Method, device, medium and program product for determining risk of overriding

Abstract

The invention aims to provide a method and device for determining an unauthorized risk, a medium and a program product, and the method comprises the steps: intercepting a request, modifying a parameter, obtaining a target response, carrying out the screenshot of a finally rendered page, achieving a dual-mode verification mechanism of vision-flow, capturing an entity through flow analysis, and achieving the unauthorized risk. By analyzing the semantics of the page screenshot, the hidden situation that the flow layer seems successfully, but the visual layer fails substantially is recognized accurately, and the problems of misinformation and missing report of a traditional method are solved fundamentally; furthermore, through performing'three-point comparison 'on the page screenshots including the attacker view angle, the victim view angle and the test view angle, accurate judgment on the semantic level based on the service scene can be realized, so that whether an unauthorized risk exists in various complex service scenes can be determined.

Description

Technical Field

[0001] This application relates to the field of computers, and more particularly to a technique for determining the risk of unauthorized access. Background Technology

[0002] Existing network security detection technologies, especially for automated detection of Insecure Direct Object Reference (IDOR) vulnerabilities (a type of access control vulnerability), primarily rely on comparing HTTP (Hypertext Transfer Protocol) traffic status codes or simple text similarity calculations. However, in modern network application scenarios, many interfaces are public resources without access restrictions (such as announcements, help documents, and public configuration information). Existing technologies struggle to intelligently identify the "public attribute" of interfaces, easily leading to false positives for public interfaces. Furthermore, in modern front-end and back-end separation architectures, many interfaces may return highly similar data structures under different access levels (such as empty JSON (JavaScript Object Notation) lists or generic success messages). When an attacker attempts to access the victim's data without authorization, if the server returns data identical to the attacker's request (e.g., both are empty), traditional detection algorithms based on "traffic differences / text differences" cannot distinguish between "successful privilege escalation" and "normal business logic," resulting in severe false negatives. This leads to false negatives and detection failures due to homogenized response data. Summary of the Invention

[0003] One object of this application is to provide a method, apparatus, medium, and procedure for determining the risk of unauthorized access.

[0004] According to one aspect of this application, a method for determining the risk of unauthorized access is provided, the method comprising:

[0005] Intercept the target request initiated by the first browser instance to the corresponding server for the target business interface, wherein the target request includes the first authentication credentials corresponding to the first browser instance;

[0006] Based on the second browser instance, a modification operation on key feature information is performed on the target request to obtain the modified target request, wherein the second browser instance corresponds to the second authentication credential;

[0007] The modified target request is sent to the server through a third browser instance, so that the server returns a target response based on the modified target request. The third browser instance then presents the corresponding target page based on the target response and captures the target page image corresponding to the target page.

[0008] The first page image obtained by requesting the target business interface through the first browser instance, the second page image obtained by requesting the target business interface through the second browser instance, and the target page image are compared for similarity. Based on the comparison results and the traffic layer status corresponding to the target response, it is determined whether the target business interface has an unauthorized access risk.

[0009] According to one aspect of this application, a computer device for determining the risk of unauthorized access is provided, comprising a memory, a processor, and a computer program stored in the memory, characterized in that the processor executes the computer program to implement the steps of any of the methods described above.

[0010] According to one aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of any of the methods described above.

[0011] According to one aspect of this application, a computer program product is provided, comprising a computer program, characterized in that, when executed by a processor, the computer program implements the steps of any of the methods described above.

[0012] According to one aspect of this application, a user equipment for determining unauthorized access risks is provided, the equipment comprising:

[0013] The module is used to intercept the target request initiated by the first browser instance to the corresponding server for the target business interface, wherein the target request includes the first authentication credentials corresponding to the first browser instance.

[0014] The first and second modules are used to perform modification operations on key feature information of the target request based on the second browser instance to obtain the modified target request, wherein the second browser instance corresponds to the second authentication credential;

[0015] The first and third modules are used to send the modified target request to the server through a third browser instance, so that the server returns a target response based on the modified target request, and the third browser instance presents the corresponding target page based on the target response, and captures the target page image corresponding to the target page;

[0016] The first and fourth modules are used to compare the similarity of the first page image obtained by requesting the target business interface through the first browser instance, the second page image obtained by requesting the target business interface through the second browser instance, and the target page image, and determine whether the target business interface has an unauthorized access risk based on the comparison result and the traffic layer status corresponding to the target response.

[0017] Compared with existing technologies, this application intercepts requests and modifies parameters to obtain the target response, then takes a screenshot of the final rendered page, realizing a dual-modal verification mechanism of "visual-traffic". By capturing the "entity" through traffic analysis and then analyzing the "semantics" of the page screenshot, it accurately identifies the hidden situation of "seeming success at the traffic layer, but actual failure at the visual layer", fundamentally solving the problems of false positives and false negatives in traditional methods. Furthermore, by performing a "three-point comparison" of page screenshots from the attacker's perspective, the victim's perspective, and the test perspective, it can achieve accurate semantic judgment based on business scenarios, thereby determining whether there is an unauthorized access risk in various complex business scenarios. Attached Figure Description

[0018] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0019] Figure 1 This diagram illustrates a method for determining the risk of unauthorized access according to one embodiment of the present application.

