponding to the normalized privilege value R selected from the cluster group corresponding to the highest privilege group, and login credentials corresponding to the normalized privilege value R selected from any other cluster group other than that cluster group, are used for vertical privilege escalation detection. If login is successful, then a horizontal privilege escalation vulnerability is confirmed to exist.

[0094] In addition, privilege escalation detection includes cross-site privilege escalation detection; privilege escalation detection methods also include: using login credentials that can access subdomains to access the main domain corresponding to the subdomain; if the access is successful, it is determined that there is a cross-site privilege escalation vulnerability.

[0095] In addition, privilege escalation detection includes unauthorized privilege escalation detection; privilege escalation detection methods also include: using a request without login credentials to access a URL that requires credentials to be allowed; if the access is successful, it is determined that an unauthorized vulnerability exists.

[0096] Furthermore, if a vulnerability is identified, logs can be logged and alerts can be issued.

[0097] In summary, by utilizing the above technical solutions, this application embodiment obtains multiple page login before and after feature information when logging in using multiple login credentials, calculates the page login value corresponding to each page login before and after feature information for determining whether the page login was successful, selects the target page login value from all page login values ​​to represent the successful login page, and performs unauthorized access detection based on the target page login value. This avoids missed detections, false detections, and reliance on the experience of detection personnel caused by traditional manual detection, thereby improving both detection efficiency and detection accuracy.

[0098] Furthermore, this application achieves anti-interference identification through a confidence dynamic compensation mechanism (penalty / gain term) and permission evolution strength quantization (Evol_x).

[0099] It should be understood that the above-described unauthorized access detection method is merely exemplary, and those skilled in the art can make various modifications based on the above method, and the modified solutions also fall within the protection scope of this application.

[0100] Please see Figure 3 , Figure 3 This diagram illustrates a structural block diagram of an unauthorized access detection device 300 provided in an embodiment of this application. It should be understood that the unauthorized access detection device 300 is capable of performing the various steps in the above method embodiments. The specific functions of the unauthorized access detection device 300 can be found in the description above; detailed descriptions are omitted here to avoid repetition. The unauthorized access detection device 300 includes at least one software function module that can be stored in memory or embedded in the operating system (OS) of the unauthorized access detection device 300 in the form of software or firmware. Specifically, the unauthorized access detection device 300 includes:

[0101] The acquisition module 310 is used to acquire feature information before and after login on multiple pages when multiple login credentials are used to log in; wherein, each feature information before and after login on multiple pages corresponds to a login credential.

[0102] The calculation module 320 is used to calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful.

[0103] The unauthorized access detection module 330 is used to select the target page login value from all page login values ​​to indicate a successful login page, and to perform unauthorized access detection based on the target page login value.

[0104] In one possible embodiment, the feature information before and after page login includes the number of tags before and after page login; the page login value is obtained by the cosine similarity of the number of tags before and after page login corresponding to the same login credential.

[0105] In one possible embodiment, the privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection module 330 is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

[0106] In one possible embodiment, the privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection module 330 is specifically configured to: attempt to log in to a URL accessed by the login credentials corresponding to ...

[0107] Since the apparatus described in the above embodiments of the present invention is an apparatus used to implement the methods of the above embodiments of the present invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the methods described in the above embodiments of the present invention, and therefore will not be described again here. All apparatuses used in the methods of the above embodiments of the present invention fall within the scope of protection of the present invention.

[0108] Figure 4 A structural block diagram of an electronic device 400 provided in an embodiment of this application is shown. Figure 4 As shown, the electronic device 400 may include one or more of the following components: a processor 410 and a memory 420 coupled to the processor 410, wherein the memory 420 may store one or more computer programs, which may be configured to implement the methods described in the above embodiments when executed by one or more processors 410.

[0109] Processor 410 may include one or more processing cores. Processor 410 connects to various parts within the electronic device 400 using various interfaces and lines, and performs various functions and processes data of the electronic device 400 by running or executing instructions, programs, code sets, or instruction sets stored in memory 420, and by calling data stored in memory 420. Optionally, processor 410 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). Processor 410 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into processor 410 and may be implemented separately using a communication chip.

