CN112134837A

CN112134837A - Method and system for detecting Web attack behavior

Info

Publication number: CN112134837A
Application number: CN202010782683.6A
Authority: CN
Inventors: 郑霖
Original assignee: Ruishu Information Technology Shanghai Co ltd
Current assignee: Ruishu Information Technology Shanghai Co ltd
Priority date: 2020-08-06
Filing date: 2020-08-06
Publication date: 2020-12-25

Abstract

The invention provides a method and a system for detecting Web attack behavior, wherein the system comprises the following steps: the system comprises a Web service website, a Web honeypot and a threat perception tracing platform; the Web service website and the Web honeypot are used for embedding a tracing script in webpage data returned to a visitor; the tracing script automatically runs after being loaded, and is used for acquiring the access data of an accessor and sending the access data to the threat perception tracing platform; the threat perception tracing platform is used for collecting visitor access data sent by the tracing script and detecting Web attack behaviors according to the visitor access data. The method and the device can effectively improve the detection effect of the Web attack behavior.

Description

Method and system for detecting Web attack behavior

[ technical field ] A method for producing a semiconductor device

The application relates to the technical field of computer security, in particular to a method and a system for detecting Web attack behaviors.

[ background of the invention ]

This section is intended to provide a background or context to the embodiments of the invention that are recited in the claims. The description herein is not admitted to be prior art by inclusion in this section.

In Web (Web) attacks, attackers often use Proxy (Proxy) or other techniques to hide their true attack source IP. In a more concealed attack, an attacker uses a remote trojan or an automated tool and then generates a continuous or batch attack in a Proxy or springboard mode and the like. Traditional defense techniques have difficulty tracing such attacks to locate the attacker.

[ summary of the invention ]

In view of this, the present application provides a method, an apparatus, and a system for detecting a Web attack behavior, so as to improve a detection effect of the Web attack behavior.

The specific technical scheme is as follows:

in a first aspect, the present application provides a system for detecting a Web attack behavior, where the system includes: the system comprises a Web service website, a Web honeypot and a threat perception tracing platform;

the Web service website and the Web honeypot are used for embedding a tracing script in webpage data returned to a visitor;

the tracing script automatically runs after being loaded, and is used for acquiring the access data of an accessor and sending the access data to the threat perception tracing platform;

the threat perception tracing platform is used for collecting visitor access data sent by the tracing script and detecting Web attack behaviors according to the visitor access data.

According to a preferred embodiment of the present application, the Web honeypot includes: at least one of a high-simulation Web honeypot and a low-interaction Web honeypot;

the high-simulation Web honeypot is used for mapping the Web service website through a reverse proxy technology to obtain a cloned Web service website;

the low-interaction Web honeypot is used for simulating a static Web site, and the static Web site is different from the Web service site.

According to a preferred embodiment of the present application, the visitor's access data includes at least one of:

visitor browser feature data, mouse and keyboard event information, touch screen event information, motion sensor event information, visitor device IP address.

According to a preferred embodiment of the present application, the system further comprises: a log collection center;

the tracing script is specifically used for sending the access data of the visitor to the log collection center;

the log collection center is used for collecting and storing the access data of the visitor;

the threat awareness tracing platform is specifically used for acquiring the access data of the visitor from the log collection center.

According to a preferred embodiment of the present application, the threat awareness tracing platform is specifically configured to perform at least one of the following detection processes:

marking visitors who visit the Web honeypots and visit data thereof as threats;

evaluating whether the access flow of the visitor to the Web service website is matched with a preset threat rule, and if so, marking the visitor and the access data thereof as a threat;

providing visitor information marked as a threat to a defense system corresponding to the Web service website, so that the defense system prevents visitors marked as threats from visiting the Web service website, or guides the visitors marked as threats to visit the Web service website to the Web honeypot;

and analyzing the historical visit track of the visitor marked as the threat and restoring the life cycle of the threat event.

In a second aspect, the present application provides a method for detecting a Web attack behavior, where the method includes:

embedding a tracing script in webpage data returned to a visitor by a Web service website and a Web honeypot;

the tracing script automatically runs after being loaded, acquires the access data of an accessor and sends the access data to the threat perception tracing platform;

the threat perception tracing platform collects the visitor access data sent by the tracing script, and the Web attack behavior is detected according to the visitor access data.

According to a preferred embodiment of the present application, the Web honeypot includes at least one of a high-emulation Web honeypot and a low-interaction Web honeypot:

the high-simulation Web honeypot maps the Web service website through a reverse proxy technology to obtain a cloned Web service website; and/or the presence of a gas in the gas,

the low-interaction Web honeypot simulates a static Web site, which is different from the Web service site.

