A method and system for identifying a service logic attack link based on dynamic behavior

Abstract

The application relates to the technical field of data processing, and discloses a business logic attack link identification method and system based on dynamic behavior, which comprises the following steps: collecting business behavior records for aggregation processing to obtain dynamic behavior segments; performing state analysis on the dynamic behavior segments to obtain pre-state description and post-state description, performing permission judgment to obtain actual occupation permission results; performing credential judgment to obtain access credential inheritance results; extracting pre-sequence dynamic behavior segments and post-sequence dynamic behavior segments, comparing the pre-sequence dynamic behavior segments and the post-sequence dynamic behavior segments, the actual occupation permission results and the access credential inheritance results with preset legal rules respectively; determining abnormal transfer when any comparison is not established; performing supplementary certificate event backtracking on abnormal business objects to obtain business logic attack link identification results. The application improves the identification accuracy of complex business logic attacks, reduces the false positive rate and enhances the attack path restoration capability.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically, to a method and system for identifying business logic attack links based on dynamic behavior. Background Technology

[0002] With the increasing complexity of internet business systems, government and enterprise business platforms, and internal management systems, business logic attacks are no longer limited to single requests or single log anomalies. Instead, they increasingly manifest as multi-step, cross-session, cross-functional page, and even cross-system continuous operations centered around the same business object. These attacks often utilize legitimate accounts, normal interfaces, or existing business paths, exhibiting strong business disguise. Relying solely on source code auditing, single-point anomaly alerts, or isolated log identification often fails to promptly uncover their true attack intent, let alone accurately reconstruct the complete attack chain from triggering to the resulting outcome.

[0003] In existing technologies, such as Chinese invention patent CN110135166A, a method and system for detecting business logic vulnerability attacks are disclosed. The main technical idea is to obtain business logs generated by the business system, preprocess the business logs, extract the information to be identified, and then input them into a preset identification model to obtain the business logic attack identification result. This solution can complete attack identification based on business logs, but its focus is still on attack discrimination of single logs or log samples. When faced with scenarios where multiple business actions are scattered in different time periods, different sessions, or different processing stages, it is easy to encounter problems such as only identifying isolated anomalies, difficulty in stably determining whether multiple actions have a real business relationship, and difficulty in reconstructing the trigger path from the abnormal results. This affects the overall identification effect and source tracing efficiency of complex business logic attacks.

[0004] Therefore, it is necessary to design a business logic attack link identification method and system based on dynamic behavior to solve the problems existing in the current technology. Summary of the Invention

[0005] In view of this, the present invention proposes a business logic attack link identification method and system based on dynamic behavior, aiming to solve the problem that it is difficult to perform stable correlation analysis around the same business object for business behaviors scattered in different times, different sessions and different processing stages, resulting in low accuracy of business logic attack link identification and insufficient attack path reconstruction capability.

[0006] This invention proposes a method for identifying business logic attack chains based on dynamic behavior, comprising: Collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object; The dynamic behavior segment is parsed to obtain the preceding and following state descriptions. The permission of the dynamic behavior segment is determined based on the resource access scope, action impact scope, and authorization records to obtain the actual access permission result. The access credential is determined based on the issuance source, renewal source, and expiration time of the access credential to obtain the access credential inheritance result. Extract the preceding dynamic behavior fragments and the following dynamic behavior fragments that act on the same business object within the preset playback window. Compare the subsequent state description of the preceding dynamic behavior fragment with the preceding state description of the following dynamic behavior fragment, the actual permission occupancy result, and the access credential inheritance result with preset legal rules respectively. When any comparison fails, an abnormal transfer is identified; a supplementary verification event is performed on the business object corresponding to the abnormal transfer. If no supplementary verification event covering the execution action corresponding to the abnormal transfer is found, the dynamic behavior fragment triggered by the abnormal transfer is traced forward and the result dynamic behavior fragment is traced backward to obtain the business logic attack chain identification result.

[0007] Furthermore, when aggregating the business behavior records, the process includes: merging business behavior records that are related to each other according to the business object identifier, the associated request relationship, and the preset time interval, to generate dynamic behavior fragments corresponding to the same business object.

[0008] Furthermore, when performing state parsing on the dynamic behavior fragment, the process includes: determining the process state, approval state, export license state, and modification license state corresponding to the dynamic behavior fragment based on the executed action, action result, and business behavior record, and generating the preceding state description and the following state description.

