Unauthorized detection method and device

Abstract

The invention provides an unauthorized detection method and device. The method comprises the following steps: acquiring a target request received by an unauthorized detection target; obtaining a target user unique identifier, a target request operation type, a target access resource path and a target path parameter from the target request; a target permission tree corresponding to the target user unique identifier is searched from a permission tree set, the permission tree set comprises permission trees corresponding to a plurality of different user unique identifiers, and each permission tree comprises the user unique identifier and a request operation type, an access resource path and a path parameter in a historical successful access request of the user unique identifier; matching the target request operation type, the target access resource path and the target path parameter with the request operation type, the access resource path and the path parameter in the target permission tree; and if the matching fails, determining that the target request is visited unauthorized. And the accuracy of unauthorized detection is integrally and effectively improved.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to an unauthorized access detection method, an unauthorized access detection device, a computer device, a computer-readable storage medium, and a computer program product. Background Technology

[0002] Unauthorized access detection is an information security technology designed to identify and prevent users from accessing or operating system resources, data, or functions that they are not authorized to use.

[0003] Currently, unauthorized access detection primarily employs static rules. Specifically, a set of static rules is first constructed to allow or disallow access. For example: allowing user A to access resource 1. Another example: allowing user B to access resource 2. Yet another example: disallowing user C to access resource 1. Then, when a user accesses a resource, that user generates a request to access the corresponding resource. Next, the unauthorized access detection engine intercepts this request and matches the user and the resource being accessed against the static rules. For example, the request reveals that user A accesses resource 2. However, in the static rules, user A can only access resource 1, and resource 2 can only be accessed by user B. Therefore, it can be determined that user A's access to resource 2 is not allowed, thus determining that user A is accessing it unauthorizedly, and ultimately denying user A's request to access resource 2.

[0004] However, if a user modifies the user identification information in their request—for example, changing the original Internet Protocol (IP) address of user 'a' to the IP address of user 'b'—then the privilege escalation detection engine will perceive the request as indicating that user 'b' is accessing resource 2. The static rules may include allowing user 'b' to access resource 2. The privilege escalation detection engine will then allow the request, enabling user 'a' to access resource 2. In reality, resource 2 does not allow user 'a' to access it. This reduces the accuracy of privilege escalation detection. Summary of the Invention

[0005] The purpose of this application is to provide an unauthorized access detection method, an unauthorized access detection device, a computer device, a computer-readable storage medium, and a computer program product to improve the accuracy of unauthorized access detection.

[0006] To address the aforementioned technical problems, this application provides the following technical solutions: The first aspect of this application provides an unauthorized access detection method, the method comprising: obtaining a target request received by the unauthorized access detection target; obtaining a target user unique identifier, a target request operation type, a target access resource path, and target path parameters from the target request; searching for a target permission tree corresponding to the target user unique identifier from a permission tree set, wherein the permission tree set includes multiple permission trees corresponding to different user unique identifiers, each permission tree including the user unique identifier and the request operation type, access resource path, and path parameters from its historically successfully accessed requests; matching the target request operation type, target access resource path, and target path parameters with the request operation type, access resource path, and path parameters in the target permission tree; if the matching fails, determining that the target request is unauthorized access.

[0007] Compared to existing technologies, the unauthorized access detection method provided in the first aspect of this application establishes a permission tree for each user based on their unique identifier. The permission tree records the request operation types, access resource paths, and path parameters of the user's past successful accesses. For a target request, the user's corresponding permission tree is located by identifying the unique identifier in the request, and the target request is matched against the request operation type, access resource path, and path parameters in the permission tree. If the match is inconsistent, it indicates that the specific content of the user's current request does not match their historical behavior, potentially indicating unauthorized access. This method uses the user's unique identifier, which is more difficult to tamper with, instead of the easily tampered source IP address, reducing the probability of successful tampering of the identifier information. Furthermore, by combining the request operation types, access resource paths, and path parameters of the user's past successful requests, a detailed judgment of the user's current request behavior can be made, effectively improving the overall accuracy of unauthorized access detection.

[0008] In other embodiments provided in this application, each permission tree also includes response data features; the method further includes: obtaining a target response based on a target request; obtaining target response data features from the target response; matching the target response data features with response data features in the target permission tree; if the matching fails, intercepting the target response.

[0009] By re-examining the target response to the target request, we can perform unauthorized access detection from another dimension beyond the request itself, which can further improve the accuracy of unauthorized access detection.

[0010] In other embodiments provided in this application, the response data features include a set of response fields; obtaining target response data features from the target response includes: obtaining the set of target response fields from the target response; matching the target response data features with the response data features in the target permission tree includes: matching the set of target response fields with the set of response fields in the target permission tree.

[0011] By analyzing the response fields, the ultimate purpose of the request can be clearly obtained, thus enabling fast and accurate detection of unauthorized access.

[0012] In other embodiments provided in this application, the response data features include resource data sensitivity levels; obtaining target response data features from the target response includes: obtaining target resource data sensitivity levels from the target response; matching the target response data features with response data features in the target permission tree includes: determining whether the target resource data sensitivity level is higher than the resource data sensitivity level in the target permission tree; if yes, then determining that the target response data features match the response data features in the target permission tree; if no, then determining that the target response data features do not match the response data features in the target permission tree.

[0013] By analyzing the sensitivity level of the resource data in response, we can determine the sensitivity of the data being acquired this time and match it with the sensitivity level of previously acquired data. This allows us to quickly detect abnormal data acquisition, thus balancing the efficiency and accuracy of unauthorized access detection.