According to a preferred embodiment of the present application, the sending to the threat awareness tracing platform includes:

the tracing script sends acquired visitor access data to the threat perception tracing platform in real time; alternatively, the first and second electrodes may be,

the tracing script sends the collected visitor access data to a log collection center, and the threat perception tracing platform obtains the visitor access data from the log collection center.

According to a preferred embodiment of the present application, the detecting the Web attack behavior according to the access data of the visitor includes:

the threat perception tracing platform marks visitors who visit the Web honeypots and visit data thereof as threats; and/or the presence of a gas in the gas,

the threat perception tracing platform evaluates whether the access flow of a visitor to the Web service website is matched with a preset threat rule, and if so, marks the visitor and the access data thereof as threats; and/or the presence of a gas in the gas,

the threat perception tracing platform provides visitor information marked as a threat to a defense system corresponding to the Web service website, so that the defense system prevents visitors marked as threats from visiting the Web service website, or guides the visitors marked as threats to the Web service website; and/or the presence of a gas in the gas,

and the threat perception tracing platform analyzes the historical visit track of the visitor marked as the threat and restores the life cycle of the threat event.

According to the technical scheme, the Web honeypot and the threat perception tracing platform are arranged, and the tracing script capable of collecting visitor access data is embedded into the Web page data returned to the visitor by the Web service website and the Web honeypot, so that the threat perception tracing platform can acquire the visitor access data collected by the tracing script, and the detection of the Web attack behavior is realized. Because the method is based on access data detection, even if an attacker generates an attack by adopting a hidden source IP and a proxy or springboard mode, the attack behavior can be traced, and the detection effect of the Web attack behavior is effectively improved.

[ description of the drawings ]

FIG. 1 is a schematic diagram of a system architecture provided by an embodiment of the present application;

fig. 2 is a flowchart of a method for detecting a Web attack behavior based on the above system according to an embodiment of the present application;

FIG. 3 illustrates a block diagram of an exemplary computer system/server suitable for use in implementing embodiments of the present invention.

[ detailed description ] embodiments

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in detail below with reference to the accompanying drawings and specific embodiments.

The terminology used in the embodiments of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the examples of the present invention and the appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

It should be understood that the term "and/or" as used herein is merely one type of association that describes an associated object, meaning that three relationships may exist, e.g., a and/or B may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" herein generally indicates that the former and latter related objects are in an "or" relationship.

To facilitate an understanding of the present application, a description of a system architecture employed by the present application is first described. As shown in fig. 1, the system may include a Web services website, a Web honeypot, and a threat awareness traceability platform.

The Web service website is a normal Web website and a real website for providing various Web services on line. In the present application, a trace-back script, for example, a way of manually embedding a trace-back JS code, may be embedded in the web page data returned to the visitor.

The Web honeypot is a computer system simulating Web sites on the Internet, is a trap system containing bugs, and provides an attacker with an easily-attacked target by simulating one or more hosts of vulnerable websites. In the present application, at least one of two kinds of Web honeypots may be included: high-simulation Web honeypots and low-interaction Web honeypots. The figure takes the example of including these two kinds of Web honeypots.

The high-simulation Web honeypot maps the Web service website through a reverse proxy technology to obtain a cloned Web service website, namely, the high-simulation Web honeypot simulates a normal Web service website. When a visitor visits the highly emulated Web honeypot, the reverse proxy embeds a traceback script, such as an automatically embedded traceback JS code, in the Web page data returned to the visitor.

The deployment of the high-simulation Web honeypots in the network can cause an attacker to mistakenly think of accessing a real website. And after the attacker successfully logs in the Web site, part of real data can be seen, so that the attacker is induced to perform more operations, and more access data of the attacker can be collected. These access data can reveal information such as the intent of intrusion and the manipulation of an attacker.

Further, the highly emulated Web honeypot may additionally be deployed with a WAF (Web Application Firewall) system, which may be a highly flexible lightweight system. WAF systems represent an emerging class of information security technologies for addressing Web application security issues that are overwhelmed by traditional device handles, such as firewalls. Unlike traditional firewalls, the WAF works at the application layer, thus having inherent technical advantages for Web application protection. Based on deep understanding of Web application service and logic, the WAF system detects and verifies the content of various requests from a Web application program client, ensures the security and the legality of the requests, and blocks illegal requests in real time, thereby effectively protecting various website sites. In the embodiment of the application, the threat degree of an attacker damaging or stealing sensitive data information can be reduced by configuring protection rules or algorithms for the WAF system.

The low-interaction Web honeypot simulation static Web site comprises a simulation HTTP response and a Web interface, wherein the simulated static Web site is different from a Web service site and is unrelated to a normal Web service site. A trace-back script is also embedded in the Web page data returned by the low-interaction Web honeypot to the visitor.

Because the low-interaction Web honeypot is simple and convenient for large-scale deployment, the method can be used for large-scale rapid deployment, and puzzles an attacker to acquire more access data of the attacker when the attacker moves transversely or scans website services indiscriminately. These access data can reveal information such as the attacker's attack technique and tools.

