Secure transmission method, device, equipment, medium and product
By utilizing randomized labels and pre-trained models for dynamic detection and analysis in the secure transmission method between the client and server, the lagging and insufficient coverage of traditional XSS defense methods are solved, achieving real-time defense and efficient detection of XSS attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- PURPLE MOUNTAIN LAB
- Filing Date
- 2026-02-03
- Publication Date
- 2026-05-01
AI Technical Summary
Traditional XSS attack defense methods rely on static rules and predefined attack signature libraries, which are difficult to respond to new types of attacks in real time and cannot cover DOM-based XSS attacks, resulting in defense lag and high maintenance costs.
By acquiring the client's access requests and the server's randomized labels, security detection is performed based on a pre-trained target detection model. Behavioral analysis is conducted on the detection results and response results, and the randomized labels are dynamically updated to enhance the randomness of the defense approach.
It enables real-time detection and defense against XSS attacks, can cope with new types and variants of attacks, improves detection and defense capabilities, avoids attackers predicting update times, and enhances transmission security.
Smart Images
Figure CN121967034A_ABST
Abstract
Description
A secure transmission method, apparatus, equipment, medium, and product Technical Field
[0001] This invention relates to the field of computer application technology, and in particular to a secure transmission method, apparatus, device, medium, and product. Background Technology
[0002] With the rapid development of internet technology, web applications have become an important part of people's lives, work, and entertainment. However, while web applications bring convenience, they also bring cybersecurity issues. Hackers and malicious actors constantly exploit various vulnerabilities and attack methods to steal user information, hijack user sessions, and damage systems. Cross-Site Scripting (XSS) attacks occupy a very important position in cyberattacks, and are widespread and pose a high threat. Therefore, how to effectively defend against XSS attacks remains an extremely important issue in the field of web application security.
[0003] Traditional XSS attack defense methods are based on rule filtering, which mainly includes blacklist or whitelist filtering, regular expression filtering, upload filtering, and content security policy filtering.
[0004] However, relying on prior knowledge such as static rules and predefined attack signature libraries, when facing new attacks, it is necessary to continuously track new vulnerabilities and attack patterns and manually update filtering rules, which is lagging, difficult to respond in real time, and has high maintenance costs. Since DOM-type XSS attacks are triggered on the client side, server-side filtering cannot cover them, so DOM-type XSS attacks are a blind spot of traditional methods. Summary of the Invention
[0005] This invention provides a secure transmission method, apparatus, device, medium, and product, which improves the ability to detect and defend against attacks.
[0006] According to a first aspect of the present invention, a secure transmission method is provided, comprising:
[0007] Obtain the client's access request and the current randomized label pre-assigned to the web application on the server. The current randomized label is updated by triggering network attack association features.
[0008] Based on the pre-trained target detection model for the access request scheduling, the security detection result of the access request is determined;
[0009] If the security test result is secure, the access request is sent to the server, and the response result from the server is received.
[0010] Based on the current randomized label, the response result is analyzed to determine the security feedback content, which is then fed back to the client.
[0011] According to a second aspect of the present invention, a secure transmission device is provided, comprising:
[0012] The information acquisition module is used to acquire the client's access request and the current randomized label pre-assigned to the web application on the server. The current randomized label is updated by network attack association features.
[0013] The security detection module is used to schedule a pre-trained target detection model based on the access request and determine the security detection result of the access request.
[0014] The result receiving module is used to send the access request to the server if the security detection result is secure, and to receive the response result from the server.
[0015] The information feedback module is used to perform behavioral analysis on the response result based on the current randomized label, determine the security feedback content, and feed it back to the client.
[0016] According to a third aspect of the present invention, an electronic device is provided, the electronic device comprising:
[0017] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the secure transmission method according to any embodiment of the present invention.
[0018] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the secure transmission method described in any embodiment of the present invention.
[0019] According to a fifth aspect of the present invention, embodiments of the present invention also provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the secure transmission method of any embodiment of the present invention.
[0020] The technical solution of this invention obtains the client's access request and a pre-assigned current randomized label to the web application on the server. The current randomized label is updated based on network attack association features. A pre-trained target detection model is scheduled based on the access request to determine the security detection result of the access request. If the security detection result is secure, the access request is sent to the server, and the server's response result is received. Behavioral analysis is performed on the response result based on the current randomized label to determine the security feedback content and send it back to the client. By dynamically updating the current randomized label, the randomness of the defense is enhanced, independent of the attacker's attack method, and can respond to new attacks or attack variants in real time. This dual attack detection of access requests—security detection and behavioral analysis—improves both attack detection and defense capabilities.
