Unauthorized access detection method and device, equipment, storage medium and program product

Abstract

The invention relates to an unauthorized access detection method and device, equipment, a storage medium and a program product. The method is applied to a detection end, the detection end is associated with an edge gateway, and the method comprises the following steps: acquiring an access request for a target server initiated by a terminal in a current time period; according to the initiation time of each access request, sorting the obtained access requests in the current time period to obtain a current access sequence; comparing the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence of which the occurrence frequency meets a threshold value in a historical time period; and under the condition that the current access sequence is not matched with the reference access sequence, determining an unauthorized access detection result of the terminal according to a first access interface parameter corresponding to the current access sequence and a second access interface parameter corresponding to each access request in the comparison time period. By adopting the method, the detection accuracy of the unauthorized access of the terminal is improved, and the detection difficulty of the unauthorized access is reduced.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an unauthorized access detection method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the advent of the digital age, the amount of data stored and transmitted by WEB (World Wide Web) development platforms has also increased. Therefore, simply detecting user login permissions is insufficient to meet the current information protection needs.

[0003] In order to achieve high-demand information protection, after the existence of privilege escalation vulnerabilities, a comprehensive investigation of each terminal is carried out through code review or manual penetration testing.

[0004] However, this kind of unauthorized access detection can only be carried out manually after unauthorized access occurs, and it is difficult to detect access requests in real time, resulting in a certain lag and thus low detection accuracy. Summary of the Invention

[0005] Therefore, it is necessary to provide an unauthorized access detection method, apparatus, device, storage medium, and program product that can improve the detection accuracy in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a method for detecting unauthorized access, including:

[0007] Get the access requests initiated by the terminal to the target server within the current time period;

[0008] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0009] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0010] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0011] In one embodiment, determining the unauthorized access detection result of the terminal based on the first access interface parameter corresponding to the current access sequence and the second access interface parameter corresponding to each access request within the comparison period includes: selecting the current interface access request from the current access sequence and obtaining the first access interface parameter in the current interface access request; determining the associated interface of the current interface based on the current interface corresponding to the current interface access request; determining the second access interface parameter in the historical interface access request corresponding to the associated interface among each access request within the comparison period; and determining the unauthorized access detection result of the terminal based on the matching between the first access interface parameter and the second access interface parameter.

[0012] In one embodiment, determining the unauthorized access detection result of the terminal based on the matching between the first access interface parameter and the second access interface parameter includes: if the first access interface parameter and the second access interface parameter match, determining that the unauthorized access detection result of the terminal is non-unauthorized access; if the first access interface parameter and the second access interface parameter do not match, determining that the unauthorized access detection result of the terminal is unauthorized access.

[0013] In one embodiment, if the unauthorized access detection result of the terminal is unauthorized access, the above method further includes: generating an interception signal corresponding to the terminal and sending the interception signal to the edge gateway; wherein the interception signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server in the future.

[0014] In one embodiment, the reference access sequence is determined as follows: Historical access requests to the target server initiated by at least two terminals within a historical time period are obtained; for each terminal, a first historical access sequence corresponding to the terminal is determined based on the initiation time of each historical access request initiated by the terminal within a preset time period; wherein, the preset time period is a time period within the historical time period with the same length as the current time period; for each first historical access sequence, each target subsequence corresponding to the first historical access sequence is determined to obtain each second historical access sequence; wherein, each target subsequence includes a preset number of historical access requests in the first historical access sequence sorted by initiation time; and the historical access sequence whose frequency of occurrence in each first historical access sequence and each second historical access sequence meets a threshold is determined as the reference access sequence.

[0015] In one embodiment, the method further includes: determining that the unauthorized access detection result of the terminal is non-unauthorized access when the current access sequence matches the reference access sequence.

[0016] Secondly, this application also provides an unauthorized access detection device, comprising:

[0017] The acquisition module is used to acquire access requests initiated by the terminal to the target server within the current time period;

[0018] The sorting module is used to sort the access requests within the current time period according to the initiation time of each access request, so as to obtain the current access sequence.

[0019] The comparison module is used to compare the current access sequence with the reference access sequence; wherein, the reference access sequence is a historical access sequence that appears with a frequency that meets a threshold within a historical time period.

[0020] The determination module is used to determine the unauthorized access detection result of the terminal based on the first access interface parameter corresponding to the current access sequence and the second access interface parameter corresponding to each access request in the reference time period when the obtained comparison result indicates that the current access sequence does not match the reference access sequence; wherein, the reference time period is the time period before the current time period.

[0021] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0022] Get the access requests initiated by the terminal to the target server within the current time period;

[0023] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0024] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0025] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0026] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0027] Get the access requests initiated by the terminal to the target server within the current time period;

[0028] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0029] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0030] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0031] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0032] Get the access requests initiated by the terminal to the target server within the current time period;

[0033] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0034] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0035] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0036] The aforementioned unauthorized access detection method, apparatus, device, storage medium, and program products introduce a detection terminal associated with an edge gateway. This detection terminal obtains access requests initiated by terminals to the target server from the edge gateway, obtains the current access sequence based on the timing of each access request, and compares the current access sequence with a reference access sequence. If the current access sequence and the reference access sequence do not match, the unauthorized access detection result of the terminal is further determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request within the comparison time period. On the one hand, this method of associating the detection terminal at the edge gateway can detect unauthorized access by terminals before they successfully access the target server. On the other hand, even when the current access sequence and the reference access sequence do not match, it does not directly identify the terminal corresponding to the current access sequence as unauthorized accessing, but further determines the unauthorized access detection result of the terminal based on the first and second access interface parameters corresponding to the current access sequence, reducing false positives for non-unauthorized access and improving the comprehensiveness of unauthorized access detection. Therefore, it improves the accuracy, reliability, and real-time performance of the detection. Furthermore, this solution eliminates the need for manual investigation, reducing the difficulty of detection implementation. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0038] Figure 1 This is a diagram illustrating the application environment of an unauthorized access detection method in one embodiment.