[0020] Figure 2 This diagram illustrates a user equipment structure for determining unauthorized access risk according to an embodiment of this application.

[0021] Figure 3 Exemplary systems that can be used to implement the various embodiments described in this application are shown.

[0022] The same or similar reference numerals in the accompanying drawings represent the same or similar parts. Detailed Implementation

[0023] The present application will now be described in further detail with reference to the accompanying drawings.

[0024] In a typical configuration of this application, the terminal, the device of the service network, and the trusted party all include one or more processors (e.g., a central processing unit (CPU)), input / output interfaces, network interfaces, and memory.

[0025] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash memory. Memory is an example of computer-readable media.

[0026] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PCM), programmable random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0027] The devices referred to in this application include, but are not limited to, user equipment, network equipment, or devices composed of user equipment and network equipment integrated through a network. The user equipment includes, but is not limited to, any mobile electronic product capable of human-computer interaction (e.g., via a touchpad), such as smartphones and tablets. These mobile electronic products can use any operating system, such as Android or iOS. The network equipment includes an electronic device capable of automatically performing numerical calculations and information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), and embedded devices. The network equipment includes, but is not limited to, computers, network hosts, single network servers, multiple network server clusters, or clouds composed of multiple servers. Here, a cloud consists of a large number of computers or network servers based on cloud computing, where cloud computing is a type of distributed computing, consisting of a virtual supercomputer composed of a group of loosely coupled computer clusters. The network includes, but is not limited to, the Internet, wide area network, metropolitan area network, local area network, VPN network, wireless ad hoc network, etc. Preferably, the device can also be a program running on the user equipment, network device, or a device formed by integrating user equipment and network device, network device, touch terminal, or network device and touch terminal through a network.

[0028] Of course, those skilled in the art should understand that the above-described devices are merely examples, and other existing or future devices that are applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0029] In the description of this application, "multiple" means two or more, unless otherwise expressly and specifically defined.

[0030] All data collected and processed in this application have been with the user's consent or permission, and have strictly complied with legal regulations, social ethics, and the public interest. This data processing includes, but is not limited to, tag management, rule setting, and recommendation decisions. The legal regulations mentioned include, but are not limited to: 1) relevant laws and regulations of various countries or organizations regarding the protection of personal information; 2) relevant laws and regulations of various countries or organizations regarding the protection of user information; and 3) relevant laws and regulations of various countries or organizations regarding the use of personal or user information by organizations.

[0031] Figure 1 This document illustrates a flowchart of a method for determining unauthorized access risk according to an embodiment of this application. The method includes steps S11, S12, S13, and S14. In step S11, a user equipment (UE) intercepts a target request initiated by a first browser instance to a corresponding server for a target service interface. The target request includes a first authentication credential corresponding to the first browser instance. In step S12, the UE performs a modification operation on key feature information regarding the target request based on a second browser instance, obtaining a modified target request. The second browser instance corresponds to a second authentication credential. In step S13, the UE sends the modified target request to the server through a third browser instance, causing the server to return a target response based on the modified target request. The third browser instance then presents a corresponding target page based on the target response, and captures an image of the target page. In step S14, the UE performs a similarity comparison between the first page image obtained through the first browser instance requesting the target service interface, the second page image obtained through the second browser instance requesting the target service interface, and the target page image. Based on the comparison result and the traffic layer state corresponding to the target response, the UE determines whether the target service interface has an unauthorized access risk.

[0032] In step S11, the user equipment intercepts the target request initiated by the first browser instance to the corresponding server for the target service interface, wherein the target request includes the first authentication credential corresponding to the first browser instance.

[0033] In some embodiments, a browser instance refers to an independently running process or session with a complete browser environment. In some embodiments, a first browser instance initiates a target request to the corresponding server for the target business interface, and then intercepts the target request using man-in-the-middle proxy technology. Man-in-the-middle proxy technology is a technique for intercepting, monitoring, or modifying data flow between a client and a server in network communication. It acts like a "transparent middleman," standing between the two communicating parties, able to see and process all passing data. In some embodiments, the target request includes a first authentication credential (e.g., a cookie (cached)) corresponding to the first browser instance. The authentication credential is text data (e.g., a random string) sent by the server to the browser and stored locally. It is carried and sent back when the browser makes a request to the same server again. For example, after the browser instance initiates a login request to the server for the server's login interface, the server returns the response information corresponding to the login request to the browser instance. This response information contains the authentication credential corresponding to the browser instance, which the browser instance then stores locally. In some embodiments, the authentication credentials corresponding to each browser instance are used to represent the identity of the user corresponding to the login account of that browser instance, and the server can distinguish which user's account initiated the request by using the authentication credentials included in the request.

[0034] In step S12, the user equipment performs a modification operation on key feature information for the target request based on the second browser instance to obtain the modified target request, wherein the second browser instance corresponds to the second authentication credential.

[0035] In some embodiments, the key feature information of a browser instance includes at least one of the user identity identifier and resource ownership identifier corresponding to the browser instance. In some embodiments, the first browser instance and the second browser instance correspond to different authentication credentials; the first browser instance corresponds to a first authentication credential, and the second browser instance corresponds to a second authentication credential. In some embodiments, a modification operation on the key feature information is performed on the target request based on the second browser instance, that is, the key feature information belonging to the first browser instance in the target request is modified to the key feature information belonging to the second browser instance. In some embodiments, the modified target request still includes the first authentication credential corresponding to the first browser instance.