[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description
[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0023] Figure 1 is a flowchart of a secure transmission method provided according to Embodiment 1 of the present invention;
[0024] Figure 2 is a flowchart illustrating a task scheduling example in a secure transmission method according to Embodiment 1 of the present invention.
[0025] Figure 3 is a flowchart of attribute update in a secure transmission method according to Embodiment 1 of the present invention;
[0026] Figure 4 is a flowchart of a secure transmission method provided according to Embodiment 2 of the present invention;
[0027] Figure 5 is a structural schematic diagram of a secure transmission device provided according to Embodiment 3 of the present invention;
[0028] Figure 6 is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. Detailed Implementation
[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.
[0031] Example 1
[0032] Figure 1 is a flowchart of a secure transmission method provided in Embodiment 1 of the present invention. This embodiment is applicable to attack detection in the web application field. The method can be executed by a secure transmission device, which can be implemented in hardware and / or software and can be configured in an electronic device. As shown in Figure 1, the method includes:
[0033] S110. Obtain the client's access request and the current randomization label pre-assigned to the web application on the server. The current randomization label is updated by triggering the network attack association feature.
[0034] In this embodiment, the client can be understood as the terminal that wants to invoke the web application. The access request can be understood as an HTTP / HTTPS access request based on the Hypertext Transfer Protocol (HTTP / HTTPS), a data request initiated by the client to the server to obtain resources. The server can be understood as the server providing the web application. The web application can be understood as the application running on the server. The current randomized tag can be understood as the attribute in the JS / HTML tags of the randomly updated web application. Network attack associated features can be understood as a set of detectable features associated with network attack behaviors (e.g., XSS attacks).
[0035] Specifically, the processor can receive access requests transmitted by the client and obtain the current randomization tag pre-assigned to the web application on the server from storage media, etc. The current randomization tag is updated by network attack association features.
[0036] S120. Based on the target detection model pre-trained for access request scheduling, determine the security detection result of the access request.
[0037] In this embodiment, the target detection model can be understood as a model used to detect whether an access request is secure, such as a neural network model. The security detection result is used to characterize whether the access request poses an attack or a high-risk attack.
[0038] Specifically, the processor can schedule its corresponding pre-trained object detection model based on the access request, for example, by calling it through a model pool. The processor can extract the input data from the access request and input it into the pre-trained object detection model to obtain the output result of the object detection model and determine the security detection result of the access request.
[0039] S130. If the security test result is secure, the access request will be sent to the server and the server's response will be received.
[0040] In this embodiment, the response result can be understood as the relevant content of the web application page returned by the server.
[0041] Specifically, if the security test result is secure, the processor can send the access request to the server, which will trigger business logic to generate a response based on the deployed web application. If the security test result is insecure, the request will be directly intercepted and logged.
[0042] S140. Analyze the response results based on the current randomized label, determine the content of the security feedback, and send it back to the client.
[0043] In this embodiment, the security feedback content can be understood as legitimate content that has passed behavioral analysis verification.
[0044] Specifically, the processor can parse the response and extract tags. If no tags are detected, it indicates that the code is malicious input injected by an attacker, and a filtering operation is performed directly. If tags are detected, the extracted tags can be compared with the currently randomized tags for consistency verification. If they match, the code is confirmed as security feedback content; otherwise, it is determined to be maliciously tampered code, and a filtering operation is performed. The processor can also de-tag the tagged security feedback content to obtain the security feedback content and send it back to the client.
[0045] The technical solution of this invention enhances the randomness of the defense form by dynamically updating the current randomized label. It does not depend on the attacker's attack method and can respond to new attacks or attack variants in real time. It also performs dual attack detection of access requests through security detection and behavioral analysis, thereby improving the attack detection and defense capabilities.
[0046] As a first optional embodiment of this embodiment, based on the above embodiment, the update steps of the current randomized label can be refined as follows:
[0047] Obtain the basic update cycle and current network attack association features; determine the jitter factor based on the attack frequency and context information in the network attack association features; determine the current update cycle based on the basic update cycle and jitter factor; when the network attack association features include attack events or abnormal traffic or the current update cycle is reached, update the attributes of the current randomized tag based on the multi-modal parser.