[0039] Figure 2 This is a flowchart illustrating an unauthorized access detection method in one embodiment;

[0040] Figure 3 This is a flowchart illustrating an unauthorized access detection method in another embodiment;

[0041] Figure 4 This is a flowchart illustrating an unauthorized access detection method in yet another embodiment;

[0042] Figure 5 This is a flowchart illustrating the steps for determining a reference access sequence in one embodiment;

[0043] Figure 6 This is a structural block diagram of an unauthorized access detection device in one embodiment;

[0044] Figure 7This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0047] While related technologies already detect user login permissions, if a logged-in user maliciously tampers with the parameters of requests initiated by the front end, they may gain unauthorized access to data or other users' personal data via the API (Application Programming Interface). Therefore, even if multi-dimensional access control for data was considered at the beginning of platform development, new unauthorized access vulnerabilities may still be introduced during later iterations and maintenance due to human error by developers.

[0048] In addition, for the unauthorized access that has already occurred, it is necessary to conduct a comprehensive code review or manual penetration testing to identify the users who have unauthorized access. This results in a significant increase in manpower costs. Furthermore, it is necessary to combine this with other methods to detect malicious behavior that attempts to access data without authorization and to promptly block it in order to enhance data security, which further increases the difficulty of implementation.

[0049] In view of this, the unauthorized access detection method provided in the embodiments of this application can be applied to, for example, Figure 1 The application environment shown. In this environment, the edge gateway 120 is located at each terminal (e.g., Figure 1The first terminal 131, the second terminal 132, and the third terminal 133 shown in the diagram communicate with the target server 140. The edge gateway 120 receives access requests from each terminal to the target server and forwards these requests to the target server 140. Simultaneously, the edge gateway 120 receives response data generated by the target server based on the access requests and forwards the response data to the corresponding terminals. The detection terminal 110 can interact with the edge gateway 120. For example, the detection terminal 110 can obtain access requests from the edge gateway 120, process the requests, determine the unauthorized access detection result of the requesting terminal, and send the unauthorized access detection result back to the edge gateway 120.

[0050] It should be noted that, Figure 1 The detection terminal 110 is externally located in the edge gateway 120, which is only illustrative. In some embodiments, the detection terminal 110 may also be integrated with the edge gateway 120, which is not limited in this application. Meanwhile, Figure 1 The number of detection terminals 110, terminals, edge gateways 120 and target servers 140 is only illustrative. Depending on actual needs, there can be any number of detection terminals 110, terminals, edge gateways 120 and target servers 140. This application is not limited to this.

[0051] In one exemplary embodiment, such as Figure 2 As shown, an unauthorized access detection method is provided. Taking the application of this method to a detection terminal associated with an edge gateway as an example, the method includes the following steps S201 to S204. Wherein:

[0052] S201, obtain access requests initiated by the terminal to the target server within the current time period.

[0053] To alleviate pressure on the origin server, improve the response speed of terminal access, and better adapt to application scenarios, the web development platform can be connected to a CDN (Content Delivery Network). In this case, when a terminal wants to access the web development platform configured on the target server, it does not send the access request directly to the target server, but instead sends it to the edge gateway closest to the terminal.

[0054] In one embodiment, each access request initiated by the terminal within the current time period corresponds to a complete interactive session. For example, taking an e-commerce platform as an example, if the current time period is 10 minutes, the terminal can perform an interactive session within this time period, including "viewing the homepage → searching for products → viewing product details → adding to cart → submitting an order." The length of the current time period can be flexibly adjusted according to the interactive situation of the web development platform in actual applications, and this application does not impose any limitations on it.

[0055] Specifically, it can obtain access requests initiated by terminals to the target server from the edge gateway in real time, or it can obtain access requests initiated by terminals to the target server within a certain period of time from the edge gateway at the time of response according to a preset time interval.

[0056] S202, based on the initiation time of each access request, sort the access requests within the current time period to obtain the current access sequence.

[0057] In one embodiment, for a terminal that does not exceed its privileges, a series of access requests will be initiated in order to obtain resources in the web development platform. These access requests usually follow a fixed order of access logic, that is, the access request initiated later is initiated on the premise that the access request initiated earlier has been responded to.

[0058] For example, if the target server is configured with an e-commerce development platform, and the terminal accesses various resources on the e-commerce development platform to make online shopping, the terminal needs to initiate an "add to cart" access request before initiating an "add to cart" access request. Similarly, the terminal needs to initiate a "view product details" access request before initiating an "add to cart" access request.

[0059] However, for terminals that access resources without authorization, in order to access the resource without having the necessary permissions, they may bypass the access logic of terminals that do not access resources without authorization and directly initiate the final access request corresponding to the resource in the preceding access request of the terminal that accesses the resource.

[0060] In one embodiment, the edge gateway can generate access logs for each terminal in real time and send the access logs to the detection end. The access logs include multi-dimensional information such as the initiation time of each access request, the IP (Internet Protocol) address of each access request, and the ID (Identity Document) of the initiating terminal corresponding to each access request.