[0036] In step S13, the user equipment sends the modified target request to the server through a third browser instance, so that the server returns a target response based on the modified target request, and the third browser instance presents the corresponding target page based on the target response, and captures the target page image corresponding to the target page.

[0037] In some embodiments, by intercepting the target request, the target request initiated by the first browser instance is not sent to the corresponding server. Instead, the modified target request is sent to the corresponding server through the third browser instance. In some embodiments, the server generates a corresponding target response based on the modified target request and returns the target response to the third browser instance. The third browser instance then executes page loading and rendering logic based on the target response, presenting the target page corresponding to the target response. After the page rendering is complete, the target page is captured to obtain the target page image. In some embodiments, the third browser instance is a clean browser environment.

[0038] In step S14, the user equipment performs a similarity comparison on the first page image obtained by requesting the target service interface through the first browser instance, the second page image obtained by requesting the target service interface through the second browser instance, and the target page image. Based on the comparison result and the traffic layer status corresponding to the target response, it determines whether the target service interface has an unauthorized access risk.

[0039] In some embodiments, a similarity comparison is performed on the first page image (baseline screenshot) of the first page corresponding to the first response (baseline response) obtained by the first browser instance from the corresponding server through a normal request (i.e., normal access) to the target business interface, the second page image (baseline screenshot) of the second page corresponding to the second response (baseline response) obtained by the second browser instance from the corresponding server through a normal request (i.e., normal access) to the target business interface, and the target page image to obtain a corresponding comparison result. The comparison result includes the degree of similarity between every two page images among the three page images. In some embodiments, the first browser instance represents an attacker / malicious user, the second browser instance represents a victim / target user, and the third browser instance represents a clean browser environment. In some embodiments, the traffic layer status corresponding to the target response refers to the status code of the target response. This is a three-digit code returned by the server to the browser instance to identify the processing result of the request, allowing the browser instance to quickly determine whether the request was successful, failed, or requires further operation. Traffic layer statuses include, but are not limited to, 200 (request successful), 301 (permanent redirect, the requested resource has been permanently moved to a new URL (Uniform Resource Locator)), 403 (server refuses request), and 503 (server is temporarily unable to process request), etc. This example embodiment does not impose any special limitations on these. In some embodiments, based on the comparison result and the traffic layer status corresponding to the target response, it is determined whether the target business interface has an unauthorized access risk. The unauthorized access risk of the target business interface refers to a security risk where the target business interface has defects in the permission verification process, allowing unauthorized users, programs, or devices to bypass normal permission restrictions and execute or access operations or data beyond their authorized scope. For example, if the traffic layer status is not in the request success state (i.e., any status code other than 200), it is determined that the target business interface does not have the risk of unauthorized access. On the other hand, if the traffic layer status is in the request success state (i.e., 200), and the similarity between the target page image and the second page image is greater than or equal to a preset threshold, while the similarity between the target page image and the first page image is less than a preset threshold, it is determined that the target business has the risk of unauthorized access, meaning that the attacker has seen the victim's page.

[0040] This application intercepts requests and modifies parameters to obtain the target response, then takes a screenshot of the final rendered page, implementing a dual-modal verification mechanism of "visual-traffic". By capturing the "entity" through traffic analysis and then analyzing the "semantics" of the page screenshot, it accurately identifies hidden situations where "the traffic layer appears successful, but the visual layer is actually a failure", fundamentally solving the problems of false positives and false negatives in traditional methods. Furthermore, by performing a "three-point comparison" of page screenshots from the attacker's perspective, the victim's perspective, and the tester's perspective, it can achieve accurate semantic-level judgment based on business scenarios, thereby determining whether there is an unauthorized access risk in various complex business scenarios.

[0041] In some embodiments, the method further includes: creating a first browser instance, a second browser instance, and a third browser instance that are isolated from each other by invoking a preset browser kernel. In some embodiments, a preset browser kernel (e.g., the Google Chrome kernel) is invoked to create three isolated browser instances, namely the first browser instance, the second browser instance, and the third browser instance. Each browser instance is independent and does not interfere with the others; that is, the underlying data of the three browser instances is not shared.

[0042] In some embodiments, the method further includes: performing a login operation for a first account through the first browser instance, and performing a login operation for a second account through the second browser instance. In some embodiments, performing the login operation for the first account through the first browser instance means that the first browser instance initiates a login request to the server via the server's login interface, requesting to log in to the first account. The server returns response information corresponding to the login request to the first browser instance, which includes a first authentication credential corresponding to the first browser instance. The first browser instance then saves the first authentication credential locally. In some embodiments, performing the login operation for the second account through the second browser instance means that the second browser instance initiates a login request to the server via the server's login interface, requesting to log in to the second account. The server returns response information corresponding to the login request to the second browser instance, which includes a second authentication credential corresponding to the second browser instance. The second browser instance then saves the second authentication credential locally.