[0048] In this embodiment, the basic update cycle can be understood as the preset label update baseline time (which can be denoted as T) that triggers label updates. Network attack association features can be understood as a set of detectable features related to XSS attacks, including attack frequency (the frequency of recent attacks), attack events (such as failed or successful XSS attack attempts), abnormal traffic (such as high-frequency scanning, abnormal IP access, etc.), and other contextual information (such as the time and source of the attack). This is the core basis for triggering label updates and calculating the jitter factor. Attack frequency can be understood as a key indicator of network attack association features, referring to the number of XSS attack attempts or related abnormal behaviors detected per unit time in the recent period. It is used to dynamically adjust the jitter factor to adapt to the attack intensity. Contextual information can be understood as auxiliary reference information related to network attacks, including the IP address initiating the attack, access time period, request type, historical attack records, etc., used to accurately judge the attack situation and assist in determining the value of the jitter factor. The jitter factor (which can be denoted as λ) can be understood as a parameter dynamically adjusted based on recent attack frequency and contextual information (such as 10% of the basic update cycle T). The current update cycle can be understood as the actual update cycle after adjusting the base update cycle using a jitter factor. Attack events can be understood as detected XSS attack attempts (whether successful or not), including explicit attack behaviors such as malicious payload injection and vulnerability exploitation attempts. Abnormal traffic can be understood as network traffic deviating from normal access patterns, such as high-frequency repeated requests, large amounts of access during non-business hours, and concentrated scanning of abnormal IP addresses. It is an important component of network attack correlation characteristics and can trigger targeted tag updates. A multi-modal parser can be understood as an analysis tool that can automatically select the appropriate parser (such as an HTML DOM parser, JavaScript AST parser, etc.) based on file extensions (.html, .js, .vue, etc.) and content characteristics.
[0049] Specifically, the processor can obtain a pre-set basic update cycle and current network attack correlation characteristics. The basic update cycle T can be set via a basic timer. Before each update, instead of simply waiting for T, the processor calculates the current update cycle T' based on a jitter factor λ, i.e., T' = T + λ. Here, λ is a jitter factor dynamically adjusted within the range [-J, +J] based on the attack frequency and context information in the network attack correlation characteristics (for example, if the original scheduled task cycle is 1 day (T is 86400 seconds), the jitter factor is the value adjusted on 86400; for example, -600 means the update time is 86400 - 600). The jitter factor value corresponding to different values of attack frequency and other context information can be set using a mapping table. For example, a higher attack frequency should result in a shorter interval, thus reducing the jitter factor. This makes the update time unpredictable, and the lifecycle of the attack payload becomes uncertain, significantly increasing the difficulty of the attack. Targeted triggering is based on threat perception signals and is event-driven. It strengthens immediately upon the appearance of a threat. When an XSS attack attempt (even if it fails) or abnormal traffic (high-frequency scanning or abnormal access) is detected, an update command is immediately sent to the randomization mechanism to trigger a timely and mandatory randomization update, without considering whether the scheduled task has reached the triggering condition.
[0050] Specifically, the above method involves irregularly triggered updates based on the current update cycle. Alternatively, targeted triggering can be configured. This triggering strategy is based on threat perception signals and is event-driven, immediately strengthening upon the detection of a threat. Targeted triggering is triggered when the network attack association characteristics include attack events or abnormal traffic. By using both targeted and irregular triggering methods, it can be determined whether a tag update is necessary. When the network attack association characteristics include attack events or abnormal traffic, or when the current update cycle is reached, the processor can analyze the syntax corresponding to the web application's code using a multi-modal parser, and based on the analysis results, accurately locate the currently randomized tags, thereby updating their attributes.
[0051] For example, the entire triggering mechanism described above can be specifically illustrated using a task scheduling framework. Figure 2 is a flowchart of a task scheduling example in a secure transmission method provided in Embodiment 1 of the present invention, which includes four core components: a scheduling center, task storage, executor, and system monitoring. Its workflow design is shown in Figure 2: The user first submits a task definition (i.e., the triggering conditions and update method mentioned above) to the scheduling center. The scheduling center reads the basic update cycle from the task storage system. Then, the scheduling center enters the cyclic scheduling stage. In each cycle, the triggering decision is dynamically calculated based on two paths: irregular time triggering and event triggering. When the triggering condition is reached, a task execution instruction (i.e., the tag update instruction) is sent to the executor. After receiving the instruction, the executor executes the specific task logic (i.e., updates the attributes of the current randomized tag based on the multi-mode parser). After the update is completed, the success / failure status is reported to the monitoring system, and the status information in the task storage is updated. If the task execution is abnormal, the monitoring system immediately triggers an alarm to notify the user, forming a closed-loop process from task submission, scheduling triggering, execution feedback to status monitoring.
