The invention discloses a security detection method and device for an HTTP (
Hyper Text Transport Protocol) request, and relates to the technical field of
network security. The method comprises the following steps: acquiring a current
data segment of an HTTP request body; if the
attack feature historical detection
record of the request body exists, loading a historical detection state; scanning a current
data fragment by using a pre-compiled regular feature
library based on a historical detection state, if the current
data fragment is completely matched with an
attack feature, setting a regular matching mark to be true, otherwise, setting the regular matching mark to be false; when the
security rule is not hit and the regular matching is true, HTTP request header condition
verification is executed, and if the
verification is passed, the hit state of the
security rule is updated to be hit; if the regular matching is false, directly skipping request header
verification and keeping an original hit state; and if the
security rule hit state is hit, executing an interception operation. According to the method, the defects of length limitation and cross-block
leak detection of traditional
block type detection are overcome, HTTP request
delay is avoided, the memory
occupancy rate is reduced, and
system resources are saved.