[0009] Furthermore, when determining permissions for the dynamic behavior fragment, the process includes: determining the actual access permissions corresponding to the execution action based on the resource access scope and the scope of action influence, and comparing the actual access permissions with the authorized object, authorized scope and authorized validity period recorded in the authorization record to obtain the actual access permission result.

[0010] Furthermore, when determining the actual occupancy permissions corresponding to the execution action based on the resource access scope and the action impact scope, the process includes: summarizing the resource types, resource quantities, number of affected objects, and impact result types involved in the execution action to generate the actual occupancy permissions corresponding to the execution action.

[0011] Furthermore, when determining the credentials for the dynamic behavior fragment, the process includes: determining whether there is a legitimate inheritance relationship between the preceding dynamic behavior fragment and the following dynamic behavior fragment based on the issuing source, renewal source, and expiration time of the access credential, and generating the access credential inheritance result.

[0012] Furthermore, when comparing with the preset legal rules, the process includes: splitting the subsequent state description of the preceding dynamic behavior segment and the preceding state description of the subsequent dynamic behavior segment into corresponding state items, and comparing each corresponding state item according to the preset legal rules; when each corresponding state item satisfies the preset legal rules, the state comparison is determined to be successful; when any corresponding state item does not satisfy the preset legal rules, the state comparison is determined to be unsuccessful.

[0013] Furthermore, when performing a reverse lookup of the supplementary verification event for the business object corresponding to the abnormal transfer, the process includes: retrieving, within a preset verification window, the approval confirmation event, supplementary authorization event, or rollback confirmation event corresponding to the execution action corresponding to the abnormal transfer; and determining that the supplementary verification event cannot cover the execution action corresponding to the abnormal transfer when the business object, authorization scope, and action sequence of the supplementary verification event do not match those of the execution action corresponding to the abnormal transfer.

[0014] Furthermore, when tracing back the triggering dynamic behavior segment from the abnormal transfer and tracing back the result dynamic behavior segment, the process includes: determining causal association based on the business object identifier, associated request relationship, preceding state description, following state description, and access credential inheritance result; identifying the dynamic behavior segment located before the abnormal transfer whose following state description connects with the preceding state description corresponding to the abnormal transfer as the triggering dynamic behavior segment; identifying the dynamic behavior segment located after the abnormal transfer whose preceding state description connects with the following state description corresponding to the abnormal transfer as the result dynamic behavior segment; and generating a business logic attack chain identification result.

[0015] Compared with existing technologies, the beneficial effects of this invention are as follows: By aggregating business behavior records around the same business object, dynamic behavior fragments that reflect the preceding and following relationships are formed. Based on this, state parsing, permission determination, and credential determination are introduced to jointly verify business actions in three dimensions: state continuity, permission occupation, and credential inheritance. This allows for a more accurate distinction between normal continuous business operations and business logic attacks disguised as normal processes. By extracting preceding and subsequent dynamic behavior fragments within a preset review window and combining them with preset legal rules to identify abnormal transfers, abnormal behaviors originally scattered across different time periods, sessions, or processing stages can be linked into a causal chain. This technology enhances the completeness of identification for complex attack scenarios. By performing a reverse lookup of the business objects corresponding to abnormal transfers, it can exclude business processing situations with legitimate supplementary evidence before tracing the attack chain, thereby reducing false alarm rates and improving the reliability of identification results. Furthermore, by tracing back the triggering dynamic behavior fragments from the abnormal transfer and tracking the result dynamic behavior fragments backward, it can reverse the triggering path from the abnormal result and locate the impacting result. This not only discovers attacks but also outputs more complete and clearer business logic attack chain identification results. Compared with existing technologies that only rely on log sample discrimination, this technology is more conducive to improving the identification accuracy, chain reconstruction capability, and source tracing analysis efficiency of complex business logic attacks.