[0014] In other embodiments provided in this application, before obtaining the target request received by the unauthorized access detection target, the method further includes: obtaining multiple requests that have passed the unauthorized access detection based on static unauthorized access detection rules since the unauthorized access detection target was put into use; extracting the user unique identifier of each request; aggregating requests with the same user unique identifier to obtain multiple user unique identifiers and their corresponding request sets; classifying the requests in the request set corresponding to each user unique identifier according to the condition that the five-tuple information is the same to obtain the request group corresponding to each five-tuple information; extracting the request operation type, access resource path and path parameters from the request group corresponding to each five-tuple information; generating a corresponding permission tree based on each user unique identifier and the request operation type, access resource path and path parameters corresponding to each five-tuple information, and obtaining a permission tree set.

[0015] Based on static privilege escalation detection rules, some normal requests are obtained, and then the requests are distinguished according to the user's unique identifier. The request operation type, access resource path and path parameters are extracted by using a five-tuple as a distinguishing factor. This enables the correct storage of each access feature in each user's permission tree, thereby improving the accuracy of permission tree construction.

[0016] In other embodiments provided in this application, before determining whether the target request has exceeded its authority, the method further includes: outputting verification information on whether the target request has exceeded its authority; obtaining response information based on the verification information; if the response information indicates that the target request has not exceeded its authority, then adding the target request operation type, the target access resource path, and the target path parameter in the target request to the target permission tree.

[0017] After an error occurs in the privilege escalation detection, the request operation type, access resource path, and path parameters of the misjudged request are promptly added to the corresponding user's permission tree. This enables dynamic updates to the permission tree and continuously improves the accuracy of privilege escalation detection during the process.

[0018] In other embodiments provided in this application, after adding the target request operation type, target access resource path, and target path parameters from the target request to the target permission tree, the method further includes: inputting the existing request operation type, access resource path, and path parameter corresponding to the request and allowed access label from the target permission tree into the target model to obtain a new target permission tree output by the target model, wherein the new target permission tree includes a unique user identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities; or, inputting the target request and the request operation types, access resource paths, and path parameters corresponding to the requests and allowed access labels from other permission trees in the permission tree set (excluding the target permission tree) into the target model to obtain a new other permission tree output by the target model, wherein the new other permission tree includes a unique user identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities, and the target model is a pre-trained, tree-structured, interpretable supervised learning model.

[0019] The request operation types, access resource paths, and path parameters in the permission tree can be continuously optimized and updated through model learning. This not only updates the permission tree for the current user but also for other users, achieving automated, correlated updates of the permission tree and effectively reducing the false positive rate of unauthorized access detection.

[0020] A second aspect of this application provides an unauthorized access detection device, comprising: a first acquisition module for acquiring a target request received by the unauthorized access detection target; a second acquisition module for acquiring a target user unique identifier, a target request operation type, a target access resource path, and target path parameters from the target request; a search module for searching a target permission tree corresponding to the target user unique identifier from a permission tree set, wherein the permission tree set includes multiple permission trees corresponding to different user unique identifiers, and each permission tree includes the user unique identifier and the request operation type, access resource path, and path parameters from its historically successfully accessed requests; a matching module for matching the target request operation type, target access resource path, and target path parameters with the request operation type, access resource path, and path parameters in the target permission tree; if the matching fails, the process proceeds to an authentication module; the authentication module is used to determine that the target request is unauthorized access.

[0021] A third aspect of this application provides a computer device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method of the first aspect.

[0022] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of the first aspect.

[0023] The fifth aspect of this application provides a computer program product, including a computer program that, when executed by a processor, implements the method of the first aspect.

[0024] The unauthorized access detection device provided in the second aspect of this application, the computer equipment provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect have the same or similar beneficial effects as the unauthorized access detection method provided in the first aspect. Attached Figure Description

[0025] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of this application are illustrated by way of example and not limitation, with the same or corresponding reference numerals denoteing the same or corresponding parts, wherein: Figure 1 This is a flowchart illustrating the unauthorized access detection method in the embodiments of this application. Figure 1 ; Figure 2 This is a flowchart illustrating the unauthorized access detection method in the embodiments of this application. Figure 2 ; Figure 3 This is a schematic diagram of the unauthorized access detection device in the embodiments of this application. Figure 1 ; Figure 4 This is a schematic diagram of the unauthorized access detection device in the embodiments of this application. Figure 2 ; Figure 5 This is a schematic diagram of the structure of the computer device in the embodiments of this application. Detailed Implementation

[0026] Exemplary embodiments of this application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of this application are shown in the drawings, it should be understood that this application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0027] It should be noted that, unless otherwise stated, the technical or scientific terms used in this application shall have the ordinary meaning as understood by one of ordinary skill in the art to which this application pertains.

[0028] Currently, privilege escalation detection primarily relies on static rules, such as checking if the source IP address in a request has permission to access the destination IP address. However, the IP address in a request is easily tampered with. An attacker can modify a source IP address with no access rights to a source IP address with access rights. In this case, the privilege escalation detection engine will consider the request not to be unauthorized and allow it to proceed. In reality, the request is a tampered, unauthorized request. This reduces the accuracy of privilege escalation detection.

[0029] In view of this, embodiments of this application provide an unauthorized access detection method, device, computer equipment, computer-readable storage medium, and computer program product. Instead of detecting unauthorized access based on the IP address in the request, it constructs a permission tree for each user based on their unique user identifier. The permission tree includes the user's unique identifier and the request operation type, access resource path, and path parameters from previously successfully accessed requests. Thus, upon intercepting a user request, the user's unique identifier is obtained from the request, and then the user's permission tree is located using that identifier. The user's request is then matched against the request operation type, access resource path, and path parameters in the permission tree to determine if the current user's access behavior is abnormal compared to previously successful access behaviors. If an anomaly is determined, the request is deemed unauthorized, and interception is achieved. Since the user's unique identifier is less susceptible to successful tampering than an IP address, and the request operation type, access resource path, and path parameters can refine the user's access behavior, effective and accurate unauthorized access detection is achieved.