[0043] In some embodiments, the key feature information includes at least one of a user identity identifier and a resource ownership identifier. In some embodiments, the key feature information includes at least one of a user identity identifier and a resource ownership identifier. The user identity identifier is used to identify the user identity of the login account corresponding to the browser instance, such as user_id. The resource ownership identifier is used to identify the resources that the login account corresponding to the browser instance has access to, such as order_no or file_id. This example embodiment does not impose any special limitations on this.

[0044] In some embodiments, the method further includes: extracting the first authentication credential from the target request and writing the first authentication credential into the third browser instance. In some embodiments, the first authentication credential corresponding to the first browser instance is extracted from the target request, and then the first authentication credential is written into a third browser instance that originally did not have a corresponding authentication credential.

[0045] In some embodiments, the step of performing a modification operation on key feature information for the target request based on the second browser instance to obtain a modified target request includes: identifying first key feature information of the first browser instance from the target request, modifying the first key feature information to second key feature information of the second browser instance, and obtaining the modified target request. In some embodiments, identifying the first key feature information of the first browser instance from the target request can be done, for example, by performing keyword recognition on the request content of the target request based on at least one preset keyword, and identifying the first key feature information from the request content of the target request; or, for example, by inputting the request content of the target request into a trained large language model to obtain the first key feature information output by the model. In some embodiments, modifying the first key feature information in the target request to the second key feature information of the second browser instance to obtain a modified target request can be done, for example, modifying the first key feature information "user_id=1001" in the target request to the second key feature information "user_id=2002" of the second browser instance.

[0046] In some embodiments, the method further includes: initiating a first request to the server for the target business interface through the first browser instance, receiving a first response returned by the server based on the first request, presenting a corresponding first page based on the first response, and capturing a first page image corresponding to the first page, wherein the first request includes the first authentication credentials. In some embodiments, the first browser instance initiates a first request to the corresponding server for the target business interface, the first request including the first authentication credentials corresponding to the first browser instance, the server generates a corresponding first response based on the first request, and returns the first response to the first browser instance, the first browser instance executes page loading and rendering logic based on the first response, presents the first page corresponding to the first response, and after the page rendering is completed, captures the first page to obtain a first page image corresponding to the first page, wherein the first browser instance represents an attacker / malicious user.

[0047] In some embodiments, the method further includes: initiating a second request to the server for the target business interface through the second browser instance, receiving a second response returned by the server based on the second request, presenting a corresponding second page based on the second response, and capturing a second page image corresponding to the second page, wherein the second request includes the second authentication credentials. In some embodiments, the second browser instance initiates a second request to the corresponding server for the target business interface, the second request including the second authentication credentials corresponding to the second browser instance, the server generates a corresponding second response based on the second request, and returns the second response to the second browser instance, the second browser instance executes page loading and rendering logic based on the second response, presents the second page corresponding to the second response, and after the page rendering is completed, captures the second page to obtain a second page image corresponding to the second page, wherein the second browser instance represents the victim / target user. In some embodiments, this application constructs an automated "multi-terminal collaboration" benchmark environment. Before the detection begins, two independent browser instances (a first browser instance and a second browser instance) are controlled to log in to two different accounts (a first account and a second account) and access the target business interface. Benchmark screenshots and traffic of "attackers viewing their own data" and "victims viewing their own data" are automatically collected and labeled to provide a benchmark for subsequent detection of whether there is an unauthorized access risk in the target business interface.

[0048] In some embodiments, determining whether the target service interface has an unauthorized access risk based on the comparison result and the traffic layer status corresponding to the target response includes: determining whether the traffic layer status corresponding to the target response is a request success status; if not, determining that the target service interface does not have an unauthorized access risk; otherwise, determining whether the target service interface has an unauthorized access risk based on the comparison result. In some embodiments, first determining whether the traffic layer status corresponding to the target response is a request success status (i.e., 200); if not, it can be directly determined that the target service interface does not have an unauthorized access risk; if so, it is necessary to determine whether the target service interface has an unauthorized access risk based on the similarity comparison result between the first page image, the second page image, and the target page image. In some embodiments, a composite prompt word containing the three page images and contextual information is constructed. This composite prompt word is input into a trained model, which then performs a similarity comparison on the three page images based on the composite prompt word and outputs a conclusion characterizing "whether there is an unauthorized access risk" based on the comparison results. The structure of the composite prompt word includes role setting, input data, and judgment criteria. For example, the role setting is: "You are a cybersecurity expert, proficient in discovering website unauthorized access vulnerabilities. Task: Analyze the following three webpage screenshots and determine whether there is an unauthorized access risk." The input data is: "First page image (attacker's perspective): This is how the first user accesses their own data; Second page image (victim's perspective): This is how the second user accesses their own data; Third page image (test perspective):..." This is the rendering result when the first user attempts to access the second user's data. The judgment criteria are: "If the target page image is highly similar to the second page image in terms of key data content and layout, and is significantly different from the first page image, it is judged as 'risk of unauthorized access'; if the target page image displays 'insufficient permissions', 'login page', or is highly similar to the first page image, it is judged as 'no risk of unauthorized access'." By constructing compound prompt words to provide the model with a complete judgment context, a complex and open question of "whether there is a risk of unauthorized access" is transformed into a specific similarity comparison question with a clear reference frame. This greatly reduces the model's illusion risk and enables it to make accurate semantic judgments based on business scenarios, thereby determining whether there is a risk of unauthorized access in various complex business scenarios.