[0016] On the other hand, this application also provides a business logic attack chain identification system based on dynamic behavior, used to apply the above-mentioned business logic attack chain identification method based on dynamic behavior, including: The collection unit is configured to collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object. The processing unit is configured to perform state parsing on the dynamic behavior segment to obtain a preceding state description and a following state description, and to perform permission determination on the dynamic behavior segment based on the resource access scope, action impact scope and authorization record to obtain the actual access permission result; and to perform credential determination on the dynamic behavior segment based on the issuance source, renewal source and expiration time of the access credential to obtain the access credential inheritance result. The judgment unit is configured to extract the preceding dynamic behavior fragment and the following dynamic behavior fragment that act on the same business object within a preset playback window, and compare the subsequent state description of the preceding dynamic behavior fragment with the preceding state description of the following dynamic behavior fragment, the actual occupied permission result, and the access credential inheritance result with preset legal rules respectively. The verification unit is configured to determine an abnormal transfer when any comparison fails; perform a reverse lookup of the supplementary verification event on the business object corresponding to the abnormal transfer; if no supplementary verification event covering the execution action corresponding to the abnormal transfer is found, trace back the triggered dynamic behavior fragment from the abnormal transfer and trace the result dynamic behavior fragment backward to obtain the business logic attack chain identification result.

[0017] It is understandable that the above-mentioned business logic attack link identification method and system based on dynamic behavior have the same beneficial effects, and will not be elaborated further here. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart of a business logic attack link identification method based on dynamic behavior provided in an embodiment of the present invention; Figure 2 A functional block diagram of a business logic attack link identification system based on dynamic behavior provided in an embodiment of the present invention. Detailed Implementation

[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the disclosure to those skilled in the art. It should be noted that, unless otherwise specified, embodiments and features in the embodiments of the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] As business processes in internet business systems, government and enterprise business platforms, and internal management systems become increasingly complex, business logic attacks are no longer limited to single requests or single log anomalies. Instead, they increasingly manifest as multi-step, cross-session, cross-functional page, and even cross-system continuous business operations centered around the same business object. These attacks typically utilize legitimate accounts, normal interfaces, or existing business paths, exhibiting strong business camouflage. Relying solely on source code auditing, single-point anomaly alerts, or isolated log identification is often insufficient to promptly detect the actual attack intent, let alone accurately reconstruct the complete attack chain from triggering to the resulting outcome. Existing business logic attack identification technologies largely focus on attack identification of single log entries or log samples. When faced with complex scenarios where multiple business actions occur at different times, in different sessions, or at different processing stages, they are prone to issues such as only identifying isolated anomalies, difficulty in reliably determining the actual business relationships between multiple actions, and difficulty in reconstructing the trigger path from the abnormal results. This impacts the identification effectiveness and tracing efficiency of complex business logic attacks.

[0021] In some embodiments of this application, see Figure 1 As shown, this application proposes a method for identifying business logic attack chains based on dynamic behavior, including: S100: Collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object.

[0022] S200: Perform state parsing on dynamic behavior fragments to obtain the preceding and following state descriptions. Based on the resource access scope, action impact scope, and authorization records, determine the permissions of the dynamic behavior fragments to obtain the actual access permissions. Based on the issuing source, renewal source, and expiration time of the access credentials, determine the credentials for the dynamic behavior fragments to obtain the access credential inheritance result.

[0023] S300: Extract the preceding and following dynamic behavior segments that act on the same business object within the preset playback window, and compare the subsequent state description of the preceding dynamic behavior segment with the preceding state description of the following dynamic behavior segment, the actual permission occupancy result, and the access credential inheritance result with the preset legal rules respectively.

[0024] S400: When any comparison fails, an abnormal transfer is identified. A retrospective lookup of the event is performed on the business object corresponding to the abnormal transfer. If no retrospective event covering the execution action corresponding to the abnormal transfer is found, the dynamic behavior fragment triggered by the abnormal transfer is traced backward and the result dynamic behavior fragment is traced backward to obtain the business logic attack chain identification result.

[0025] For ease of understanding, the following explanations are provided for some of the terms used in this embodiment. Business behavior records refer to the original logs or event data generated during the operation of the business system, reflecting at least the operation time, operation subject, executed action, operation object, and action result. Business objects refer to entities operated on or managed within the business system, such as user accounts, orders, documents, or approval items. Dynamic behavior fragments refer to a sequence of operations formed by aggregating multiple business behavior records with sequential relationships around the same business object within a predetermined time frame. Pre-state description and post-state description are used to characterize the state of the business object before and after the execution of the dynamic behavior fragment, respectively. The state can at least include process state, approval state, export permission state, and modification permission state. Resource access scope characterizes the resource categories and quantities involved in the executed action, while action impact scope characterizes the scope of impact and result type of the executed action on the business object or system. Authorization records characterize the authorized object, authorization scope, and authorization validity period. Actual permission usage result characterizes whether the actual permission usage of the executed action matches the authorization record. Access credential inheritance result characterizes whether there is a legitimate inheritance relationship between the access credentials of the preceding and subsequent dynamic behavior fragments. Predefined legal rules are used to determine whether state transitions, permission usage, and access credential inheritance comply with business logic and security policies. Abnormal transfers refer to state transfers, permission usage, or access credential inheritance that do not conform to the predefined legal rules. Supplementary verification events are supplementary events used to prove that abnormal transfers comply with standard operating procedures, such as approval confirmation, supplementary authorization, or rollback confirmation. Triggering dynamic behavior fragments are the preceding operation fragments that lead to abnormal transfers, while result dynamic behavior fragments are the subsequent operation fragments triggered after an abnormal transfer occurs.