[0061] Optionally, the detection end is configured as a distributed architecture, which can perform traffic distribution processing on the access logs sent in real time by the edge gateway. For example, access requests initiated by the same terminal can be divided into the same distributed node according to the IP of each access request and the ID of the initiating terminal corresponding to each access request, so that the access requests initiated by the same terminal can be processed within the distributed node.

[0062] Therefore, based on the access logs, the access requests can be sorted according to the order in which they were initiated to obtain the current access sequence, and the unauthorized access of the terminal can be analyzed according to the order in which the access requests were initiated in the current access sequence.

[0063] S203, compare the current access sequence with the reference access sequence.

[0064] However, statically comparing the pre-defined access logic with the order initiation of access requests in the current access sequence is insufficient for real-time synchronization with web development platform updates and fails to consider the different access habits of various terminals, resulting in a high false alarm rate. Therefore, a reference access sequence can be determined from historical access sequences within a historical time period, whose frequency meets a threshold, and used as a comparison benchmark. In other words, the reference access sequence is a historical access sequence within a historical time period that meets the frequency threshold.

[0065] In one embodiment, a threshold is used to define the frequency of occurrence of each historical access sequence. The specific value of the threshold can be flexibly adjusted and is not limited in this application. For example, if the threshold is 5, the frequency of occurrence of historical access sequence x is 3, and the frequency of occurrence of historical access sequence y is 6, then historical access sequence x can be determined to be a non-reference access sequence, while historical access sequence y is a reference access sequence.

[0066] Optionally, the historical time period can be the time period corresponding to the previous period of the current period. Each historical access sequence can be a series of access requests initiated by a single terminal received by the edge gateway within the historical time period. It should be noted that the reference access sequence is not fixed, but is updated synchronously with the period, that is, it is updated once every period. For example, with each period as 24 hours, if the current time period belongs to the period corresponding to October 1, then the historical time period is the 24 hours corresponding to September 30.

[0067] For example, the number of reference access sequences can be one or more.

[0068] In one embodiment, when there is only one reference access sequence, the current access sequence and the reference access sequence are compared to obtain a comparison result.

[0069] In another embodiment, when there are multiple reference access sequences, the current access sequence and each reference access sequence can be compared sequentially. Only when none of the reference access sequences and the current access sequence meet the requirements can a comparison result indicating a mismatch between the current access sequence and the reference access sequences be obtained.

[0070] For example, the current access sequence is [a1, b2, a2], while the reference access sequences are [a1, b1, a2] and [a1, b1, b2], where a1, a2, b1, and b2 represent different access requests. A comparison reveals that the order of the access requests in the current sequence is inconsistent with the order of the historical access requests in both reference access sequences. Therefore, the comparison result indicates a mismatch between the current access sequence and the reference access sequences. Furthermore, this current access sequence may be an unauthorized access sequence, suggesting that the terminal initiating this current access sequence may have an intent to access without authorization.

[0071] S204, if the obtained comparison results indicate that the current access sequence does not match the reference access sequence, determine the unauthorized access detection result of the terminal based on the first access interface parameter corresponding to the current access sequence and the second access interface parameter corresponding to each access request in the comparison period.

[0072] However, determining the detection result solely based on the comparison between the reference access sequence and the current access sequence may lead to misjudgments of terminals that are not accessing the system without authorization. For example, in an enterprise's internal management platform, only a small number of colleagues in certain positions may be able to access resources related to information other than their own household registration information based on authorized access logic. This would result in the access logic not appearing or only appearing once in the historical access sequence, thus preventing the historical access sequence corresponding to that access logic from being identified as the reference access sequence.

[0073] Therefore, to ensure the accuracy of detection, when the current access sequence does not match the reference access sequence, access interface parameters are introduced to further detect unauthorized access by the terminal.

[0074] In one embodiment, the first access interface parameter represents the parameters carried by the interface access request in the current access sequence. The second access interface parameter represents the parameters carried by the interface access request in each access request within the comparison time period.

[0075] In one embodiment, the reference time period is a time period preceding the current time period. For example, if the current time period is 10 minutes, the reference time period could be a time period within 30 days preceding the current time period. Optionally, the second access interface parameter can be one or more.

[0076] As an optional implementation, the unauthorized access detection result of the terminal corresponding to the current access sequence can be determined based on the matching between the parameter values ​​of the first access interface parameter and the parameter values ​​of the second access interface parameter.

[0077] For example, if the parameter value of the first access interface is 999, but the parameter value of the second access interface during the same period is an integer between 010 and 600, then the first access interface parameter does not match the parameters of each second access interface. It can be determined that the terminal is initiating an unauthorized access attempt to the target server. That is, the unauthorized access detection result of the terminal is unauthorized access.

[0078] As another optional implementation, the unauthorized access detection result of the terminal corresponding to the current access sequence can be determined based on the matching between the number of bits in the first access interface parameter and the number of bits in the second access interface parameter.

[0079] For example, the parameter value of the first access interface parameter is 11112222, which is 8 bits. However, the parameter value of the second access interface parameter in the same time period is an integer between 010 and 600, which is 3 bits. Therefore, the first access interface parameter does not match the second access interface parameters. It can be determined that the terminal is initiating an unauthorized access attempt to the target server. That is, the unauthorized access detection result of the terminal is unauthorized access.