[0052] Furthermore, based on the above embodiments, the steps for updating the attributes of the current randomized tag using a multi-modal parser can be refined as follows:
[0053] Based on the path of the web application's source code, traverse the application file directory; determine the target parser that matches the application file directory based on the multi-modal parser; convert the source code into a structure tree through the target parser, and determine the target tag from the structure tree; update the attributes of the target tag based on the randomly generated attribute values, and generate the current randomized tag.
[0054] In this embodiment, the path of the web application's source code can be understood as the specific location identifier where the web application's source code files are stored. The application file directory can be understood as a hierarchical directory structure containing all the web application's source code files, covering different types of code files such as .html, .js, and .vue, and is the scope of the traversal operation. The target parser can be understood as the parsing tool corresponding to the application file, used to convert the code into a structured form. The original code of the web application can be understood as code written in languages such as HTML, JavaScript, and Vue, and is the original object after randomization. The structure tree can be understood as a structured tree representation formed after the source code is converted by the target parser. Target tags can be understood as the JS / HTML tags of the web application (i.e., template tags in the syntax). Randomly generated attribute values can be understood as dynamically generated random parameters (such as $randomId), possessing randomness and uniqueness, used as security identifier attribute values for target tags.
[0055] Specifically, the processor can locate the corresponding application file directory based on the path of the web application's source code. It then traverses this directory to obtain all source code files (covering various file types such as .html, .js, and .vue). A multi-modal parser is invoked to analyze each obtained source code file. Based on the file extension (e.g., .html, .js, .vue) and content characteristics, an appropriate target parser is automatically selected and determined (e.g., HTML files match the HTML DOM parser, JavaScript files match the JavaScript AST parser). Using the determined target parser, the corresponding source code file is converted into a structured tree representation (structure tree). Leveraging the clear hierarchy and node relationships of the structure tree, accurate and lossless location of target tags is achieved, avoiding the incomplete matching and mismatch problems that occur with traditional matching methods. After locating the target tag (DOM / AST node) in the structure tree, for example, the `setAttribute` function can be called to insert or update dynamically generated random attribute values into the target tag (during environment initialization, the processor can call the dynamic randomization engine to adaptively perform randomization operations on the web application and deploy updates to the server; that is, the first randomization adds attributes, and subsequent dynamic updates replace attribute values). Finally, a currently randomized tag carrying a random security identifier is generated (e.g., using the `` tag as an example). (and ensure that the updated code syntax is complete and the functionality is not affected).
[0056] For example, the steps of randomized attribute updating can be illustrated with a specific example. Figure 3 is a flowchart of attribute updating in a secure transmission method provided in Embodiment 1 of the present invention. The randomization algorithm is mainly divided into three parts, as shown in Figure 3. First, the application file directory is traversed according to the path of the application source code. Second, a multi-mode parser is introduced to automatically select and call the corresponding target parser (such as HTML DOM parser, JavaScript AST parser, Vue SFC custom parser, etc.) based on the file suffix (such as .html, .js, .vue, etc.) and content characteristics, converting the source code into a structured tree representation to achieve accurate and lossless positioning of target tags and attributes. Finally, node traversal and query operations are performed directly on the tree structure, and the setAttribute function is directly called on the target DOM / AST node to insert or update the dynamically generated attribute value (adding the attribute during the first randomization and updating the attribute during subsequent dynamic randomizations). For example, taking the a tag as an example, a random parameter $randomId is generated, and the randomized form is as follows: .
[0057] In the first optional embodiment of this invention, a multi-modal parser is introduced to analyze the code structure. This randomization method solves the inherent defects of existing matching methods when facing complex code structures, such as incomplete matching, matching errors, and code syntax violations. It improves the accuracy of tag randomization while ensuring the syntactic integrity and functional consistency of the output code. Furthermore, the randomization is designed as a dynamically triggered mode, employing a triggering strategy based on "irregular triggering" and driven by "targeted triggering" to update target tags. This enhances the randomness of the defense approach. "Irregular triggering" prevents attackers from predicting the update time, while "targeted triggering" eliminates the time blind spot that still exists within the update interval. This idea of dynamic heterogeneity of tags is independent of the attacker's attack method and can respond to new attacks or attack variants in real time.
[0058] Furthermore, while deep learning models have significantly improved detection accuracy, they still have shortcomings, such as strong data dependence. If the training data does not cover new attack variants, the model may fail to detect unknown attacks, resulting in false positives or false negatives, thus limiting its generalization ability. Additionally, they are easily deceived by adversarial examples, causing the model to produce incorrect predictions. To address this issue, as a second optional embodiment of this first embodiment, based on the above embodiments, the training steps of the target detection model can be refined as follows:
[0059] The initial detection model and original data sample set are obtained; the original data sample set is cleaned and standardized to obtain the first sample set; the first sample set is parsed and labeled with context to obtain the second sample set with type labels; the second sample set is enhanced at the semantic labeling layer to obtain the third sample set; the third sample set is fused with multi-channel features to obtain the fourth sample set; the length of the fourth sample set is processed based on the type labels to obtain the adversarial enhanced sample set that retains key information; the initial detection model is trained based on the adversarial enhanced sample set that retains key information to obtain the target detection model.