[0030] It should be noted that all components, data, and related processing methods involved in this application are authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0031] First, the unauthorized access detection method provided in the embodiments of this application will be described in detail.

[0032] Figure 1 This is a flowchart illustrating the unauthorized access detection method in the embodiments of this application. Figure 1 See Figure 1 As shown, the method may include: S11: Obtain the target request received by the unauthorized detection target.

[0033] Unauthorized access detection targets refer to entities that require unauthorized access detection, such as a server, all servers of a company, a terminal device, or a database. The specific types and scope of unauthorized access detection targets are not limited here.

[0034] The reason for the need for privilege escalation detection targets is that they exist in scenarios where data is received. Attackers typically request data from these targets to obtain data they shouldn't have access to. Therefore, it's necessary to obtain the requests received by the privilege escalation detection targets—the target requests—and then perform detection on these target requests to achieve privilege escalation detection against the targets.

[0035] To obtain the target request, a mirroring tool can be set up at the data receiving interface of the unauthorized access detection target. This tool mirrors all requests received by the unauthorized access detection target, thus obtaining the target request. In this way, unauthorized access detection is achieved without affecting the normal operation of the business processes within the unauthorized access detection target.

[0036] To obtain the target request, an interception tool can be set up at the data receiving interface of the unauthorized access detection target. This tool intercepts all requests received by the unauthorized access detection target, thus obtaining the target request. This prevents unauthorized requests from entering the unauthorized access detection target, thereby preventing unknown risks from these requests from entering the target and improving the security of information within the unauthorized access detection target.

[0037] S12: Obtain the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request.

[0038] The target user's unique identifier is the unique identifier of the user obtained from the target request. A user's unique identifier refers to a data segment or combination that can uniquely and persistently associate with a specific user identity or access instance within a system or application session. In practical applications, the user's unique identifier can be a session identifier, token, device fingerprint, browser fingerprint, network identifier, in-application identifier, etc.

[0039] When obtaining a user's unique identifier, you can parse the request headers to retrieve the Session ID / Token from the Cookie, the Token from the Authorization header, the User-Agent, and so on. You can also parse the request body to retrieve the Token / ID from the URL parameters, the credentials from the POST request body, and so on. The specific method for obtaining the user's unique identifier depends on the request and the specific type of the user's unique identifier, and can be obtained using appropriate standard data parsing and retrieval methods.

[0040] The target request operation type refers to the type of request operation obtained from the target request. The request operation type indicates the kind of operation the client expects the server to perform on the resource, clearly expressing the intent of the request (e.g., retrieve, create, modify, or delete). In the Hypertext Transfer Protocol (HTTP), this is primarily represented by HTTPMethods. Request operation types can include: GET, POST, PUT, PATCH, DELETE, HEAD, etc.

[0041] Since the request action type is part of the start line of an HTTP request, it can be directly obtained from the first line of the message for HTTP requests. For other types of requests, the action type can be obtained from the specific location within the request where it is required to be written.

[0042] The target access resource path refers to the portion of a Uniform Resource Locator (URL) used to uniquely identify a resource or a class of resources. It does not contain protocols, domain names, ports, or query parameters; it purely represents the hierarchical location of the resource. For example, for a complete URL: https: / / api.example.com / v1 / users / 12345 / orders?status=completed&page=2, the access resource path is / v1 / users / 12345 / orders.

[0043] When obtaining the path to an accessed resource, you can reconstruct the complete URL from the Request-URI field in the HTTP request line or from information such as the Host header. Then, use a regular URL parsing tool to extract the resource path from the URL. For other types of requests, you can use the appropriate URL parsing tool.

[0044] The target path parameter refers to the variable portion embedded in the resource path, used to specify a specific resource instance. For example, given a path template: / api / v1 / users / {user_id} / orders / {order_id}, when the request path is / api / v1 / users / 1001 / orders / 2002, the value of the path parameter user_id is 1001, and the value of the path parameter order_id is 2002. This allows the request to be precisely located to the specific resource of order ID 2002 for user ID 1001.

[0045] Because path parameters are tightly bound to the routing rules defined by the web server, their extraction must be performed after the route matching process. Typically, after a route is matched, the path parameters are stored in a dictionary-like structure. Therefore, the path parameters for the current request can be obtained by accessing the web framework's routing context or request object.

[0046] S13: Find the target permission tree corresponding to the unique identifier of the target user from the permission tree set.

[0047] The permission tree set includes multiple permission trees corresponding to different user unique identifiers. Each permission tree includes the user's unique identifier and the request operation type, access resource path, and path parameters from their historical successfully accessed requests.

[0048] When constructing the permission tree for each user, all requests previously allowed by the target of the unauthorized access detection are retrieved. Then, the user's unique identifier, request operation type, access resource path, and path parameters are extracted from each request. The request operation types, access resource paths, and path parameters corresponding to the same user's unique identifier are then used as the permission tree for that user. In the permission tree, the user's unique identifier serves as the root node, and each request operation type, access resource path, and path parameter is a child node.

[0049] The specific methods for obtaining the request operation type, access resource path, and path parameters from each request have been explained in detail in the previous step and will not be repeated here.

[0050] After obtaining the target user's unique identifier from the target request, since the user's unique identifier can uniquely identify the user, different users correspond to different permission trees, and each permission tree contains its own user's unique identifier, the target user's unique identifier is matched with the user's unique identifiers in each permission tree. The permission tree corresponding to the successfully matched user's unique identifier is the permission tree corresponding to the target requesting user, i.e., the target permission tree.