[0080] The aforementioned unauthorized access detection method introduces a detection terminal associated with an edge gateway. This terminal obtains access requests initiated by terminals to the target server from the edge gateway, calculates the current access sequence based on the timing of each request, and compares it with a reference access sequence. If the current access sequence does not match the reference sequence, the unauthorized access detection result is further determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request within the same time period. On one hand, this method of associating the detection terminal at the edge gateway allows for the detection of unauthorized access before the terminal successfully accesses the target server. On the other hand, even when the current access sequence does not match the reference access sequence, it does not directly classify the terminal corresponding to the current access sequence as unauthorized. Instead, it further determines the unauthorized access detection result based on the first and second access interface parameters corresponding to the current access sequence, reducing false positives for non-unauthorized access and improving the comprehensiveness of unauthorized access detection. Therefore, it improves the accuracy, reliability, and real-time performance of the detection. Furthermore, this solution eliminates the need for manual investigation, reducing the difficulty of implementation.

[0081] In one embodiment, if the current access sequence matches the reference access sequence, the unauthorized access detection result of the terminal can be determined as non-unauthorized access.

[0082] Optionally, if the current access sequence matches at least one of the reference access sequences, it can be concluded that the order of the access requests in the current access sequence frequently occurred in the historical period. This indicates that the terminal is requesting access to the target server according to the authorized access logic, and therefore the unauthorized access detection result of the terminal can be determined as non-unauthorized access.

[0083] Furthermore, the detection system can generate trust signals and store them in an internal database to mark terminals as trusted terminals. This allows for priority detection of terminals other than trusted ones when multiple terminals request access, improving detection efficiency.

[0084] For example, a terminal that was previously marked as a trusted terminal may no longer have access to the corresponding platform or access to certain resources on the corresponding platform in the current period due to actual circumstances. Therefore, the list of trusted terminals can be updated periodically, and if a trusted terminal has not initiated an access request for a long period of time, the terminal can be removed from the list of trusted terminals.

[0085] Based on the above embodiments, to avoid unauthorized access based solely on the matching of the current access sequence and the reference access sequence, when the current access sequence and the reference access sequence do not match, the unauthorized access detection result of the terminal is further judged based on the first access parameter. The following will combine... Figure 4 The process of determining the unauthorized access detection result of the terminal based on the first access parameter is explained.

[0086] In some embodiments, such as Figure 3 As shown, S204 includes S301 to S304.

[0087] S301, Select the current interface access request from the current access sequence, and obtain the first access interface parameter in the current interface access request.

[0088] The current access sequence can include various types of access requests, such as static resource requests (e.g., images, style sheets), HTML (HyperText Markup Language) requests, and API requests.

[0089] Optionally, the type of access request can be determined based on the URL (Uniform Resource Locator) of the access request included in the access log, so as to identify the access request corresponding to the interface request type from the current access sequence as the current interface access request.

[0090] In one embodiment, the format of the current interface access request content can be determined based on the application field in the interface request header corresponding to the current interface access request. Then, based on the format of the current interface access request content, different parameter parsing methods can be used to obtain the first interface request parameters. The interface request header can be auxiliary information sent along with the current interface access request, reflecting the format of the request content in the current interface access request.

[0091] Optionally, if the application field in the API request header is application / json, it means that the format of the request content in the current API access request is JSON (JavaScript Object Notation, JS key-value pair data), and the current API access request can be parsed according to the parameter parsing method corresponding to the JSON format.

[0092] Optionally, if the application field in the interface request header is application / x-www-form-urlencoded, it indicates that the format of the requested content in the current access request is URL-encoded form data, and the current access interface request can be parsed according to the parameter parsing method corresponding to the URL-encoded form data format.

[0093] S302, determine the associated interface of the current interface based on the current interface corresponding to the current interface access request.

[0094] Among them, the associated interface represents the preceding interface that can serve as the source of parameters for the current interface. It should be noted that the associated interface of the current interface also has its own associated interface, that is, each interface can be both the current interface and its associated interface.

[0095] Taking the current interface access request as an example, the first interface request parameter in the current access sequence is provided by the associated interface of the current interface, and is one of the parameters in the response dataset of the associated interface.

[0096] For example, given that the current interface is known, the associated interface can be determined from the interface mapping table. The interface mapping table can be set directly according to actual needs, or it can be obtained by analyzing the access requests within the specified time period.

[0097] Specifically, analyzing the relationships between each interface involves first obtaining all interface requests corresponding to that interface within the specified time period and parsing the parameters of each request. Then, each interface request parameter is compared with all parameters in the response datasets of other interfaces to determine the similarity between the request parameters of that interface and all parameters in the response datasets of other interfaces. The similarity scores are then ranked, and the interface with the highest similarity is identified as its associated interface. This process is repeated for each interface to determine its associated interfaces, resulting in an interface mapping table.

[0098] S303, determine the second access interface parameter in the historical interface access request corresponding to the associated interface in each access request within the comparison period.

[0099] Optionally, the second access interface parameter can represent the access interface parameter in the interface request, or it can represent the parameter in the response dataset when the interface is used as an associated interface.

[0100] For example, after determining the associated interface of the current interface, the second access interface data corresponding to the associated interface can be selected from the second access interface parameters of each access request, that is, the parameters in the response data set of the associated interface.

[0101] S304, determine the unauthorized access detection result of the terminal based on the matching between the first access interface parameters and the second access interface parameters.

[0102] In one embodiment, matching the first access interface parameter and the second access interface parameter means querying the first access interface parameter from the second access interface parameter. If the first access interface parameter is found in the second access interface parameter, it means that the first access interface parameter matches the second access interface parameter. Conversely, if the first access interface parameter is not found in the second access interface parameter, it means that the first access interface parameter does not match the second access interface parameter.

[0103] For example, after determining the matching between the first access interface parameters and the second access interface parameters, the terminal can be determined to have unauthorized access or not based on the matching.