[0049] In some embodiments, determining whether the target business interface has an unauthorized access risk based on the comparison result includes: if the similarity between the target page image and the second page image is greater than or equal to a preset threshold, and the similarity between the target page image and the first page image is less than the preset threshold, then the target business interface is determined to have an unauthorized access risk. In some embodiments, if the traffic layer status corresponding to the target response is a request success status (i.e., 200), and the similarity between the target page image and the second page image is greater than or equal to a preset threshold, and the similarity between the target page image and the first page image is less than the preset threshold, then the target business interface is determined to have an unauthorized access risk, i.e., the attacker has successfully viewed the victim's page.

[0050] In some embodiments, the method further includes: if the similarity between the target page image and the first page image is greater than or equal to the preset threshold, determining that the target business interface does not have an unauthorized access risk. In some embodiments, if the traffic layer status corresponding to the target response is a request success status (i.e., 200), and the similarity between the target page image and the first page image is greater than or equal to the preset threshold, then it is determined that the target business interface does not have an unauthorized access risk, which is a logical automatic error correction, i.e., the attack is invalid, and the server automatically returns the attacker's own data.

[0051] In some embodiments, the method further includes: determining whether the target page belongs to a login page or an error page based on the target page image; if so, determining that the target business interface does not have an unauthorized access risk. In some embodiments, if the traffic layer status corresponding to the target response is a request success status (i.e., 200), image content recognition is performed on the target page image, and the target page is determined to belong to a login page or an error page based on the content recognition result. If it belongs to a login page or an error page, it can be determined that the target business interface does not have an unauthorized access risk, that is, although the server returns 200, it visually rejects access (traditional tools are prone to false positives).

[0052] In some embodiments, determining that the target business interface does not have an unauthorized access risk if the similarity between the target page image and the first page image is greater than or equal to the preset threshold includes: if the similarity between the target page image and the first page image is greater than or equal to the preset threshold, and the similarity between the target page image and the first page image is greater than or equal to the preset threshold, then the target business interface is determined to be used to access public resources, and the target business interface does not have an unauthorized access risk. In some embodiments, if the traffic layer status corresponding to the target response is a request success status (i.e., 200), and the similarity between the target page image and the first page image is greater than or equal to the preset threshold, then it can be determined that the target business interface is used to access public resources, and the target business interface does not have an unauthorized access risk; that is, the target page accessed by the target business interface is a public page, and there is no unauthorized access risk.

[0053] Figure 2 The diagram illustrates a user equipment structure for determining unauthorized access risks according to an embodiment of this application. The user equipment includes a first module 11, a second module 12, a third module 13, and a fourth module 14. Module 11 is used to intercept a target request initiated by a first browser instance to the corresponding server for the target business interface, wherein the target request includes a first authentication credential corresponding to the first browser instance; Module 12 is used to perform a modification operation on key feature information based on the target request by a second browser instance to obtain a modified target request, wherein the second browser instance corresponds to a second authentication credential; Module 13 is used to send the modified target request to the server through a third browser instance, so that the server returns a target response based on the modified target request, and the third browser instance presents the corresponding target page based on the target response, and captures the target page image corresponding to the target page; Module 14 is used to perform a similarity comparison on the first page image obtained by requesting the target business interface through the first browser instance, the second page image obtained by requesting the target business interface through the second browser instance, and the target page image, and determine whether the target business interface has an unauthorized access risk based on the comparison result and the traffic layer state corresponding to the target response.

[0054] Module 11 is used to intercept the target request initiated by the first browser instance to the corresponding server for the target business interface, wherein the target request includes the first authentication credential corresponding to the first browser instance.

[0055] In some embodiments, a browser instance refers to an independently running process or session with a complete browser environment. In some embodiments, a first browser instance initiates a target request to the corresponding server for the target business interface, and then intercepts the target request using man-in-the-middle proxy technology. Man-in-the-middle proxy technology is a technique for intercepting, monitoring, or modifying the data flow between the client and server in network communication. It acts like a "transparent middleman," standing between the two communicating parties, able to see and process all the data passing through. In some embodiments, the target request includes a first authentication credential (e.g., a cookie) corresponding to the first browser instance. The authentication credential is text data (e.g., a random string) sent by the server to the browser and stored locally. It is carried and sent back when the browser makes a subsequent request to the same server. For example, after the browser instance initiates a login request to the server for the server's login interface, the server returns the response information corresponding to the login request to the browser instance. This response information includes the authentication credential corresponding to the browser instance, which the browser instance then stores locally. In some embodiments, the authentication credential corresponding to each browser instance represents the identity of the user corresponding to the login account of that browser instance. The server can identify which user's account initiated the request through the authentication credential included in the request.

[0056] Module 12 is used to perform modification operations on key feature information of the target request based on the second browser instance, and obtain the modified target request, wherein the second browser instance corresponds to the second authentication credential.