[0051] If the target user's unique identifier fails to match the unique identifier of the user corresponding to each permission tree, it indicates that the target requesting user is a new user, and no permission tree has been established for them before. In this case, manual privilege escalation analysis can be performed on the target request. If manual analysis confirms that the target request is not privilege escalated, a permission tree for that user can be established based on the target user's unique identifier, request operation type, access resource path, and path parameters in the target request, so that privilege escalation detection can be performed automatically for that user later. If manual analysis confirms that the target request is privilege escalated, the target request needs to be intercepted, and the relevant information of the target request can be added to a privilege escalation blacklist for later querying.

[0052] S14: Match the target request operation type, target access resource path, and target path parameters with the request operation type, access resource path, and path parameters in the target permission tree.

[0053] The target permission tree records the request operation types, access resource paths, and path parameters of the current user's past successful accesses. These represent the user's permitted accesses and their historical access habits. By matching the target request operation type, target access resource path, and target path parameters in the target request with the request operation type, access resource path, and path parameters in the target permission tree, it's possible to determine whether the user's specific access behavior is the same as before, and thus whether the current target request is unauthorized.

[0054] S15: If a match is found, it is determined that the target request did not exceed its authorized access rights.

[0055] A successful match indicates that the specific access behavior of this target request is the same as the user's allowed historical access behavior, and does not constitute unauthorized access. In this case, the target request can be allowed to proceed, enabling the unauthorized access detection target to process the request.

[0056] S16: If a match fails, it is determined that the target request is unauthorized.

[0057] A match failure indicates that the specific access behavior of this target request differs from the user's allowed historical access behavior, and is highly likely to be unauthorized access. In this case, the target request can be determined to be unauthorized access, and thus the target request can be blocked.

[0058] As described above, the unauthorized access detection method provided in this application establishes a permission tree for each user based on their unique identifier. The permission tree records the request operation types, access resource paths, and path parameters of the user's past successful accesses. For a target request, the user's corresponding permission tree is located by identifying the unique identifier in the request, and the target request is matched against the request operation type, access resource path, and path parameters in the permission tree. If the match is inconsistent, it indicates that the specific content of the user's current request does not match their historical behavior, and unauthorized access may exist. Here, instead of using the easily tampered source IP address, the more difficult-to-tamper-with unique user identifier is used, reducing the probability of successful tampering of the identifier information. Furthermore, by combining the request operation types, access resource paths, and path parameters of the user's past successful requests, a detailed judgment of the user's current request behavior can be made, effectively improving the overall accuracy of unauthorized access detection.

[0059] Furthermore, as Figure 1 In a refinement and extension of the method shown, this application also provides an unauthorized access detection method.

[0060] Figure 2 This is a flowchart illustrating the unauthorized access detection method in the embodiments of this application. Figure 2 See Figure 2 As shown, the method may include: S21: Construct a set of permission trees.

[0061] During the initial operation of the privilege escalation detection target, it is necessary to first construct permission trees for different users, i.e., a permission tree set, based on the requests received by the privilege escalation detection target. The requests obtained at this stage can be all requests acquired by the privilege escalation detection target within a preset time period. This preset time period can be a trial operation phase. To minimize the acquisition of privilege escalation requests and thus improve the accuracy of the permission trees, static privilege escalation detection rules can be added to the data interface of the privilege escalation detection target. Only requests that pass the static privilege escalation detection rules can participate in the construction of the permission trees.

[0062] Specifically, step S21 above may include: S21a: Obtain the target of unauthorized access detection from the start of use, based on multiple requests that have passed the static unauthorized access detection rules.

[0063] The static privilege escalation detection rules here are a type of access control policy based on predefined, fixed rules, typically defined based on user roles or static attributes (such as department or level). For example: Role == "Administrator" => Allow access to / api / admin / deleteUser. Another example: Role == "Regular User" => Deny access to / api / admin / deleteUser. Yet another example: User ID == Resource.Owner ID => Allow access to / api / orders / {orderId}. Furthermore, if the request parameters contain userId=0 or admin=true, then the request is blocked. Finally, if the URL path pattern is / api / user / [^ / ]+ / admin / , and the user role is not administrator, then the request is blocked.

[0064] Once the privilege escalation detection target is deployed, users of that target can use it normally. At this point, requests received by the privilege escalation detection target need to be matched against static privilege escalation detection rules. If the match indicates the request is privilege escalated, the privilege escalation detection target will block the request to prevent unauthorized access to data within the target. If the match indicates the request is not privilege escalated, the privilege escalation detection target will not only allow the request but will also provide it for the creation of the permission tree.

[0065] The number of requests that need to be obtained at this point can be determined based on the actual situation, and is not limited here.

[0066] S21b: Extract the unique user identifier for each request.

[0067] The specific method for extracting the user's unique identifier from the request has been described in detail in the foregoing embodiments, and can be found in the relevant descriptions in the foregoing embodiments, which will not be repeated here.

[0068] S21c: Aggregate requests with the same user unique identifier to obtain multiple user unique identifiers and their corresponding request sets.

[0069] Among multiple requests, some are sent by the same user, while others are sent by different users. In this case, it is necessary to divide the requests according to different users in order to generate a more complete permission tree for each user later.

[0070] Since a user's unique identifier can uniquely represent a user, one user's unique identifier is one user. Therefore, requests with the same user's unique identifier are all requests from the corresponding user.

[0071] At this point, each user's unique identifier may correspond to one request or multiple requests (a set of requests). This is determined based on the requests that the user actually sends to the unauthorized access detection target.