[0104] In the above embodiment, when the current access sequence does not match the reference access sequence, the first access interface parameter in the current interface access request is obtained and the associated interface of the current interface is determined. Then, the first access interface parameter in the current interface access request is matched with the second access interface parameter corresponding to the associated interface in each access request in the reference time period. Based on the matching situation, unauthorized access detection is performed, which makes up for the misjudgment caused by detection based solely on sequence matching and further improves the detection accuracy.

[0105] In one embodiment, if the first access interface parameters and the second access interface parameters match, the unauthorized access detection result of the terminal can be determined as non-unauthorized access.

[0106] Based on the above embodiments, although the current access sequence does not match the reference access sequence, after further determining the matching situation of the first access interface parameters and the second access interface parameters, it can be seen that the first access interface parameters belong to the response dataset of the associated interface. This indicates that although the terminal's access logic is different from other trusted terminals of the target server, it is not an unauthorized access.

[0107] For example, the employee corresponding to terminal M pays close attention to their personal attendance information, so they add attendance details to the frequently used items in the enterprise's internal management platform. Therefore, when terminal M accesses resources related to attendance in the enterprise's internal management platform, the access requests initiated in sequence are "Login → View Attendance Details". However, other employees in the same enterprise do not pay attention to attendance details, so they have not added them to their frequently used items. Therefore, when these employees access resources related to attendance through their terminals, the more frequent access request sequence is "Login → View Personal Center → View Attendance Details". In this case, the current access sequence does not match the reference access sequence. Furthermore, by comparing the first access request parameters with the second access request parameters, and obtaining a match between the first access interface parameters and the second access interface parameters, it can be determined that terminal M's access is not unauthorized.

[0108] In one embodiment, if the first access interface parameters and the second access interface parameters do not match, the unauthorized access detection result of the terminal can be determined as unauthorized access.

[0109] Based on the above embodiments, the current access sequence does not match the reference access sequence, and the current access sequence is determined to be an undetermined sequence. However, after further determining the matching situation of the first access interface parameters and the second access interface parameters, it can be seen that the first access interface parameters do not belong to the response dataset of the associated interface, which indicates that the terminal is likely to attempt unauthorized access.

[0110] For example, terminal N initiates access requests sequentially as "Login → View Attendance Details". However, other employees in the company do not pay attention to attendance details and therefore have not added them to their frequently used items. Therefore, when these employees access resources related to attendance through their terminals, the most frequent access request sequence is "Login → View Personal Center → View Attendance Details". In this case, the current access sequence does not match the reference access sequence. Furthermore, parsing the parameters of the current interface request initiated by terminal N reveals that the first access parameter is 567. However, within the reference time period, the response parameters of the associated interface do not include 567, indicating that terminal N is attempting unauthorized access. Therefore, the unauthorized access detection result of terminal N can be determined as unauthorized access.

[0111] Based on the above embodiments, if the unauthorized access detection result of the terminal is unauthorized access, an interception signal corresponding to the terminal can be generated and sent to the edge gateway.

[0112] Optionally, if the terminal's unauthorized access detection result is unauthorized access, the terminal can be marked as an untrusted terminal and added to the blacklist. The interception signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server within a future time period.

[0113] Optionally, the intercepted signal may include the specific time of the future period, the ID of the untrusted terminal, the type of the intercepted access request, etc.

[0114] In one embodiment, the edge gateway can generate an alarm message based on the interception signal and send it to the target server to alert the target server that the terminal is attempting to access the network without authorization.

[0115] After determining that the terminal's unauthorized access is unauthorized, the aforementioned method sends a generated interception signal to the edge gateway, thereby intercepting the edge gateway from forwarding the access request initiated by this terminal to the target server. Therefore, it can intercept the terminal's unauthorized access attempt before the access request reaches the target server, suppressing the risk of information leakage from the target server. This solves the technical problem that related technologies cannot prevent unauthorized access by checking the terminal after it has occurred, thus improving the real-time performance and accuracy of unauthorized access detection.

[0116] Based on the above embodiments, in one embodiment, such as Figure 4 As shown, the reference access sequence can be determined according to the following S401~S404. Wherein:

[0117] S401: Obtain historical access requests to the target server initiated by at least two terminals within a historical time period.

[0118] In one embodiment, based on the access logs generated by the edge gateway, historical access requests initiated by multiple terminals within a historical time period and their related information can be obtained as samples. To ensure the validity and quality of the samples, the samples are preprocessed, for example, invalid historical access requests are removed, and duplicates of the same historical access requests from the same terminal within a short period of time are deduplicated.

[0119] Optionally, to improve processing efficiency and reduce computational load, an identifier corresponding to the historical access request can be generated based on the type of historical access request in the preprocessed sample.

[0120] Table 1 shows several different types of historical access requests initiated by the same terminal and their identifiers.

[0121] Table 1

[0122]

[0123] As shown in Table 1, the type of each historical access request can be determined based on the different URLs of each historical access request. For example, an HTML historical access request can be represented as type a, and an API historical access request can be represented as type b. The identifier of each historical access request consists of a letter representing the type and a number representing the access resource level, and the larger the number, the higher the access resource level.

[0124] For example, the historical access request of the above-mentioned identifier a1 may represent an access request corresponding to accessing the login page, and the historical access request of the above-mentioned identifier a2 may represent an access request corresponding to accessing the resource list, where the resource level of the resource list is higher than the resource level of the login page.

[0125] S402, for each terminal, determine the first historical access sequence corresponding to the terminal based on the initiation time of each historical access request initiated by the terminal within a preset time period.