[0060] In this embodiment, the initial detection model can be understood as an untrained, initialized detection model, such as a CNN-LSTM hybrid model. The original data sample set can be understood as an initial dataset composed of normal network access data (negative samples) and XSS attack-related data (positive samples), which is the original data source for model training and has not undergone any preprocessing. The first sample set is a normalized dataset obtained after cleaning and standardization of the original data sample set. The second sample set is a dataset obtained after context parsing and labeling, where each sample exists in the form of a label sequence, and each label is accompanied by a type label, clearly presenting the semantic and structural features of the sample. The third sample set is an expanded dataset obtained after semantic labeling enhancement, containing original samples and various variant samples, which can improve the model's adaptability to attack variants. Type labels can be understood as classification identifiers attached to sample labels, including high-risk semantic labels, used to distinguish attack-related key features from ordinary features in the sample, and are the core reference for length processing. The fourth sample set is a numerical dataset obtained after multi-channel feature fusion, with heterogeneous feature sequences as the core, adapting to the input format requirements of the model. The adversarial enhancement sample set that retains key information can be understood as the model training dataset that has been lengthened.
[0061] Specifically, the processor or relevant personnel can first collect relevant XSS data and normal data as positive and negative examples, respectively, to form the original data sample set. The processor can first perform basic cleaning and standardization on the original data sample set by deduplication, URL decoding, etc., to obtain the first sample set. A syntax context parser is then used to perform context parsing and tokenization on the payload dataset in the first sample set, making each sample a token sequence, with each token accompanied by a type label (e.g., type labels can distinguish between no-risk, low-risk, medium-risk, and high-risk types), resulting in a second sample set with type labels. The processor can further enhance the second sample set at the semantic tagging layer by applying a series of security mutation rules simulating attacker techniques, such as equivalent substitution, redundant insertion, and multi-layer coding, to expand the second sample set, obtaining a third sample set, thus increasing the diversity and complexity of the dataset. The processor can then transform the semantic tag sequences of the enhanced third sample set into numerical heterogeneous feature sequences based on the tag type through multi-channel (semantic embedding, structural encoding) feature fusion, resulting in a fourth sample set. The processor can process the sequence length of the fourth sample set: when converting variable-length feature sequences into fixed-length sequences, it does not simply truncate them from the beginning and end, but prioritizes retaining the identified high-risk semantic type labels and their contextual information to ensure that key features are not lost. Finally, the two-dimensional matrix [sequence length, fused feature dimension] formed during the data processing stage is used as the adversarial enhancement sample set. The initial detection model is trained based on the adversarial enhancement sample set to obtain the target detection model.
[0062] The second optional embodiment of Embodiment 1 of the present invention improves feature extraction accuracy by using syntax context awareness, tagging, and reconstruction. It also enhances the diversity and complexity of the training set by supplementing adversarial samples with security mutation rules that simulate attacker techniques. Semantic tagging and reconstruction improve XSS detection accuracy, and adversarial sample enhancement allows the model to learn various mutations during training, making it more stable in the face of unknown variants in practical applications.
[0063] Example 2
[0064] Figure 4 is a flowchart of a secure transmission method provided in Embodiment 2 of the present invention. This embodiment is a further refinement of the above embodiments. As shown in Figure 4, the method includes:
[0065] S201. Obtain the client's access request and the current randomization tag pre-assigned to the web application on the server.
[0066] S202. Determine the path of the target detection model based on the access request, and determine whether the target detection model has been loaded into the model pool.
[0067] In this embodiment, the model pool can be understood as a technical architecture for the centralized management, storage, and scheduling of multiple models. The path can be understood as the storage location identifier for object detection model files in the model repository.
[0068] Specifically, when an access request sent by a client reaches the processor, the processor can determine whether the requested content needs to be inspected based on configuration or business logic. If no inspection is required, the model inspection step is skipped. When inspection is required, the processor can query the model repository based on the information in the access request to determine the storage path of the target detection model suitable for the scenario. The processor can also check whether the target detection model has been loaded into the model pool (i.e., whether there is a usable instance of the model in the model pool).