[0057] In some embodiments, the key feature information of a browser instance includes at least one of the user identity identifier and resource ownership identifier corresponding to the browser instance. In some embodiments, the first browser instance and the second browser instance correspond to different authentication credentials; the first browser instance corresponds to a first authentication credential, and the second browser instance corresponds to a second authentication credential. In some embodiments, a modification operation on the key feature information is performed on the target request based on the second browser instance, that is, the key feature information belonging to the first browser instance in the target request is modified to the key feature information belonging to the second browser instance. In some embodiments, the modified target request still includes the first authentication credential corresponding to the first browser instance.

[0058] Module 13 is used to send the modified target request to the server through a third browser instance, so that the server returns a target response based on the modified target request, and the third browser instance presents the corresponding target page based on the target response, and captures the target page image corresponding to the target page.

[0059] In some embodiments, by intercepting the target request, the target request initiated by the first browser instance is not sent to the corresponding server. Instead, the modified target request is sent to the corresponding server through the third browser instance. In some embodiments, the server generates a corresponding target response based on the modified target request and returns the target response to the third browser instance. The third browser instance then executes page loading and rendering logic based on the target response, presenting the target page corresponding to the target response. After the page rendering is complete, the target page is captured to obtain the target page image. In some embodiments, the third browser instance is a clean browser environment.

[0060] Module 14 is used to perform a similarity comparison on the first page image obtained by requesting the target business interface through the first browser instance, the second page image obtained by requesting the target business interface through the second browser instance, and the target page image, and determine whether the target business interface has an unauthorized access risk based on the comparison result and the traffic layer status corresponding to the target response.

[0061] In some embodiments, a similarity comparison is performed on the first page image (baseline screenshot) of the first page corresponding to the first response (baseline response) obtained by the first browser instance from the corresponding server through a normal request (i.e., normal access) to the target business interface, the second page image (baseline screenshot) of the second page corresponding to the second response (baseline response) obtained by the second browser instance from the corresponding server through a normal request (i.e., normal access) to the target business interface, and the target page image to obtain a corresponding comparison result. The comparison result includes the degree of similarity between every two page images among the three page images. In some embodiments, the first browser instance represents an attacker / malicious user, the second browser instance represents a victim / target user, and the third browser instance represents a clean browser environment. In some embodiments, the traffic layer status corresponding to the target response refers to the status code of the target response. It is a three-digit code returned by the server to the browser instance to identify the processing result of the request, allowing the browser instance to quickly determine whether the request was successful, failed, or requires further operation. Traffic layer statuses include, but are not limited to, 200 (request successful), 301 (permanent redirect, the requested resource has been permanently moved to a new URL), 403 (server refuses request), 503 (server is temporarily unable to process request), etc. This example embodiment does not make any special limitations on this. In some embodiments, based on the comparison results and the traffic layer status corresponding to the target response, it is determined whether the target business interface has an unauthorized access risk. The unauthorized access risk of the target business interface refers to a security risk where the target business interface has a defect in the permission verification process, allowing unauthorized users, programs, or devices to bypass normal permission restrictions and execute or access operations or data beyond their authorized scope. For example, if the traffic layer status is not a successful request status (i.e., a status code other than 200), it is determined that the target business interface does not have an unauthorized access risk. Conversely, if the traffic layer status is a successful request status (i.e., 200), and the similarity between the target page image and the second page image is greater than or equal to a preset threshold, while the similarity between the target page image and the first page image is less than a preset threshold, it is determined that the target business interface has an unauthorized access risk, meaning that an attacker has access to the victim's page.

[0062] In some embodiments, the user equipment is further configured to: create mutually isolated first browser instances, second browser instances, and third browser instances by invoking a preset browser kernel. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0063] In some embodiments, the user equipment is further configured to: perform a login operation for a first account through the first browser instance, and perform a login operation for a second account through the second browser instance. Here, the related operations are... Figure 1The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0064] In some embodiments, the key feature information includes at least one of a user identity identifier and a resource ownership identifier. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0065] In some embodiments, the user equipment is further configured to: extract the first authentication credential from the target request and write the first authentication credential into the third browser instance. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0066] In some embodiments, the step of performing a modification operation on key feature information based on a second browser instance to obtain a modified target request includes: identifying first key feature information of the first browser instance from the target request, modifying the first key feature information to second key feature information of the second browser instance, and obtaining the modified target request. Here, the related operations are similar to... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0067] In some embodiments, the user equipment is further configured to: initiate a first request to the server via the first browser instance for the target business interface, receive a first response returned by the server based on the first request, present a corresponding first page based on the first response, and capture a first page image corresponding to the first page, wherein the first request includes the first authentication credentials. Here, related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0068] In some embodiments, the user equipment is further configured to: initiate a second request to the server via the second browser instance for the target business interface, receive a second response returned by the server based on the second request, present a corresponding second page based on the second response, and capture an image of the second page corresponding to the second page, wherein the second request includes the second authentication credentials. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0069] In some embodiments, determining whether the target service interface has an unauthorized access risk based on the comparison result and the traffic layer state corresponding to the target response includes: determining whether the traffic layer state corresponding to the target response is a request success state; if not, determining that the target service interface does not have an unauthorized access risk; otherwise, determining whether the target service interface has an unauthorized access risk based on the comparison result. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0070] In some embodiments, determining whether the target service interface has an unauthorized access risk based on the comparison result includes: if the similarity between the target page image and the second page image is greater than or equal to a preset threshold, and the similarity between the target page image and the first page image is less than the preset threshold, then determining that the target service interface has an unauthorized access risk. Here, related operations and... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0071] In some embodiments, the user equipment is further configured to: determine that the target service interface does not have an unauthorized access risk if the similarity between the target page image and the first page image is greater than or equal to the preset threshold. Here, related operations and Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0072] In some embodiments, the user equipment is further configured to: determine whether the target page is a login page or an error page based on the target page image; if so, determine that the target service interface does not have an unauthorized access risk. Here, the related operations are... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0073] In some embodiments, determining that the target business interface does not have an unauthorized access risk if the similarity between the target page image and the first page image is greater than or equal to the preset threshold includes: if the similarity between the target page image and the first page image is greater than or equal to the preset threshold, and the similarity between the target page image and the first page image is greater than or equal to the preset threshold, determining that the target business interface is used to access public resources, and that the target business interface does not have an unauthorized access risk. Here, related operations and... Figure 1 The embodiments shown are the same or similar, so they will not be described again, but are included here by reference.