[0126] Optionally, to ensure comparability between the reference access sequence and the current access sequence, the length of the preset time period can be equal to the length of the current time period. Meanwhile, to avoid inconsistent occurrence frequencies due to varying lengths of the obtained first historical access sequences, the number of historical access requests in each first historical access sequence can be set to no more than a preset maximum value. Specifically, the maximum number of historical access requests in each first historical access sequence can be set to 3.

[0127] In one embodiment, for each terminal, an initial first historical access sequence can be obtained by sorting all historical access requests initiated within a preset time period in chronological order. If the number of historical access requests included in the initial first historical access sequence does not exceed a preset maximum value, the initial first historical access sequence can be directly used as the first historical access sequence. However, if the number of historical access requests included in the initial first historical access sequence exceeds the preset maximum value, the sequence length of the initial first historical access sequence can be shortened using a constructed sliding window.

[0128] For example, the initial first historical access sequence [a1, b2, a2, a3, b1] includes 5 historical access requests, while the preset maximum value is 3. This means the number of historical access requests in the initial first historical access sequence exceeds the preset maximum value. In this case, a sliding window of size 3 and a sliding step of 1 can be constructed. Starting from the first historical access request in the first historical access sequence, the window slides sequentially until all historical access requests are covered. Specifically, when the sliding window is not moving, it covers (a1, b2, a2); when the sliding window moves for the first time, it covers (b2, a2, a3); and when the sliding window moves for the second time, it covers (a2, a3, b1). That is, the sliding window moves a total of 2 times to cover each historical access request at least once. Based on this, the request actions performed in the initial first historical access sequence covered by the sliding window each time it moves are marked to generate a sequence segment.

[0129] Therefore, the initial first historical access sequence can be shortened to a first historical subsequence consisting of three sequence segments, and the first historical subsequence can satisfy the preset maximum value.

[0130] It should be noted that the size, number of moves, and step size of the sliding window can be determined based on the preset maximum value and the number of historical access requests in the initial first historical access sequence, and this application does not impose any limitations on them.

[0131] S403, for each first historical access sequence, determine each target subsequence corresponding to the first historical access sequence to obtain each second historical access sequence.

[0132] Each target subsequence includes a predetermined number of historical access requests from the first historical access sequence, sorted by initiation time. The predetermined number limits the number of historical access requests included in the target subsequence to a minimum of 1, preventing the occurrence of blank sequences from affecting the frequency statistics of each second historical access sequence.

[0133] In one embodiment, for each first historical access sequence, one or more historical access requests with the highest frequency can be selected from each first historical access sequence as prefixes of the second historical access sequence. Target subsequences are determined from the subsequences corresponding to each first historical access sequence, and the first historical access request in the target subsequence is the selected prefix. Thus, each target subsequence corresponds to a second historical access sequence.

[0134] Optionally, each first historical access sequence can be input into the Prefixspan (prefix projection pattern mining) algorithm for mining to obtain each second historical access sequence.

[0135] Specifically, the input to the Prefixspan algorithm can be {S, α, β, P}. Here, S represents each first historical access sequence, α represents the threshold, β represents the minimum number of historical access requests included in the second historical access sequence within a predetermined number, and P represents the prefix of each target subsequence.

[0136] Based on this, the algorithm can count the occurrence frequency of each first historical access sequence and each second historical access sequence, and output the first historical access sequence and the second historical access sequence whose occurrence frequency is higher than the threshold.

[0137] S404, the historical access sequence whose frequency meets the threshold in each first historical access sequence and each second historical access sequence is determined as the reference access sequence.

[0138] In one embodiment, the first historical access sequence and the second historical access sequence, which have a frequency that meets the threshold, can represent the access logic frequently initiated by each terminal within a historical period. The first historical access sequence and / or the second historical access sequence corresponding to these frequently initiated access logics are determined as reference access sequences and compared with the current access sequence obtained in real time during the detection process to determine the unauthorized access detection result of the terminal that initiated the current access sequence.

[0139] The above method for determining the reference access sequence, based on the first historical access sequence, obtains a second historical access subsequence including a preset number of historical access requests in the first historical access sequence sorted by initiation time. The occurrence frequency of each first historical subsequence and each second historical access subsequence is statistically analyzed to determine the first historical access sequence and the second historical access sequence whose occurrence frequency meets the threshold as the reference access sequence, providing a sufficient basis for comparison in the subsequent terminal unauthorized access detection process.

[0140] Figure 5 This is a flowchart illustrating an unauthorized access detection method in another embodiment. Based on the above embodiments, this embodiment provides an optional example of an unauthorized access detection method. (Combined with...) Figure 5 The specific implementation process is as follows:

[0141] S501: Obtain access requests to the target server initiated by the terminal within the current time period.

[0142] S502, based on the initiation time of each access request, sort the access requests within the current time period to obtain the current access sequence.

[0143] S503, if the obtained comparison result indicates that the current access sequence does not match the reference access sequence, select the current interface access request from the current access sequence and obtain the first access interface parameter in the current interface access request.

[0144] S504: Determine the associated interface of the current interface based on the current interface access request.

[0145] S505, determine the second access interface parameter in the historical interface access request corresponding to the associated interface in each access request within the comparison period.

[0146] S506, if the first access interface parameters and the second access interface parameters match, determine that the terminal's unauthorized access detection result is non-unauthorized access.

[0147] S507, if the first access interface parameters and the second access interface parameters do not match, determine that the terminal's unauthorized access detection result is unauthorized access.

[0148] S508 generates an interception signal corresponding to the terminal and sends the interception signal to the edge gateway; wherein, the interception signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server in the future period.