[0069] S203. If already loaded, the target detection model is called from the model pool, the payload in the access request is input into the target detection model, and the output security detection result is obtained.
[0070] In this embodiment, the payload can be understood as the core data content carried in the access request (such as form submission data, interface parameters, script fragments, etc.), which is the carrier that may inject malicious code in an XSS attack, and also the input data of the target detection model.
[0071] Specifically, if the target detection model has been loaded into the model pool, the processor can directly call the model instance from the model pool without having to fetch the file separately. At the same time, it extracts the payload from the access request and inputs it into the target detection model after the call. The model uses its built-in feature extraction and classification logic to perform XSS attack feature detection on the payload and finally outputs the security detection result.
[0072] S204. If not loaded, the model file of the target detection model will be loaded into the model pool based on the path, and the payload will be input into the target detection model to obtain the security detection result.
[0073] In this embodiment, the model file can be understood as a complete executable file of the object detection model, which contains core information such as model structure configuration and trained parameter weights. It is stored in the model repository and needs to be loaded into the model pool before detection inference can be performed.
[0074] Specifically, if the target detection model is not loaded into the model pool, the processor can retrieve the complete model file of the model from the model repository based on the obtained model path; load the model file into the model pool and initialize it to generate an executable model instance; then, extract the payload from the access request and input it into the target detection model that has just been loaded; the model performs detection inference and outputs the security detection result, while the model instance will be retained in the model pool for subsequent similar requests to call directly.
[0075] Furthermore, the processor can periodically check the usage of models in the model pool. If a model has not been used within a specified time, it is triggered to unload and release resources. The model pool confirms the unloading of the model and releases the relevant resources. In the edge model scheduling mechanism, the processor can support dynamic switching of multiple models according to diverse edge scenario requirements, enhancing its flexibility. The model pool reduces model loading latency and improves its overall performance through efficient cache management and resource optimization. Compared to cluster deployment and full-scale large models in the cloud, edge node models are deployed on the same server as the processor, and the deployed models are lightweight models that only need to be called through a local HTTP interface to intercept known attacks in real time. Through the above methods, seamless adaptation to diverse business scenarios and model update requirements is ultimately achieved.
[0076] S205. If the security test result is secure, the access request will be sent to the server and the server's response will be received.
[0077] S206. Parse the response results and determine whether the parsed content contains dynamically randomized tag attributes.
[0078] In this embodiment, the parsed content can be understood as the result of performing syntactic analysis on the response body. Dynamically randomized tag attributes can be understood as random attributes added to trusted JS / HTML tags.
[0079] Specifically, when a response result is received, the processor can perform a comprehensive analysis of the core content of the response result to obtain the analyzed content and determine whether there are preset dynamic randomized tag attributes in the analyzed content.
[0080] S207. If it does not exist, then it is determined that there is malicious input in the response result.
[0081] In this embodiment, malicious input can be understood as input types that contain malicious content such as XSS attack scripts.
[0082] Specifically, if it does not exist, it means that there is untrusted code in the response result, that is, illegal content injected by the attacker. It is directly determined that there is malicious input in the response result, and a filtering operation is performed.
[0083] S208. If it exists, determine whether the dynamically randomized tag attribute is consistent with the current randomized tag.
[0084] Specifically, if it exists, the processor can further compare the actual value of the attribute with the attribute value of the current randomized tag stored on the server to determine whether the two are consistent.
[0085] S209. If they match, the response result is determined to be the security feedback content and sent to the client.
[0086] Specifically, if they are completely consistent, it means that the response result is a trusted code legally generated by the server. It is determined to be safe feedback content, and the dynamic randomization tag attribute is removed (to avoid leakage of defense mechanisms). Then, the processed safe feedback content is forwarded to the client.
[0087] S210. If there is a discrepancy, it is determined that there is malicious input in the response result.
[0088] Specifically, if the attribute values are inconsistent, it indicates that there is untrusted code in the response content, which is determined to be malicious input. Therefore, a filtering and interception operation is performed, and the code is not forwarded to the client.
[0089] The technical solution of this invention employs a fusion of structure randomization and deep learning for security detection. Structure randomization compensates for the vulnerability of deep learning to adversarial attacks, while deep learning supplements the client-side attacks that structure randomization cannot cover. Through deep collaboration, the two significantly improve the detection and defense capabilities against XSS attacks. Malicious code in server responses is analyzed and filtered, ensuring that the code returned to the client is processed and trusted. Furthermore, the removal of dynamic attributes prevents the dynamic randomization defense mechanism from being leaked to attackers through browser elements, thus improving transmission security.