[0026] In this embodiment, business behavior records are first collected. These records can originate from system logs, database operation records, API call records, or audit records. Subsequently, the business behavior records are aggregated, grouping operations related to the same business object and exhibiting sequential relationships to form dynamic behavior fragments. This transforms scattered, discrete behaviors into analytical units that reflect changes in the state of the business object and its operational trajectory.

[0027] Furthermore, state analysis is performed on dynamic behavior segments. State analysis is used to identify the state changes of business objects before and after the execution of dynamic behavior segments. For example, based on the executed action, the action result, and the contextual information in the business behavior record, the process state, approval state, export license state, and modification license state of the business object before execution can be determined, and it can be determined whether the above states have changed after execution. This forms the pre-state description and post-state description, providing a basis for judging the legality of subsequent state transitions.

[0028] Based on this, permission determination is performed on dynamic behavior fragments. Permission determination is based on the resource access scope and impact scope corresponding to the executed action, combined with the authorized object, authorized scope, and authorized validity period recorded in the authorization record, to determine the actual permission occupied for the executed action. The actual permission occupied result can be used to characterize whether the executed action was performed within the authorized scope, or whether there are situations such as unauthorized access or expired unauthorized access. The actual permission occupied result includes at least two determination results: match and non-match. If the authorized object, authorized scope, and authorized validity period corresponding to the actual permission occupied all satisfy the authorization record, the actual permission occupied result is determined to be a match. If any one of these conditions is not met, the actual permission occupied result is determined to be a non-match.

[0029] Simultaneously, credential verification is performed on dynamic behavior segments. Credential verification determines whether a legitimate inheritance relationship exists between preceding and subsequent dynamic behavior segments based on the issuing source, renewal source, and expiration time of the access credential. For example, if the access credential used by the subsequent dynamic behavior segment was obtained from the access credential in the preceding dynamic behavior segment through a legitimate renewal mechanism and is used within its validity period, the access credential inheritance result can be determined as legitimate. Conversely, it can be determined as illegitimate.

[0030] In some embodiments of this application, the access credential continuation result is determined to be valid if the issuing entity of the access credential is consistent, the continuation path is traceable, and the access credential has not expired. The access credential continuation result is determined to be invalid if the issuing entity is inconsistent, the continuation path is interrupted, the access credential has expired, or the access credential is inconsistent with the entity performing the current action.

[0031] Subsequently, the preceding and following dynamic behavior segments acting on the same business object are extracted within a preset review window. The preset review window limits the time range of the correlation analysis to reduce the interference of irrelevant historical segments on the judgment results. After extracting the preceding and following dynamic behavior segments, the subsequent state description of the preceding dynamic behavior segment is compared with the preceding state description of the following dynamic behavior segment. The actual permission occupancy result and the access credential inheritance result are then compared with preset legal rules. If any comparison fails, an abnormal transfer is determined.

[0032] For identified abnormal transfers, a retrospective verification of the corresponding business object is performed. This retrospective verification identifies whether there are approval confirmation events, supplementary authorization events, or rollback confirmation events that can explain the compliance of the abnormal transfer with regulations. If no retrospective verification event covering the corresponding action of the abnormal transfer is found within the preset verification window, the triggering dynamic behavior fragment is traced backward from the abnormal transfer, and the result dynamic behavior fragment is traced backward, thus forming the business logic attack chain identification result.

[0033] In some embodiments of this application, the aggregation of business behavior records includes: merging business behavior records with sequential relationships according to business object identifiers, associated request relationships, and preset time intervals to generate dynamic behavior fragments corresponding to the same business object. The business object identifier is used to constrain that the merged records all target the same business entity, the associated request relationship is used to identify logically continuous request sequences, and the preset time interval is used to ensure the temporal continuity of the aggregated records. Through the joint constraints of the business object identifier, associated request relationship, and preset time interval, the dynamic behavior fragments can more accurately reflect a series of continuous operations of a specific business object within a predetermined time range.