[0149] S509, if the current access sequence matches the reference access sequence, determine that the terminal's unauthorized access detection result is non-unauthorized access.

[0150] The specific processes of S501-S509 described above can be found in the description of the above method embodiments. Their implementation principles and technical effects are similar, and will not be repeated here.

[0151] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0152] Based on the same inventive concept, this application also provides an unauthorized access detection device for implementing the unauthorized access detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the unauthorized access detection device provided below can be found in the limitations of the unauthorized access detection method described above, and will not be repeated here.

[0153] In one exemplary embodiment, such as Figure 6 As shown, an unauthorized access detection device 600 is provided, including: an acquisition module 610, a sorting module 620, a comparison module 630, and a determination module 640, wherein:

[0154] The acquisition module 610 is used to acquire access requests initiated by the terminal to the target server within the current time period;

[0155] The sorting module 620 is used to sort the access requests within the current time period according to the initiation time of each access request, so as to obtain the current access sequence.

[0156] The comparison module 630 is used to compare the current access sequence with the reference access sequence; wherein, the reference access sequence is a historical access sequence that appears with a frequency that meets a threshold within a historical time period;

[0157] The determination module 640 is used to determine the unauthorized access detection result of the terminal based on the first access interface parameter corresponding to the current access sequence and the second access interface parameter corresponding to each access request in the reference time period when the obtained comparison result indicates that the current access sequence does not match the reference access sequence; wherein, the reference time period is the time period before the current time period.

[0158] In one embodiment, the determining module 640 includes:

[0159] The first acquisition submodule is used to select the current interface access request from the current access sequence and obtain the first access interface parameter in the current interface access request;

[0160] The first determination submodule is used to determine the associated interface of the current interface based on the current interface corresponding to the current interface access request;

[0161] The second determination submodule is used to determine the second access interface parameter in the historical interface access request corresponding to the associated interface in each access request within the comparison period;

[0162] The third determining submodule is used to determine the unauthorized access detection result of the terminal based on the matching between the first access interface parameters and the second access interface parameters.

[0163] In one embodiment, the third determining submodule includes:

[0164] The first determining unit is used to determine that the terminal's unauthorized access detection result is non-unauthorized access when the first access interface parameters and the second access interface parameters match.

[0165] The second determining unit is used to determine that the terminal's unauthorized access detection result is unauthorized access when the first access interface parameters and the second access interface parameters do not match.

[0166] The third determining unit is used to generate an interception signal corresponding to the terminal when the unauthorized access detection result of the terminal is unauthorized access, and send the interception signal to the edge gateway; wherein, the interception signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server in the future period.

[0167] In one embodiment, the comparison module 630 includes:

[0168] The second acquisition submodule is used to acquire historical access requests to the target server initiated by at least two terminals within a historical time period.

[0169] The fourth determination submodule is used to determine the first historical access sequence corresponding to each terminal based on the initiation time of each historical access request initiated by the terminal within a preset time period; wherein, the preset time period is a time period within the historical time period with the same length as the current time period;

[0170] The fifth determining submodule is used to determine each target subsequence corresponding to each first historical access sequence in order to obtain each second historical access sequence; wherein each target subsequence includes a preset number of historical access requests in the first historical access sequence sorted by initiation time;

[0171] The sixth determination submodule is used to determine the historical access sequence whose frequency meets the threshold in each first historical access sequence and each second historical access sequence as the reference access sequence.

[0172] In one embodiment, the above-mentioned unauthorized access detection device further includes:

[0173] The detection module is used to determine whether the terminal's unauthorized access detection result is non-unauthorized access when the current access sequence matches the reference access sequence.

[0174] Each module in the aforementioned unauthorized access detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0175] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores access request data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an unauthorized access detection method.

[0176] Those skilled in the art will understand that Figure 7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0177] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0178] Get the access requests initiated by the terminal to the target server within the current time period;

[0179] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0180] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0181] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0182] In one embodiment, when the processor executes the computer program, it further performs the following steps: selecting a current interface access request from the current access sequence and obtaining a first access interface parameter from the current interface access request; determining the associated interface of the current interface based on the current interface corresponding to the current interface access request; determining a second access interface parameter from the historical interface access requests corresponding to the associated interface in each access request within the comparison period; and determining the unauthorized access detection result of the terminal based on the matching between the first access interface parameter and the second access interface parameter.

[0183] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the first access interface parameter and the second access interface parameter match, it determines that the unauthorized access detection result of the terminal is non-unauthorized access; if the first access interface parameter and the second access interface parameter do not match, it determines that the unauthorized access detection result of the terminal is unauthorized access.

[0184] In one embodiment, when the processor executes the computer program, it further performs the following steps: generating an intercept signal corresponding to the terminal and sending the intercept signal to the edge gateway; wherein the intercept signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server in the future.

[0185] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring historical access requests to the target server initiated by at least two terminals within a historical time period; for each terminal, determining a first historical access sequence corresponding to the terminal based on the initiation time of each historical access request initiated by the terminal within a preset time period; wherein, the preset time period is a time period within the historical time period with the same length as the current time period; for each first historical access sequence, determining each target subsequence corresponding to the first historical access sequence to obtain each second historical access sequence; wherein, each target subsequence includes a preset number of historical access requests in the first historical access sequence sorted by initiation time; and determining the historical access sequence in each first historical access sequence and each second historical access sequence whose frequency of occurrence meets a threshold as a reference access sequence.

[0186] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the current access sequence matches the reference access sequence, it determines that the unauthorized access detection result of the terminal is a non-unauthorized access.