[0072] When a user's unique identifier corresponds to a single request, and the request type is HTTP, the request might be missing. In this case, manual querying can be performed to find other missing requests, thus completing the request and improving the completeness of the information in the permission tree. Alternatively, the missing requests can be discarded, and other requests can be retrieved later to supplement the permission tree. This approach improves the efficiency of permission tree construction without significantly affecting its accuracy.

[0073] When a user's unique identifier corresponds to multiple requests (i.e., a request set), some requests may be from the same session, while others may be from different sessions. Access behavior within the same session is consistent, but access behavior across different sessions is inconsistent. To ensure that the access behaviors recorded in the permission tree are not duplicated and are accurate, it is necessary to extract the request operation type, accessed resource path, and path parameters for each request in the request set, on a session-by-session basis.

[0074] S21d: Classify the requests in the request set corresponding to each user's unique identifier according to the condition that the five-tuple information is the same, and obtain the request group corresponding to each five-tuple information.

[0075] In computer networks, a quintuple is a combination of five key elements that uniquely identifies a network connection, much like an "identity card" for network communication. Using quintuple information, the initiator, receiver, and specific service used in a communication can be precisely located.

[0076] The 5-tuple information specifically includes: source IP address, source port number, destination IP address, destination port number, and transport layer protocol.

[0077] Requests with identical 5-tuple information indicate that they belong to the same session and perform the same task. From requests with identical 5-tuple information, we can accurately and uniquely extract the request operation type, access resource path, and path parameters corresponding to the same action.

[0078] S21f: Extract the request operation type, access resource path, and path parameters from the request group corresponding to each quintuple information.

[0079] At this point, each user's unique identifier corresponds to the request operation type, access resource path, and path parameters in different access behaviors. For each user, the unique user identifier serves as the root node, and each child node corresponds to a request operation type, access resource path, and path parameters. This yields the permission tree for each user. The permission trees for all users constitute the set of permission trees.

[0080] S21g: Based on each user's unique identifier and the request operation type, access resource path, and path parameters corresponding to each of its five-tuple information, generate the corresponding permission tree and obtain the permission tree set.

[0081] Next, we can officially begin unauthorized detection of the target.

[0082] S22: Obtain the target request received by the unauthorized detection target.

[0083] S23: Obtain the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request.

[0084] S24: Find the target permission tree corresponding to the unique identifier of the target user from the permission tree set.

[0085] S25: Match the target request operation type, target access resource path, and target path parameters with the request operation type, access resource path, and path parameters in the target permission tree.

[0086] Steps S22-S23 here are implemented in the same way as steps S11-S14 in the previous embodiments, and can be found in the relevant descriptions in the previous embodiments, which will not be repeated here.

[0087] After obtaining the target request, while performing privilege escalation detection on the target request, to improve the accuracy of privilege escalation detection, regardless of whether the target request is found to be privilege-exceeding after detection, the target can be allowed to process the target request and obtain the target response. Then, privilege escalation detection is performed on the target response, and the privilege escalation detection result of the target response is combined to determine whether this access was privilege-exceeding.

[0088] S26: Obtain the target response based on the target request.

[0089] To correctly obtain the response to the target request, i.e., the target response, an identifier can be added to the target request and required to be carried in the response. Different requests carry different identifiers. In this way, even if multiple requests are processed simultaneously and multiple responses are obtained, the target response can be determined by searching for the request with the same identifier in the response.

[0090] Alternatively, the target response to the target request can be determined using the 5-tuple information and the sequence number. Since requests and responses occur sequentially within the same connection, a partial response can be identified by first using the same 5-tuple information, and then the sequence number (sequence number + 1) from the target request can be found within the partial response to determine the target response.

[0091] S27: Obtain target response data features from the target response.

[0092] S28: Match the target response data features with the response data features in the target permission tree.

[0093] The response contains a wealth of information. By comparing the data characteristics in the response with those of historical responses, it's possible to more accurately determine whether the current access was unauthorized. In some cases, a request may appear normal but actually constitutes an unauthorized operation, obtaining unauthorized information. In such situations, examining the response can enable accurate determination of unauthorized access.

[0094] On one hand, response data characteristics can be identified by the fields included in the response data, i.e., the set of response fields. Unauthorized access will obtain additional information, namely, the values ​​of more fields. If the fields in the target response do not match the fields in historical responses, or exceed the fields in historical responses, it indicates that this access is highly likely to be unauthorized.

[0095] It should be noted that when constructing the permission tree, the corresponding response to the request must be obtained, and each field must be extracted from the response. The extracted fields are then stored in the corresponding position after the parameter path of the request.

[0096] Specifically, step S27 above may include: obtaining the target response field set from the target response.

[0097] Step S28 above may include: matching the target response field set with the response field set in the target permission tree.

[0098] In other words, the fields involved in the target response are matched with the fields involved in the response in the target permission tree. If the match is consistent, or the number of fields matched is less than the number of fields matched in the response in the target permission tree, it means that the data in this access response has not exceeded the historical access range, and it is determined that this access has not exceeded the permissions. If the match is inconsistent, that is, there are more fields matched in the response in the target permission tree, it means that the data in this access response has exceeded the historical access range, and it is preliminarily determined that this access has exceeded the permissions, requiring further manual review.

[0099] In practical applications, the response field set can include common response fields such as Server, Set-Cookie, and Content-Type.

[0100] In addition, if the target response set contains some uncommon response fields, or some high-privilege fields, such as enumeration-related fields, and these fields do not appear in the response field set of the target permission tree, then it can also be determined that this access is unauthorized.

[0101] On the other hand, response data characteristics can also be reflected through resource data sensitivity levels. If the resource data sensitivity level in the target response is higher than that in the target permission tree, it indicates that more sensitive data was accessed, and compared to historical behavior, there is a higher probability of unauthorized access. If the resource data sensitivity level in the target response is equal to or lower than that in the target permission tree, it indicates that equally sensitive or less sensitive data was accessed, and compared to historical behavior, there is a higher probability of no unauthorized access.