[0034] In some embodiments of this application, the preset time interval, preset review window, and preset verification window can be configured based on the historical normal sample statistics of the business system, the duration of the business process, and the arrival delay of the authorization event. Specifically, the preset time interval is used to constrain the maximum interval between business behavior records of the same business object during the aggregation phase, and can be set according to the common time span of adjacent normal business behavior records. The preset review window is used to extract preceding and subsequent dynamic behavior segments, and can be set according to the common duration of the same business object in a complete business process. The preset verification window is used to retrieve approval confirmation events, supplementary authorization events, or rollback confirmation events, and can be set according to the common database storage delay of authorization events, rollback events, or approval events in the business system. In one embodiment, the preset time interval can be set to 5 minutes to 30 minutes, the preset review window can be set to 30 minutes to 24 hours, and the preset verification window can be set to 5 minutes to 2 hours.

[0035] In some embodiments of this application, the state parsing of dynamic behavior fragments includes: determining the corresponding process state, approval state, export permission state, and modification permission state based on the executed action, action result, and business behavior record; and generating a pre-state description and a post-state description. The process state characterizes the process stage of the business object; the approval state characterizes whether approval has been obtained and the approval result; the export permission state characterizes whether an export operation is allowed; and the modification permission state characterizes whether a modification operation is allowed. By characterizing the state changes of the business object before and after execution from multiple state dimensions, the accuracy of business logic anomaly identification can be improved.

[0036] In some embodiments of this application, when determining permissions for dynamic behavior segments, the process includes: determining the actual permissions occupied by the executed action based on the resource access scope and the scope of the action's impact; and comparing the actual permissions occupied with the authorized object, authorized scope, and authorized validity period recorded in the authorization record to obtain the actual permissions occupied result. The resource access scope characterizes the resource type and quantity reached by the executed action, and the scope of the action's impact characterizes the number of affected objects and the type of impact result caused by the executed action. Based on the above information, the actual permissions occupied by the executed action are generated and then compared with the authorization record to identify unauthorized operations or permission abuse.

[0037] Furthermore, when determining the actual permissions required for an action based on its resource access scope and impact scope, the types and quantities of resources involved, the number of affected objects, and the types of impact results can be summarized to generate the actual permissions required for the action. This approach allows for a more detailed depiction of the permission requirements for the action in terms of resources, scale, and impact results, thereby improving the reliability of permission determination results.

[0038] In some embodiments of this application, when determining credentials for dynamic behavior segments, the process includes: based on the issuing source, renewal source, and expiration time of the access credential, determining whether there is a legitimate inheritance relationship between the preceding and subsequent dynamic behavior segments, and generating an access credential inheritance result. By examining the legality of the access credential's source, the continuity of the renewal path, and the validity of its usage time, abnormal business operations implemented using expired, forged, or illegally renewed credentials can be identified.

[0039] In some embodiments of this application, the preset legal rules include at least state transition rules, permission matching rules, and access credential inheritance rules. State transition rules can be generated based on business process configuration, state machine definition, or approval flow configuration. Permission matching rules can be generated based on permission model configuration, role authorization table, resource authorization table, and authorization validity period configuration. Access credential inheritance rules can be generated based on session management policies, token renewal policies, and access credential expiration policies. The preset legal rules can be pre-configured before system launch or updated synchronously according to changes in business system version, permission policies, and process configuration.

[0040] In some embodiments of this application, the comparison with preset legal rules includes: splitting the subsequent state description of the preceding dynamic behavior segment and the preceding state description of the subsequent dynamic behavior segment into corresponding state items, and comparing each corresponding state item item by item according to the preset legal rules. If all corresponding state items satisfy the preset legal rules, the state comparison is determined to be successful. If any corresponding state item does not satisfy the preset legal rules, the state comparison is determined to be unsuccessful. Since the preceding and subsequent state descriptions typically contain multiple state dimensions, splitting them into corresponding state items allows for the location of specific state items that do not conform to the preset legal rules, thereby improving the accuracy of abnormal transfer identification.