[0110] The memory 420 may include random access memory (RAM) or read-only memory (ROM). The memory 420 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 420 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described above. The data storage area may also store data created by the electronic device 400 during use.

[0111] Understandably, electronic device 400 may include more or fewer structural elements than those shown in the above block diagram, such as power supply, input buttons, camera, speaker, screen, Wi-Fi (Wireless Fidelity) module, Bluetooth module, sensor, etc., and may not be limited herein.

[0112] This application discloses a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the above-described unauthorized access detection method.

[0113] This application discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program can be executed by a processor to implement the above-described unauthorized access detection method.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0115] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions.

[0116] It should be noted that any reference numerals placed between parentheses in the claims should not be construed as limiting the claims. The word "comprising" does not exclude the presence of components or steps not listed in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such components. The invention can be implemented by means of hardware comprising several different components and by means of a suitably programmed computer. In claims that enumerate several means, several of these means may be embodied by the same hardware. The use of the terms first, second, third, etc., is merely for convenience of expression and does not indicate any order. These terms can be understood as part of the component names.

[0117] Furthermore, it should be noted that in the description of this specification, the terms "one embodiment," "some embodiments," "embodiment," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Furthermore, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0118] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the claims should be interpreted to include both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0119] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, then this invention should also include these modifications and variations.

Claims

1. A method for detecting unauthorized access, characterized in that, include: When multiple login credentials are used to log in, multiple page login before and after feature information is obtained; wherein, each page login before and after feature information corresponds to one login credential. Calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful; Select the target page login value from all the page login values ​​to represent a successful login page, and perform unauthorized access detection based on the target page login value; The calculation of the page login value corresponding to the feature information before and after each page login includes: When each page login feature information includes the number of tags before and after login, the page login value is obtained by the cosine similarity of the number of tags before and after login for the same login credential.

2. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection based on the login value of the target page includes: Attempt to log in to the URL accessed by the login credentials corresponding to the login value on the first page using the login credentials corresponding to the login value on the second page; wherein the login values ​​on the first page and the login values ​​on the second page are equal; If the login credentials corresponding to the login value on the first page are able to log in to the URL, a horizontal privilege escalation vulnerability is identified.

3. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection based on the login value of the target page includes: Attempt to log in to the URL accessed by the login credentials corresponding to the login credentials corresponding to the login credentials corresponding to the login credentials of the third page; wherein the login credentials of the third page are greater than the login credentials of the fourth page, and the login credentials of the fourth page are the page login credentials that are closest to the target value among all the page login credentials; If the login credentials corresponding to the login value on the third page are able to log in to the URL, a vertical privilege escalation vulnerability is identified.

4. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes cross-site privilege escalation detection; the privilege escalation detection method further includes: Access the main domain corresponding to the subdomain using login credentials that allow access to the subdomain; If the access is successful, a cross-site privilege escalation vulnerability is confirmed.

5. The unauthorized access detection method according to claim 1, characterized in that, The privilege escalation detection includes unauthorized privilege escalation detection; the privilege escalation detection method further includes: Access a URL that requires credentials to be accessed using a request that does not include login credentials; If access is successful, an unauthorized vulnerability is identified.

6. An overstepping authority detection device, characterized in that, include: The acquisition module is used to acquire feature information before and after login of multiple pages when logging in using multiple login credentials; wherein, each of the feature information before and after login of multiple pages corresponds to one of the login credentials; The calculation module is used to calculate the page login value corresponding to the feature information before and after each page login; wherein, the page login value is used to determine whether the page login was successful. An unauthorized access detection module is used to select the target page login value representing a successful login page from all the page login values, and to perform unauthorized access detection based on the target page login value; Specifically, the calculation module is used to obtain the page login value by means of the cosine similarity of the number of tags before and after page login for the same login credential, when the feature information before and after each page login includes the number of tags before and after page login.

7. The unauthorized access detection device according to claim 6, characterized in that, The privilege escalation detection includes horizontal privilege escalation detection; the privilege escalation detection module is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

8. The unauthorized access detection device according to claim 6, characterized in that, The privilege escalation detection includes vertical privilege escalation detection; the privilege escalation detection module is specifically used to: attempt to log in to a URL accessed by the login credentials corresponding to ...

Images