[0102] The sensitivity level of the resource data here refers to the confidentiality level of the accessed resource data. The higher the level, the more confidential the resource data, and the more restrictions users face when accessing it. "Higher level" can refer to either a lower or higher numerical sequence number. The specific numerical representation of a "higher level" can be determined based on actual needs and is not limited here.

[0103] Specifically, step S27 above may include: obtaining the sensitivity level of target resource data from the target response.

[0104] The response can carry the sensitivity level of the data, allowing direct extraction of the target resource data sensitivity level from the target response. Alternatively, the resource data sensitivity level of the target response can be obtained by mapping the specific location of the data source in the target response to a resource data sensitivity level table.

[0105] Step S28 above may include: determining whether the sensitivity level of the target resource data is higher than the sensitivity level of the resource data in the target permission tree; if yes, determining that the target response data feature matches the response data feature in the target permission tree; if no, determining that the target response data feature does not match the response data feature in the target permission tree.

[0106] If the sensitivity level of the target resource data is higher than the sensitivity level of the resource data in the target permission tree, it means that the permissions of the data being accessed this time are higher than those of previous accesses. In this case, it is necessary to focus on whether there is any unauthorized access. If the sensitivity level of the target resource data is equal to or lower than the sensitivity level of the resource data in the target permission tree, it means that the permissions of the data being accessed this time are the same as those of previous accesses, or lower than those of previous accesses. In this case, it can be determined that the probability of unauthorized access is low.

[0107] The above steps address privilege escalation checks for both the target request and the target response. If both the target request and response determine that privilege escalation is not involved, the current access can be considered legitimate, and the target response can be allowed to proceed, enabling the target request to be executed. If either the target request or the target response indicates privilege escalation, then the current access is preliminarily determined to be privilege escalated, requiring manual review of either the target request or the target response.

[0108] S29: If the target request and target response match the relevant information in the target permission tree, then allow the target response.

[0109] For the target request, this information includes the request operation type, the accessed resource path, and path parameters. For the target response, it includes the set of response fields and the resource data sensitivity level.

[0110] This is a normal request and response to the unauthorized access detection target. That is, the target's requested object has historically performed the same operation on the unauthorized access detection target and obtained the same result.

[0111] S210: If at least one of the target request and target response fails to match the relevant information in the target permission tree, output verification information on whether the target request and / or target response is an unauthorized access; obtain the response information based on the verification information.

[0112] Whether the target request or the target response fails to match, it indicates a suspected privilege escalation. The next step is to manually verify the failed target requests and / or responses.

[0113] Output verification information to the administrator of the privilege escalation detection engine. This verification information includes a query to determine whether the target request and / or target response constitutes privilege escalation. Whether the verification information includes the target request or the target response depends on the previously identified suspected privilege escalation. When the suspected privilege escalation corresponds to both the target request and the target response, the verification information includes both. When the suspected privilege escalation corresponds to the target request, the verification information includes the target request. When the suspected privilege escalation corresponds to the target response, the verification information includes the target response.

[0114] After seeing the verification information, the administrator confirms the target request and / or target response based on the verification information. Specifically, this can be done by consulting relevant personnel or referring to information security manuals, etc., to determine whether the target request and / or target response exceeds the authorized limits, thereby generating a response information containing whether the authorization has been exceeded, and inputting the response information into the authorization exceedance detection engine.

[0115] S211: If the response information indicates that the target request and / or target response is an unauthorized access, then intercept the target response.

[0116] Regardless of whether the target request or response is suspected of unauthorized access, since the target request has already been processed by the unauthorized access detection engine (generating the target response), intercepting the target response is sufficient. Ultimately, this will still prevent the target request from completing. Because the target response is intercepted, the object that initiated the target request will not receive the target response, thus achieving unauthorized access security protection for the target.

[0117] In addition, the target request and target response information can be recorded for later querying.

[0118] S212: If the response information indicates that neither the target request nor the target response has exceeded its authority, then the target request operation type, the target access resource path, and the target path parameters in the target request are added to the target permission tree, and the response field set and resource data sensitivity level in the target response are added to the target permission tree.

[0119] At this point, it indicates that the target request and response were not unauthorized; rather, the target user had not previously performed this operation, and there was no corresponding record in the target permission tree. In this case, the target request operation type, target access resource path, and target path parameters from the target request can be added to the target permission tree, as can the response field set and resource data sensitivity level from the target response, to update the target permission tree.

[0120] S213: Update the information in the target permission tree and other permission trees in the permission tree set other than the target permission tree based on the target model.

[0121] The target model is a pre-trained, tree-based, interpretable supervised learning model, such as a decision tree model. The training data used to train the target model can be successful access requests and responses obtained from historical logs.

[0122] Specifically, step S213 above may include: S213a: Input the existing request operation types, access resource paths, and path parameters corresponding to the requests and allowed access tags from the target permission tree into the target model to obtain a new target permission tree output by the target model.

[0123] The new target permission tree includes a unique user identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities.

[0124] By using the target model, we can relearn from existing requests in the target permission tree based on non-authorization access, thereby optimizing the data types and specific data content of each child node in the target permission tree, and thus improving the accuracy of subsequent authorization detection.

[0125] In the new target permission tree, in addition to the original request operation type, access resource path, path parameters, and allowed access probability (100%), it can also include derived and inferred request operation types, access resource paths, path parameters, and allowed access probability (not 100%). In this way, the probability of false alarms can be reduced for non-unauthorized actions that the user has not previously performed.