[0041] In some embodiments of this application, when performing a reverse lookup of the supplementary verification event for the business object corresponding to the abnormal transfer, the process includes: retrieving, within a preset verification window, approval confirmation events, supplementary authorization events, or rollback confirmation events corresponding to the execution action corresponding to the abnormal transfer. If the business object, authorization scope, and action sequence of the supplementary verification event do not match the execution action corresponding to the abnormal transfer, it is determined that the supplementary verification event cannot cover the execution action corresponding to the abnormal transfer. Specifically, the supplementary verification event is determined to cover the execution action corresponding to the abnormal transfer only if the business object corresponding to the supplementary verification event is the same as the business object corresponding to the abnormal transfer, the authorization scope of the supplementary verification event covers the execution action corresponding to the abnormal transfer, the occurrence time of the supplementary verification event falls within the preset verification window, and the type of the supplementary verification event matches the type of the execution action. Otherwise, it is determined that the supplementary verification event cannot cover the execution action corresponding to the abnormal transfer. This reverse lookup mechanism can distinguish between business processing situations that have been legally remedied, legally authorized, or legally revoked and genuine abnormal attack behavior, thereby reducing the false alarm rate.

[0042] In some embodiments of this application, when tracing forward the triggering dynamic behavior segment from the abnormal transfer and backward the result dynamic behavior segment, causal association determination can be performed based on the business object identifier, the associated request relationship, the preceding state description, the following state description, and the access credential inheritance result. Specifically, the dynamic behavior segment located before the abnormal transfer and whose following state description is connected to the preceding state description corresponding to the abnormal transfer is determined as the triggering dynamic behavior segment. The dynamic behavior segment located after the abnormal transfer and whose preceding state description is connected to the following state description corresponding to the abnormal transfer is determined as the result dynamic behavior segment. This generates a business logic attack chain identification result. When performing causal association determination, it is preferable to include the corresponding dynamic behavior segment in the same business logic attack chain only when the business object identifier is consistent, the associated request relationship is connected, the state description satisfies the connection relationship, and the access credential inheritance result does not conflict with the preset legal rules, so as to reduce the risk of false association caused by simple temporal proximity. In the above way, scattered anomalies can be organized into a complete attack chain with contextual relationships.

[0043] The technical solution of this application will be further explained below in conjunction with specific application scenarios.

[0044] In an online loan approval system, User A attempts to exploit a system vulnerability to obtain an illegal loan. The system continuously collects User A's business activity records within the loan approval system, including user operation logs and system event logs. Assume User A submits a loan application at 10:00 AM, modifies the loan amount through an interface at 10:30 AM, and attempts to export the modified loan contract at 10:45 AM.

[0045] First, the aforementioned business activity records are aggregated. Based on the unique identifier of the loan application, the relationship between each request, and the preset time interval, three dynamic behavior segments surrounding the same loan application can be generated: submitting the loan application segment, modifying the loan amount segment, and exporting the loan contract segment.

[0046] For the submitted loan application segment, its status analysis result can be represented as follows: no business status before execution, and pending approval, unapproved, export not allowed, and modification allowed after execution. The permission determination result indicates that user A has the legal permission to submit a loan application. The credential determination result indicates that the access credentials are valid.

[0047] For the segment involving modifying the loan amount, the status analysis result can be represented as follows: before execution, it is pending approval, not approved, export not allowed, and modification allowed; after execution, it is pending approval, not approved, export not allowed, and modification not allowed, and the loan amount has been modified. The permission determination result indicates that user A does not have the permission to modify the amount of a submitted loan application. The credential determination result indicates that the access credentials are valid.

[0048] For exporting a loan contract fragment, the status analysis result can be represented as follows: before execution, it is pending approval, not approved, export not allowed, and modification not allowed, and the loan amount has been modified; after execution, the status does not change substantially. The permission determination result indicates that user A does not have the permission to export an unapproved loan contract. The credential determination result indicates that the access credentials are valid.

[0049] Subsequently, the preceding and following dynamic behavior segments corresponding to the same loan application are extracted and compared within the preset review window. For the relationship between submitting the loan application segment and modifying the loan amount segment, the status comparison is successful, and the access credential inheritance result matches the preset legal rules. However, the actual access permission result does not match the preset legal rules, thus confirming an abnormal transfer. Similarly, for the relationship between modifying the loan amount segment and exporting the loan contract segment, the status comparison is successful, and the access credential inheritance result matches the preset legal rules. However, the actual access permission result does not match the preset legal rules, again confirming an abnormal transfer.