[0074] Figure 3 Exemplary systems that can be used to implement the various embodiments described in this application are shown; such as Figure 3 As shown in some embodiments, system 300 can function as any of the devices described in each of the embodiments. In some embodiments, system 300 may include one or more computer-readable media having instructions (e.g., system memory or NVM / storage device 320) and one or more processors (e.g., one or more processors 305) coupled to the one or more computer-readable media and configured to execute the instructions to implement the module and thus perform the actions described in this application.

[0075] In one embodiment, the system control module 310 may include any suitable interface controller to provide any suitable interface to at least one of the processors 305 and / or any suitable device or component communicating with the system control module 310.

[0076] The system control module 310 may include a memory controller module 330 to provide an interface to the system memory 315. The memory controller module 330 may be a hardware module, a software module, and / or a firmware module.

[0077] System memory 315 can be used, for example, to load and store data and / or instructions for system 300. In one embodiment, system memory 315 may include any suitable volatile memory, such as suitable DRAM. In some embodiments, system memory 315 may include double data rate type quad synchronous dynamic random access memory (DDR4 SDRAM).

[0078] In one embodiment, the system control module 310 may include one or more input / output (I / O) controllers to provide interfaces to the NVM / storage device 320 and (one or more) communication interfaces 325.

[0079] For example, NVM / storage device 320 may be used to store data and / or instructions. NVM / storage device 320 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drive (HDD), one or more optical disc (CD) drives, and / or one or more digital universal optical disc (DVD) drives).

[0080] NVM / storage device 320 may include storage resources that are physically part of a device on which system 300 is mounted, or that can be accessed by the device without necessarily being part of it. For example, NVM / storage device 320 may be accessed via a network through one or more communication interfaces 325.

[0081] One or more communication interfaces 325 may provide the system 300 with an interface to communicate over one or more networks and / or with any other suitable device. The system 300 may wirelessly communicate with one or more components of a wireless network in accordance with any of one or more wireless network standards and / or protocols.

[0082] In one embodiment, at least one of the processors 305 may be logically packaged with one or more controllers of the system control module 310 (e.g., memory controller module 330). In one embodiment, at least one of the processors 305 may be logically packaged with one or more controllers of the system control module 310 to form a system-in-package (SiP). In one embodiment, at least one of the processors 305 may be integrated with the logic of one or more controllers of the system control module 310 on the same die. In one embodiment, at least one of the processors 305 may be integrated with the logic of one or more controllers of the system control module 310 on the same die to form a system-on-a-chip (SoC).

[0083] In various embodiments, system 300 may be, but is not limited to, a server, workstation, desktop computing device, or mobile computing device (e.g., laptop computing device, handheld computing device, tablet computer, netbook, etc.). In various embodiments, system 300 may have more or fewer components and / or different architectures. For example, in some embodiments, system 300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touchscreen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0084] In addition to the methods and devices described in the above embodiments, this application also provides a computer-readable storage medium storing computer code that, when executed, performs the method described in any of the preceding embodiments.

[0085] This application also provides a computer program product that, when executed by a computer device, performs the method described in any of the preceding claims.

[0086] This application also provides a computer device, the computer device comprising:

[0087] One or more processors;

[0088] Memory, used to store one or more computer programs;

[0089] When the one or more computer programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the method as described in any of the preceding methods.

[0090] It should be noted that this application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In one embodiment, the software program of this application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, a magnetic or optical drive, a floppy disk, or similar devices. Furthermore, some steps or functions of this application can be implemented in hardware, for example, as circuitry that cooperates with a processor to perform the various steps or functions.

[0091] Furthermore, a portion of this application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0092] Communication media include media through which communication signals containing, for example, computer-readable instructions, data structures, program modules, or other data are transmitted from one system to another. Communication media can include guided transmission media (such as cables and wires (e.g., optical fibers, coaxial cables, etc.)) and wireless (unguided transmission) media capable of propagating energy waves, such as sound, electromagnetic, RF, microwave, and infrared. Computer-readable instructions, data structures, program modules, or other data can be embodied as modulated data signals in, for example, wireless media (such as carrier waves or similar mechanisms embodied as part of spread spectrum technology). The term "modulated data signal" refers to a signal whose one or more characteristics are altered or set in a manner that encodes information in the signal. Modulation can be analog, digital, or a hybrid modulation technique.