[0126] For example, the target permission tree includes Resource 1, Resource 2, and Resource 3. In reality, the target user can access Resources 4 and 5. If the target user accesses Resource 4 (which has never been accessed before) through a target request, matching this with the target permission tree will mistakenly determine that the target request is unauthorized. In the new target permission tree, Resources 1 (100%), Resource 2 (100%), Resource 3 (100%), Resource 4 (90%), and Resource 5 (80%) are included. If the target user accesses Resource 4 through a target request, matching this with the new target permission tree will determine that the target request is not unauthorized, with an 80% probability. This higher probability of confirming that the target request is not unauthorized improves the accuracy of unauthorized access detection.

[0127] S213b: Input the target request and the request operation type, access resource path and path parameter corresponding to the other permission trees in the permission tree set other than the target permission tree into the target model to obtain a new other permission tree output by the target model.

[0128] The new other permission tree includes the user's unique identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities.

[0129] By using the target model, we can relearn from existing requests in other permission trees based on non-authorization access, thereby optimizing the data types and specific data content of each child node in other permission trees and improving the accuracy of subsequent authorization detection.

[0130] In the new permission trees, in addition to the original request operation type, access resource path, path parameters, and allowed access probability (100%), it can also include new request operation types, access resource paths, path parameters, and allowed access probabilities based on the target request (which may be 100% or not, depending on the specific relationship between the target request and other permission trees, for example, the target request and the user corresponding to the other permission trees have the same level). This reduces the probability of false alarms for non-unauthorized actions that the user has not previously performed.

[0131] For example, the other permission tree corresponding to manager A includes resource 1. In reality, all department managers in the company can access resource 2, but manager A has not accessed it before, while manager B has already accessed resource 2, and it has been confirmed that manager B's request is not an unauthorized access. After the target model processes the target request and the requests corresponding to other permission trees, resource 2 is also added to the other permission trees, resulting in a new other permission tree. In this way, subsequent requests from users in other permission trees to access resource 2 will no longer be considered unauthorized access, thus improving the accuracy of unauthorized access detection.

[0132] It should be noted that steps S213a and S213b can be performed individually or simultaneously; no restriction is imposed here.

[0133] This concludes the description of the unauthorized access detection method provided in the embodiments of this application.

[0134] Based on the same inventive concept, embodiments of this application also provide an unauthorized access detection device.

[0135] Figure 3 This is a schematic diagram of the unauthorized access detection device in the embodiments of this application. Figure 1 See Figure 3 As shown, the device may include: The first acquisition module 31 is used to acquire the target request received by the unauthorized detection target; The second acquisition module 32 is used to acquire the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request; The lookup module 33 is used to look up the target permission tree corresponding to the unique identifier of the target user from the permission tree set. The permission tree set includes multiple permission trees corresponding to different unique identifiers of users. Each permission tree includes the unique identifier of the user and the request operation type, access resource path and path parameters in the historical successfully accessed requests. The matching module 34 is used to match the target request operation type, target access resource path, and target path parameters with the request operation type, access resource path, and path parameters in the target permission tree; if the matching fails, the authentication module is entered. The authentication module 35 is used to determine whether the target request is unauthorized access.

[0136] Furthermore, as Figure 3 In addition to the refinement and expansion of the illustrated device, this application also provides an overreach detection device.

[0137] Figure 4 This is a schematic diagram of the unauthorized access detection device in the embodiments of this application. Figure 2 See Figure 4 As shown, the device may include: Module 41 is used to obtain multiple requests that have passed the unauthorized access detection target since its deployment, based on static unauthorized access detection rules; extract the user's unique identifier for each request; aggregate requests with the same user unique identifier to obtain multiple user unique identifiers and their corresponding request sets; classify the requests in the request set corresponding to each user unique identifier according to the condition that the five-tuple information is the same to obtain the request group corresponding to each five-tuple information; extract the request operation type, access resource path and path parameters from the request group corresponding to each five-tuple information; and generate the corresponding permission tree based on each user unique identifier and the request operation type, access resource path and path parameters corresponding to each five-tuple information, and obtain the permission tree set.

[0138] The first acquisition module 42 is used to acquire the target request received by the unauthorized detection target.

[0139] The second acquisition module 43 is used to obtain the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request.

[0140] The lookup module 44 is used to look up the target permission tree corresponding to the unique identifier of the target user from the permission tree set. The permission tree set includes multiple permission trees corresponding to different unique identifiers of users. Each permission tree includes the unique identifier of the user and the request operation type, access resource path and path parameters in the historical successfully accessed requests.

[0141] Matching module 45 is used to match the target request operation type, target access resource path and target path parameters with the request operation type, access resource path and path parameters in the target permission tree.

[0142] The matching module 45 is also used to obtain the target response based on the target request; extract the target response data features from the target response; and match the target response data features with the response data features in the target permission tree. If the matching fails, the process proceeds to the authentication module 46.

[0143] When the response data features include a set of response fields, the matching module 45 is also specifically used to obtain the target response field set from the target response; and to match the target response field set with the response field set in the target permission tree.

[0144] When the response data features include the sensitivity level of resource data, the matching module 45 is further specifically used to obtain the sensitivity level of target resource data from the target response; determine whether the sensitivity level of target resource data is higher than the sensitivity level of resource data in the target permission tree; if so, determine that the target response data features match the response data features in the target permission tree; if not, determine that the target response data features do not match the response data features in the target permission tree.

[0145] Authentication module 46 is used to intercept the target response.

[0146] The authentication module 46 is also used to output verification information on whether the target request has exceeded its authority; obtain response information based on the verification information; if the response information indicates that the target request has not exceeded its authority, then the target request operation type, target access resource path and target path parameter in the target request are added to the target permission tree.