[0050] Next, a reverse lookup of supplementary documentation events is performed on the business objects corresponding to the loan application. Within the preset verification window, approval confirmation events, supplementary authorization events, or rollback confirmation events corresponding to modifying the loan amount and exporting the loan contract are retrieved. If no supplementary documentation event covering the above actions is found, the abnormal transfer is used as the starting point for tracing back and forth. For the first abnormal transfer between submitting the loan application segment and modifying the loan amount segment, the loan application submission segment can be identified as the triggering dynamic behavior segment of the first abnormal transfer, and the loan amount modification segment can be identified as the result dynamic behavior segment of the first abnormal transfer. For the second abnormal transfer between modifying the loan amount segment and exporting the loan contract segment, the loan amount modification segment can be identified as the triggering dynamic behavior segment of the second abnormal transfer, and the loan contract export segment can be identified as the result dynamic behavior segment of the second abnormal transfer. After merging the first and second abnormal transfers, the following business logic attack chain identification results can be generated: submitting a loan application, illegally modifying the loan amount, and attempting to export the illegally modified loan contract.

[0051] Compared to existing technologies, this solution aggregates business behavior records, linking scattered and seemingly independent business operations into dynamic behavior fragments. This solves the problem of existing technologies struggling to determine the true business relationships between multiple actions. By performing state parsing, permission determination, and credential verification on these dynamic behavior fragments, and comparing them with preset legal rules across multiple dimensions, it can more accurately identify highly disguised business logic anomalies. When an anomaly is detected and there is no supplementary evidence event covering it, this solution can use the anomaly as a starting point to trace back the triggering dynamic behavior fragments through causal correlation determination and then trace the resulting dynamic behavior fragments backward. This allows for a complete reconstruction of the entire attack chain from attack triggering to result formation, solving the problem of existing technologies struggling to reverse-engineer the trigger path from abnormal results. This improves the identification and tracing efficiency of complex business logic attacks.

[0052] Based on another preferred embodiment described above, see [link to preferred embodiment]. Figure 2 As shown, this embodiment provides a business logic attack chain identification system based on dynamic behavior, used to apply the above-mentioned business logic attack chain identification method based on dynamic behavior, including: The collection unit is configured to collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object.

[0053] The processing unit is configured to perform state parsing on dynamic behavior fragments to obtain preceding and subsequent state descriptions, and to determine permissions for the dynamic behavior fragments based on resource access scope, action impact scope, and authorization records to obtain the actual access permissions. It also performs credential determination on the dynamic behavior fragments based on the issuing source, renewal source, and expiration time of the access credentials to obtain the access credential inheritance result.

[0054] The judgment unit is configured to extract the preceding dynamic behavior fragments and the following dynamic behavior fragments that act on the same business object within a preset playback window, and compare the subsequent state description of the preceding dynamic behavior fragment with the preceding state description of the following dynamic behavior fragment, the actual permission occupancy result, and the access credential inheritance result with preset legal rules respectively.

[0055] The verification unit is configured to identify an abnormal transfer when any comparison fails. It performs a reverse lookup of the business object corresponding to the abnormal transfer. If no supplementary verification event covering the execution action corresponding to the abnormal transfer is found, it traces back the triggered dynamic behavior fragments from the abnormal transfer and then traces the resulting dynamic behavior fragments backward to obtain the business logic attack chain identification result.

[0056] It is understandable that the above-mentioned business logic attack link identification method and system based on dynamic behavior have the same beneficial effects, and will not be elaborated further here.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the present invention.

Claims

1. A method for identifying business logic attack chains based on dynamic behavior, characterized in that, include: Collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object; The dynamic behavior segment is parsed to obtain the preceding and following state descriptions. The permission of the dynamic behavior segment is determined based on the resource access scope, action impact scope, and authorization records to obtain the actual access permission result. The access credential is determined based on the issuance source, renewal source, and expiration time of the access credential to obtain the access credential inheritance result. Extract the preceding dynamic behavior fragments and the following dynamic behavior fragments that act on the same business object within the preset playback window. Compare the subsequent state description of the preceding dynamic behavior fragment with the preceding state description of the following dynamic behavior fragment, the actual permission occupancy result, and the access credential inheritance result with preset legal rules respectively. When any comparison fails, an abnormal transfer is identified; A reverse lookup of the evidence-providing event is performed on the business object corresponding to the abnormal transfer. If no evidence-providing event covering the execution action corresponding to the abnormal transfer is found, the dynamic behavior fragment triggered by the abnormal transfer is traced forward and the result dynamic behavior fragment is traced backward to obtain the business logic attack chain identification result.

2. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When aggregating the business behavior records, the process includes: merging business behavior records that are related to each other according to the business object identifier, the associated request relationship, and the preset time interval, and generating dynamic behavior fragments corresponding to the same business object.

3. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When performing state parsing on the dynamic behavior fragment, the process includes: determining the process state, approval state, export license state, and modification license state corresponding to the dynamic behavior fragment based on the executed action, action result, and business behavior record, and generating the preceding state description and the following state description.

4. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When determining permissions for the dynamic behavior fragment, the process includes: determining the actual access permissions corresponding to the execution action based on the resource access scope and the scope of action influence, and comparing the actual access permissions with the authorized object, authorized scope and authorized validity period recorded in the authorization record to obtain the actual access permission result.

5. The method for identifying business logic attack links based on dynamic behavior according to claim 4, characterized in that, When determining the actual occupancy permissions corresponding to the execution action based on the resource access scope and the action impact scope, the process includes: summarizing the resource types, resource quantities, number of affected objects, and impact result types involved in the execution action to generate the actual occupancy permissions corresponding to the execution action.

6. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When performing credential determination on the dynamic behavior segment, the process includes: determining whether there is a legitimate inheritance relationship between the preceding dynamic behavior segment and the following dynamic behavior segment based on the issuing source, renewal source, and expiration time of the access credential, and generating the access credential inheritance result.

7. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When comparing with preset legal rules, the process includes: splitting the subsequent state description of the preceding dynamic behavior segment and the preceding state description of the subsequent dynamic behavior segment into corresponding state items, and comparing each corresponding state item one by one according to the preset legal rules; when each corresponding state item satisfies the preset legal rules, the state comparison is determined to be successful; when any corresponding state item does not satisfy the preset legal rules, the state comparison is determined to be unsuccessful.

8. The method for identifying business logic attack links based on dynamic behavior according to claim 1, characterized in that, When performing a reverse lookup of the supplementary verification event for the business object corresponding to the abnormal transfer, the process includes: in a preset verification window, retrieving the approval confirmation event, supplementary authorization event, or rollback confirmation event corresponding to the execution action corresponding to the abnormal transfer; when the supplementary verification event does not match the business object, authorization scope, and action sequence of the execution action corresponding to the abnormal transfer, determining that the supplementary verification event cannot cover the execution action corresponding to the abnormal transfer.

9. The method for identifying business logic attack links based on dynamic behavior according to claim 8, characterized in that, When tracing back the triggered dynamic behavior segment from the abnormal transfer as the starting point and tracing back the resulting dynamic behavior segment, the process includes: determining causal association based on the business object identifier, associated request relationship, preceding state description, following state description, and access credential inheritance result; identifying the dynamic behavior segment located before the abnormal transfer whose following state description connects with the preceding state description corresponding to the abnormal transfer as the triggered dynamic behavior segment; identifying the dynamic behavior segment located after the abnormal transfer whose preceding state description connects with the following state description corresponding to the abnormal transfer as the resulting dynamic behavior segment; and generating a business logic attack chain identification result.

10. A business logic attack link identification system based on dynamic behavior, used to apply the business logic attack link identification method based on dynamic behavior as described in any one of claims 1-9, characterized in that, include: The acquisition unit is configured to collect business behavior records, aggregate the business behavior records, and obtain dynamic behavior fragments corresponding to the same business object. The processing unit is configured to perform state parsing on the dynamic behavior segment to obtain a preceding state description and a following state description, and to perform permission determination on the dynamic behavior segment based on the resource access scope, action impact scope and authorization record to obtain the actual access permission result; and to perform credential determination on the dynamic behavior segment based on the issuance source, renewal source and expiration time of the access credential to obtain the access credential inheritance result. The judgment unit is configured to extract the preceding dynamic behavior fragment and the following dynamic behavior fragment that act on the same business object within a preset playback window, and compare the subsequent state description of the preceding dynamic behavior fragment with the preceding state description of the following dynamic behavior fragment, the actual occupied permission result, and the access credential inheritance result with preset legal rules respectively. The verification unit is configured to determine an anomaly transfer when any comparison fails; A reverse lookup of the evidence-providing event is performed on the business object corresponding to the abnormal transfer. If no evidence-providing event covering the execution action corresponding to the abnormal transfer is found, the dynamic behavior fragment triggered by the abnormal transfer is traced forward and the result dynamic behavior fragment is traced backward to obtain the business logic attack chain identification result.

Images