[0187] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0188] Get the access requests initiated by the terminal to the target server within the current time period;

[0189] Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence;

[0190] Compare the current access sequence with the reference access sequence; the reference access sequence is a historical access sequence that occurs within a historical period and meets the frequency threshold.

[0191] If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

[0192] In one embodiment, when the processor executes the computer program, it further performs the following steps: selecting a current interface access request from the current access sequence and obtaining a first access interface parameter from the current interface access request; determining the associated interface of the current interface based on the current interface corresponding to the current interface access request; determining a second access interface parameter from the historical interface access requests corresponding to the associated interface in each access request within the comparison period; and determining the unauthorized access detection result of the terminal based on the matching between the first access interface parameter and the second access interface parameter.

[0193] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the first access interface parameter and the second access interface parameter match, it determines that the unauthorized access detection result of the terminal is non-unauthorized access; if the first access interface parameter and the second access interface parameter do not match, it determines that the unauthorized access detection result of the terminal is unauthorized access.

[0194] In one embodiment, when the processor executes the computer program, it further performs the following steps: generating an intercept signal corresponding to the terminal and sending the intercept signal to the edge gateway; wherein the intercept signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server in the future.

[0195] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring historical access requests to the target server initiated by at least two terminals within a historical time period; for each terminal, determining a first historical access sequence corresponding to the terminal based on the initiation time of each historical access request initiated by the terminal within a preset time period; wherein, the preset time period is a time period within the historical time period with the same length as the current time period; for each first historical access sequence, determining each target subsequence corresponding to the first historical access sequence to obtain each second historical access sequence; wherein, each target subsequence includes a preset number of historical access requests in the first historical access sequence sorted by initiation time; and determining the historical access sequence in each first historical access sequence and each second historical access sequence whose frequency of occurrence meets a threshold as a reference access sequence.

[0196] In one embodiment, when the processor executes the computer program, it further performs the following steps: if the current access sequence matches the reference access sequence, it determines that the unauthorized access detection result of the terminal is a non-unauthorized access.

[0197] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0198] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0199] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0200] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0201] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting unauthorized access, characterized in that, Applied to a detection end, which is associated with an edge gateway, the method includes: Get the access requests initiated by the terminal to the target server within the current time period; Based on the initiation time of each access request, the access requests within the current time period are sorted to obtain the current access sequence; Compare the current access sequence with the reference access sequence; wherein, the reference access sequence is a historical access sequence that occurs with a frequency that meets a threshold within a historical time period; If the comparison results indicate that the current access sequence does not match the reference access sequence, the unauthorized access detection result of the terminal is determined based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period; wherein, the reference time period is the time period before the current time period.

2. The method according to claim 1, characterized in that, The step of determining the unauthorized access detection result of the terminal based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request within the comparison time period includes: Select the current interface access request from the current access sequence, and obtain the first access interface parameter from the current interface access request; Based on the current interface corresponding to the current interface access request, determine the associated interface of the current interface; Determine the second access interface parameter in the historical interface access request corresponding to the associated interface in each access request within the comparison period; The unauthorized access detection result of the terminal is determined based on the matching between the first access interface parameters and the second access interface parameters.

3. The method according to claim 2, characterized in that, Determining the unauthorized access detection result of the terminal based on the matching between the first access interface parameters and the second access interface parameters includes: If the first access interface parameters and the second access interface parameters match, the unauthorized access detection result of the terminal is determined to be non-unauthorized access; If the first access interface parameters and the second access interface parameters do not match, the unauthorized access detection result of the terminal is determined to be unauthorized access.

4. The method according to claim 3, characterized in that, If the unauthorized access detection result of the terminal is unauthorized access, the method further includes: Generate an interception signal corresponding to the terminal and send the interception signal to the edge gateway; The interception signal is used to instruct the edge gateway to prohibit sending access requests initiated by the terminal to the target server to the target server within a future time period.

5. The method according to any one of claims 1-4, characterized in that, The reference access sequence is determined in the following manner: Obtain historical access requests to the target server initiated by at least two terminals within the historical time period; For each terminal, a first historical access sequence corresponding to the terminal is determined based on the initiation time of each historical access request initiated by the terminal within a preset time period; wherein, the preset time period is a time period within the historical time period that has the same length as the current time period; For each first historical access sequence, each target subsequence corresponding to the first historical access sequence is determined to obtain each second historical access sequence; wherein, each target subsequence includes a preset number of historical access requests in the first historical access sequence sorted according to the initiation time; The historical access sequence whose frequency in each of the first historical access sequence and each of the second historical access sequences meets the threshold is determined as the reference access sequence.

6. The method according to any one of claims 1-4, characterized in that, The method further includes: If the current access sequence matches the reference access sequence, the unauthorized access detection result of the terminal is determined to be non-unauthorized access.

7. An unauthorized access detection device, characterized in that, Configured in the detection terminal, which is associated with the edge gateway, the device includes: The acquisition module is used to acquire access requests initiated by the terminal to the target server within the current time period; The sorting module is used to sort the access requests within the current time period according to the initiation time of each access request, so as to obtain the current access sequence. The comparison module is used to compare the current access sequence with a reference access sequence; wherein, the reference access sequence is a historical access sequence whose frequency within a historical period meets a threshold. The determining module is used to determine the unauthorized access detection result of the terminal based on the first access interface parameters corresponding to the current access sequence and the second access interface parameters corresponding to each access request in the reference time period when the obtained comparison result indicates that the current access sequence does not match the reference access sequence; wherein, the reference time period is the time period before the current time period.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1-6.

9. A readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

10. A program product comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-6.

Images