[0147] The update module 47 is used to input the existing request operation types, access resource paths, and path parameters corresponding to the requests and allowed access tags from the target permission tree into the target model to obtain a new target permission tree output by the target model. The new target permission tree includes the user's unique identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities. Alternatively, it can input the target request and the request operation types, access resource paths, and path parameters corresponding to the requests and allowed access tags from other permission trees in the permission tree set (excluding the target permission tree) into the target model to obtain a new other permission tree output by the target model. The new other permission tree includes the user's unique identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities. The target model is a pre-trained, tree-structured, interpretable supervised learning model.

[0148] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0149] Based on the same inventive concept, this application also provides a computer device.

[0150] Figure 5 This is a schematic diagram of the structure of the computer device in an embodiment of this application. See also... Figure 5 As shown, the computer device may include: a memory 51, a processor 52, and a computer program stored on the memory 51, wherein the processor 52 executes the computer program to implement the methods described in the foregoing embodiments.

[0151] It should be noted that the description of the above computer device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0152] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the methods described in the foregoing embodiments.

[0153] It should be noted that the description of the above computer-readable storage medium embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the computer-readable storage medium embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0154] Based on the same inventive concept, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the methods described in the foregoing embodiments.

[0155] It should be noted that the descriptions of the above computer program product embodiments are similar to those of the above method embodiments, and have similar beneficial effects. For technical details not disclosed in the computer program product embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0156] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting unauthorized access, characterized in that, The method includes: Obtain the target request received by the unauthorized detection target; Obtain the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request; The target permission tree corresponding to the unique identifier of the target user is found in the permission tree set. The permission tree set includes multiple permission trees corresponding to different unique identifiers of users. Each permission tree includes the unique identifier of the user and the request operation type, access resource path and path parameters in the historical successfully accessed requests. The target request operation type, the target access resource path, and the target path parameter are matched with the request operation type, access resource path, and path parameter in the target permission tree; If a match fails, it is determined that the target request is unauthorized.

2. The method according to claim 1, characterized in that, Each permission tree also includes response data characteristics; The method further includes: Obtain the target response based on the target request; Obtain target response data features from the target response; Match the target response data features with the response data features in the target permission tree; If a match fails, the target response is intercepted.

3. The method according to claim 2, characterized in that, The response data features include a set of response fields; obtaining the target response data features from the target response includes: Obtain the target response field set from the target response; Matching the target response data features with the response data features in the target permission tree includes: Match the target response field set with the response field set in the target permission tree.

4. The method according to claim 2, characterized in that, Response data characteristics include resource data sensitivity levels; The step of obtaining target response data features from the target response includes: Obtain the sensitivity level of the target resource data from the target response; Matching the target response data features with the response data features in the target permission tree includes: Determine whether the sensitivity level of the target resource data is higher than the sensitivity level of the resource data in the target permission tree; If so, then it is determined that the target response data feature matches the response data feature in the target permission tree; If not, it is determined that the target response data features do not match the response data features in the target permission tree.

5. The method according to any one of claims 1 to 4, characterized in that, Before obtaining the target request received by the unauthorized detection target, the method further includes: The unauthorized access detection target is obtained from multiple requests that have passed detection based on static unauthorized access detection rules since the system was put into use; Extract the unique user identifier for each request; Aggregate requests with the same user unique identifier to obtain multiple user unique identifiers and their corresponding request sets; The requests in the request set corresponding to each user's unique identifier are classified according to the condition that the five-tuple information is the same, so as to obtain the request group corresponding to each five-tuple information. Extract the request operation type, access resource path, and path parameters from the request group corresponding to each 5-tuple information; Based on each user's unique identifier and the request operation type, access resource path, and path parameters corresponding to each of its five-tuple information, a corresponding permission tree is generated, and the permission tree set is obtained.

6. The method according to any one of claims 1 to 4, characterized in that, Before determining that the target request is unauthorized accessing the device, the method further includes: Output verification information regarding whether the target request constitutes unauthorized access; Obtain the response information based on the verification information; If the response information indicates that the target request has not exceeded its authority, then the target request operation type, the target access resource path, and the target path parameter in the target request are added to the target permission tree.

7. The method according to claim 6, characterized in that, After adding the target request operation type, the target access resource path, and the target path parameter from the target request to the target permission tree, the method further includes: Inputting the existing request operation types, access resource paths, and path parameters corresponding to the requests and allowed access tags from the target permission tree into the target model yields a new target permission tree output by the target model. This new target permission tree includes a unique user identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities; or... The target request is input into the target model along with the request operation types, access resource paths, and path parameters corresponding to other permission trees in the permission tree set (excluding the target permission tree), as well as the allowed access labels. This yields a new other permission tree output by the target model. The new other permission tree includes a unique user identifier and its corresponding different request operation types, access resource paths, path parameters, and allowed access probabilities. The target model is a pre-trained, tree-structured, interpretable supervised learning model.

8. An overstepping authority detection device, characterized in that, The device includes: The first acquisition module is used to acquire the target request received by the unauthorized detection target. The second acquisition module is used to acquire the target user's unique identifier, the target request operation type, the target access resource path, and the target path parameters from the target request; The lookup module is used to look up the target permission tree corresponding to the unique identifier of the target user from the permission tree set. The permission tree set includes multiple permission trees corresponding to different unique identifiers of users. Each permission tree includes the unique identifier of the user and the request operation type, access resource path and path parameters in the historical successfully accessed requests. The matching module is used to match the target request operation type, the target access resource path, and the target path parameters with the request operation type, access resource path, and path parameters in the target permission tree; if the matching fails, the authentication module is entered. The authentication module is used to determine whether the target request is unauthorized.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images