[0090] Example 3
[0091] Figure 5 is a schematic diagram of a secure transmission device provided in Embodiment 3 of the present invention. As shown in Figure 5, the device includes:
[0092] The information acquisition module 31 is used to acquire the client's access request and the current randomized label pre-assigned to the web application on the server. The current randomized label is updated by network attack association features.
[0093] Security detection module 32 is used to schedule a pre-trained target detection model based on the access request and determine the security detection result of the access request;
[0094] The result receiving module 33 is used to send the access request to the server if the security detection result is secure, and to receive the response result fed back by the server.
[0095] The information feedback module 34 is used to perform behavioral analysis on the response result based on the current randomized label, determine the security feedback content, and feed it back to the client.
[0096] The technical solution of this invention enhances the randomness of the defense form by dynamically updating the current randomized label. It does not depend on the attacker's attack method and can respond to new attacks or attack variants in real time. It also performs dual attack detection of access requests through security detection and behavioral analysis, thereby improving the attack detection and defense capabilities.
[0097] Optionally, the device further includes a tag updating module.
[0098] The tag update module includes:
[0099] The feature acquisition unit is used to acquire the basic update cycle and the current network attack-related features;
[0100] The factor determination unit is used to determine the jitter factor based on the attack frequency and context information in the network attack association features;
[0101] The cycle determination unit is used to determine the current update cycle based on the basic update cycle and the jitter factor;
[0102] The tag update unit is used to update the attributes of the current randomized tag based on the multi-modal parser when the network attack association features include an attack event or abnormal traffic or when the current update cycle is reached.
[0103] Specifically, the tag update unit is used for:
[0104] Traverse the application file directory based on the path of the web application's source code;
[0105] A target parser that matches the application file directory is determined based on a multi-modal parser.
[0106] The target parser converts the source code into a structure tree and determines the target label from the structure tree;
[0107] The attributes of the target tag are updated based on the randomly generated attribute values to generate the current randomized tag.
[0108] Furthermore, the security detection module 32 is specifically used for:
[0109] The path of the target detection model is determined based on the access request, and it is determined whether the target detection model has been loaded into the model pool.
[0110] If already loaded, the target detection model is called from the model pool, and the payload in the access request is input into the target detection model to obtain the output security detection result;
[0111] If not loaded, the model file of the target detection model is loaded into the model pool based on the path, and the payload is input into the target detection model to obtain the security detection result.
[0112] Furthermore, the information feedback module 34 is specifically used for:
[0113] The response result is parsed to determine whether the parsed content contains dynamically randomized tag attributes;
[0114] If not, then it is determined that malicious input exists in the response result;
[0115] If it exists, determine whether the dynamic randomization tag attribute is consistent with the current randomization tag;
[0116] If they match, the response result is determined to be security feedback content and is sent back to the client;
[0117] If there is a discrepancy, it is determined that there is malicious input in the response result.
[0118] Optionally, the device further includes a model training module.
[0119] The model training module is specifically used for:
[0120] Obtain the initial detection model and the original data sample set;
[0121] The original data sample set is cleaned and standardized to obtain the first sample set;
[0122] The first sample set is parsed and labeled to obtain a second sample set with type labels.
[0123] The second sample set is enhanced at the semantic tagging layer to obtain the third sample set;
[0124] Multi-channel feature fusion is performed on the third sample set to obtain the fourth sample set;
[0125] The fourth sample set is length-processed based on the type label to obtain an adversarial enhancement sample set that retains key information;
[0126] The initial detection model is trained based on the adversarial enhancement sample set that retains key information to obtain the target detection model.
[0127] The secure transmission device provided in the embodiments of the present invention can execute the secure transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.
[0128] Example 4
[0129] Figure 6 illustrates a schematic diagram of an electronic device 40 that can be used to implement embodiments of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.
[0130] As shown in Figure 6, the electronic device 40 includes at least one processor 41 and a memory, such as a read-only memory (ROM) 42 or a random access memory (RAM) 43, communicatively connected to the at least one processor 41. The memory stores computer programs executable by the at least one processor. The processor 41 can perform various appropriate actions and processes based on the computer program stored in the ROM 42 or loaded into the RAM 43 from storage unit 48. The RAM 43 can also store various programs and data required for the operation of the electronic device 40. The processor 41, ROM 42, and RAM 43 are interconnected via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.
[0131] Multiple components in electronic device 40 are connected to I / O interface 45, including: input unit 46, such as keyboard, mouse, etc.; output unit 47, such as various types of monitors, speakers, etc.; storage unit 48, such as disk, optical disk, etc.; and communication unit 49, such as network card, modem, wireless transceiver, etc. Communication unit 49 allows electronic device 40 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.