[0093] By way of example and not limitation, computer-readable storage media may include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information such as computer-readable instructions, data structures, program modules or other data. For example, computer-readable storage media include, but are not limited to, volatile memories such as random access memory (RAM, DRAM, SRAM); and non-volatile memories such as flash memory, various read-only memories (ROM, PROM, EPROM, EEPROM), magnetic and ferromagnetic / ferroelectric memories (MRAM, FeRAM); and magnetic and optical storage devices (hard disks, magnetic tapes, CDs, DVDs); or other media now known or hereafter developed capable of storing computer-readable information / data for use by a computer system.

[0094] Herein, one embodiment of this application includes an apparatus comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the apparatus is triggered to run a method and / or technical solution based on the foregoing embodiments of this application.

[0095] It will be apparent to those skilled in the art that this application is not limited to the details of the exemplary embodiments described above, and that this application can be implemented in other specific forms without departing from the spirit or essential characteristics of this application. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of this application is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be embraced within this application. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices recited in the apparatus claims may also be implemented by a single unit or device in software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

Claims

1. A method for determining an overreach risk, wherein, The method includes: Intercept the target request initiated by the first browser instance to the corresponding server for the target business interface, wherein the target request includes the first authentication credentials corresponding to the first browser instance; Based on the second browser instance, a modification operation on key feature information is performed on the target request to obtain the modified target request, wherein the second browser instance corresponds to the second authentication credential; The modified target request is sent to the server through a third browser instance, so that the server returns a target response based on the modified target request. The third browser instance then presents the corresponding target page based on the target response and captures the target page image corresponding to the target page. The first page image obtained by requesting the target business interface through the first browser instance, the second page image obtained by requesting the target business interface through the second browser instance, and the target page image are compared for similarity. Based on the comparison results and the traffic layer status corresponding to the target response, it is determined whether the target business interface has an unauthorized access risk.

2. The method of claim 1, wherein, The method further includes: By invoking a preset browser engine, a first browser instance, a second browser instance, and a third browser instance are created that are isolated from each other.

3. The method of claim 2, wherein, The method further includes: The login operation for the first account is performed through the first browser instance, and the login operation for the second account is performed through the second browser instance.

4. The method of claim 1, wherein, The key feature information includes at least one of user identity identifier and resource ownership identifier.

5. The method of claim 1, wherein, The method further includes: The first authentication credential is extracted from the target request and written into the third browser instance.

6. The method of claim 1, wherein, The step of performing modification operations on key feature information for the target request based on the second browser instance to obtain the modified target request includes: The first key feature information of the first browser instance is identified from the target request, and the first key feature information is modified to the second key feature information of the second browser instance to obtain the modified target request.

7. The method of claim 1 or 3, wherein, The method further includes: The first browser instance initiates a first request to the server for the target business interface, receives a first response from the server based on the first request, presents a corresponding first page based on the first response, and captures a first page image corresponding to the first page. The first request includes the first authentication credentials.

8. The method of claim 1 or 3, wherein, The method further includes: The second browser instance initiates a second request to the server for the target business interface, receives a second response from the server based on the second request, presents a corresponding second page based on the second response, and captures an image of the second page corresponding to the second page. The second request includes the second authentication credentials.

9. The method of claim 1, wherein, The step of determining whether the target service interface has an unauthorized access risk based on the comparison results and the traffic layer status corresponding to the target response includes: Determine whether the traffic layer status corresponding to the target response belongs to the request success status; If not, it is determined that the target business interface does not pose a risk of unauthorized access. Otherwise, the comparison results will determine whether the target business interface has an unauthorized access risk.

10. The method of claim 9, wherein, The step of determining whether the target business interface has an unauthorized access risk based on the comparison results includes: If the similarity between the target page image and the second page image is greater than or equal to a preset threshold, and the similarity between the target page image and the first page image is less than the preset threshold, it is determined that the target business interface has an unauthorized access risk.

11. The method according to claim 10, wherein, The method further includes: If the similarity between the target page image and the first page image is greater than or equal to the preset threshold, it is determined that the target business interface does not have the risk of exceeding authority.

12. The method according to claim 11, wherein, The method further includes: Based on the target page image, determine whether the target page is a login page or an error page; if so, determine that the target business interface does not have the risk of unauthorized access.

13. The method of claim 11, wherein, The step of determining that the target business interface does not have an unauthorized access risk if the similarity between the target page image and the first page image is greater than or equal to the preset threshold includes: If the similarity between the target page image and the first page image is greater than or equal to the preset threshold, and the similarity between the target page image and the first page image is greater than or equal to the preset threshold, it is determined that the target business interface is used to access public resources, and that the target business interface does not have the risk of unauthorized access.

14. A computer device for determining an overreach risk, comprising a memory, a processor and a computer program stored on the memory, characterized in that, The processor executes the computer program to implement the steps of the method as described in any one of claims 1 to 13.

15. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 13.

16. A computer program product comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the method as described in any one of claims 1 to 13.

Images