[0132] Processor 41 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 41 performs the various methods and processes described above, such as secure transmission methods.
[0133] In some embodiments, the secure transmission method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 40 via ROM 42 and / or communication unit 49. When the computer program is loaded into RAM 43 and executed by processor 41, one or more steps of the secure transmission method described above may be performed. Alternatively, in other embodiments, processor 41 may be configured to perform the secure transmission method by any other suitable means (e.g., by means of firmware).
[0134] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.
[0135] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.
[0136] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.
[0137] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).
[0138] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.
[0139] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.
[0140] In one embodiment, the present invention further includes a computer program product, which includes a computer program that, when executed by a processor, implements the secure transmission method of any embodiment of the present invention.
[0141] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages or a combination thereof. Programming languages include object-oriented programming languages such as Java, Smalltalk, and C++, as well as conventional procedural programming languages such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0142] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.
[0143] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.
Claims
1. A secure transmission method, characterized in that, include: Obtain the client's access request and the current randomized label pre-assigned to the web application on the server. The current randomized label is updated by triggering network attack association features. Based on the pre-trained target detection model for the access request scheduling, the security detection result of the access request is determined; If the security test result is secure, the access request is sent to the server, and the response result from the server is received. Based on the current randomized label, the response result is analyzed to determine the security feedback content, which is then fed back to the client.
2. The method according to claim 1, characterized in that, The steps for updating the current randomized label include: obtaining the basic update cycle and the current network attack association features; determining the jitter factor based on the attack frequency and context information in the network attack association features; determining the current update cycle based on the basic update cycle and the jitter factor; and updating the attributes of the current randomized label based on a multi-modal parser when the network attack association features include an attack event or abnormal traffic or when the current update cycle is reached.
3. The method according to claim 2, characterized in that, The step of updating the attributes of the current randomized tag based on the multi-modal parser includes: traversing the application file directory according to the path of the web application's source code; determining a target parser that matches the application file directory based on the multi-modal parser; converting the source code into a structure tree through the target parser, and determining the target tag from the structure tree; updating the attributes of the target tag based on randomly generated attribute values, and generating the current randomized tag.
4. The method according to claim 1, characterized in that, The step of scheduling a pre-trained target detection model based on the access request and determining the security detection result of the access request includes: determining the path of the target detection model based on the access request, and determining whether the target detection model has been loaded into the model pool; if it has been loaded, calling the target detection model from the model pool, inputting the payload in the access request into the target detection model, and obtaining the output security detection result; if it has not been loaded, loading the model file of the target detection model into the model pool based on the path, and inputting the payload into the target detection model, and obtaining the security detection result.
5. The method according to claim 1, characterized in that, The step of performing behavioral analysis on the response result based on the current randomized tag, determining the security feedback content, and feeding it back to the client includes: parsing the response result and determining whether the parsed content has a dynamic randomized tag attribute; if it does not exist, then it is determined that there is malicious input in the response result; if it exists, then it is determined whether the dynamic randomized tag attribute is consistent with the current randomized tag; if they are consistent, then it is determined that the response result is security feedback content and fed back to the client; if they are inconsistent, then it is determined that there is malicious input in the response result.
6. The method according to claim 1, characterized in that, The training steps of the target detection model include: acquiring an initial detection model and a raw data sample set; cleaning and standardizing the raw data sample set to obtain a first sample set; performing context parsing and labeling on the first sample set to obtain a second sample set with type labels; enhancing the second sample set at a semantic labeling layer to obtain a third sample set; performing multi-channel feature fusion on the third sample set to obtain a fourth sample set; lengthening the fourth sample set based on the type labels to obtain an adversarial enhancement sample set that retains key information; and training the initial detection model based on the adversarial enhancement sample set that retains key information to obtain the target detection model.
7. A secure transmission device, characterized in that, include: The information acquisition module is used to acquire the client's access request and the current randomized label pre-assigned to the web application on the server. The current randomized label is updated by network attack association features. The security detection module is used to schedule a pre-trained target detection model based on the access request and determine the security detection result of the access request. The result receiving module is used to send the access request to the server if the security detection result is secure, and to receive the response result from the server. The information feedback module is used to perform behavioral analysis on the response result based on the current randomized label, determine the security feedback content, and feed it back to the client.
8. An electronic device, characterized in that, The electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the secure transmission method according to any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the secure transmission method according to any one of claims 1-6.
10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the secure transmission method according to any one of claims 1-6.