It can be seen that the normal Web service websites and the Web honeypots described above both embed the trace-back scripts in the Web page data returned to the visitor. And the tracing script automatically runs after being loaded by the browser and is used for acquiring the access data of the visitor and sending the access data to the threat perception tracing platform.

The visitor access data collected by the tracing script may include at least one of the following: visitor browser feature data, mouse and keyboard event information, touch screen event information, motion sensor event information, visitor device IP address. Where the browser characteristic data may be, for example, a browser ID, a fingerprint, etc. The motion sensor may be an acceleration sensor, a gyroscope, or the like.

And the threat perception tracing platform collects the visit data of the visitor sent by the tracing script and detects the Web attack behavior according to the visit data of the visitor.

The tracing script can directly send the collected visitor access data to the threat perception tracing platform in real time.

The trace-back script may also send the collected visitor's visit data to the log collection center. The log collection center records the visit data of the visitor and records the visit data as a visit log. And the threat awareness platform acquires offline access data from the log collection center.

In the embodiment of the application, when the threat awareness tracing platform detects a Web attack behavior according to access data of a visitor, one or any combination of the following detection processing methods can be adopted, but not limited to:

and in the first mode, the threat perception tracing platform monitors the visit of the visitor to the Web honeypots. Preferably, the visit of the visitor to the Web honeypots can be monitored in real time according to the visit data sent by the tracing script. Once the visitors' access to the Web honeypot is monitored, the visitors and their access data are marked as threats. The visitor may be tagged with a browser ID, a fingerprint, a visitor device IP address, a visitor MAC address, etc.

Of course, the visitor accessing the Web honeypot may also be determined by monitoring the access data in the access log recorded by the log collection center. The visitor and its access data are then marked as a threat.

Therefore, even if an attacker generates an attack by hiding a source IP and adopting an agent or springboard mode, the behavior of the attacker for accessing the Web honeypot is collected and exposed due to the setting of the Web honeypot and the collection of the tracing script on the access data of the attacker, so that the attacker and the access data thereof are marked as threats.

And secondly, evaluating whether the access flow of the visitor to the Web service website is matched with a preset threat rule by the threat perception tracing platform, and if so, marking the visitor and the access data thereof as threats.

Wherein the threat rules are the characteristics of the access traffic of the threat obtained by analyzing the access traffic of the known threat. The access traffic of the known threat can be identified in any way, can be identified based on the access to the Web honeypot in the application, and can also be identified in other ways. That is, for a visitor who has been identified as an attacker, attack features can be extracted from the access traffic of the visitor so that a threat rule will be established, and if the access traffic of the visitor to the Web service website matches the threat rule, the visitor is probably an attacker and is therefore marked as a threat.

And thirdly, providing the visitor information marked as the threat to a defense system corresponding to the Web service website by the threat perception tracing platform, so that the defense system prevents the visitor marked as the threat from accessing the Web service website, or guides the visit of the visitor marked as the threat to the Web service website to a Web honeypot.

Whether in the first mode, the second mode or other modes, once the visitor is marked as a threat, the visitor information marked as the threat is synchronized into a defense system for the Web service website. The defense system corresponding to the Web service website may be a firewall, a WAF system, or other systems capable of controlling the flow of accessing the Web service website.

For the visitor marked as the threat, once the visitor marked as the threat acquires the access request of the visitor to the Web service website, the defense system of the Web service website prohibits the access request from accessing the Web service website. Or once the access request to the Web service website is obtained, the defense system of the Web service website forwards the access request to the high-simulation Web honeypot, so that an attacker misunderstands that the real Web service website is accessed, more access data of the attacker are collected, and the influence of the attacker on the Web service website is reduced to the maximum extent.

And fourthly, analyzing the historical visit track of the visitor marked as the threat by the threat perception tracing platform, and restoring the life cycle of the threat event.

In this way, the threat awareness tracing platform may trace back the long-period access log and restore the life cycle of the threat event by analyzing the historical tracks of the visitors marked as threats.

Fig. 2 is a flowchart of a method for detecting a Web attack behavior based on the above system according to an embodiment of the present application, and as shown in fig. 2, the method may include the following steps:

in 201, the Web services site and Web honeypot embed a traceback script in the data of the Web page returned to the visitor.

As described in the above system embodiment, the Web honeypot may include at least one of a high-emulation Web honeypot and a low-interaction Web honeypot, which is not described herein in detail. Both normal Web service websites and Web honeypots embed a trace-back script in the Web page data returned to the visitor.

In 202, the tracing script is automatically run after being loaded, and the access data of the visitor is collected and sent to the threat perception tracing platform.

And the tracing script automatically runs after being loaded by the browser and is used for acquiring the access data of the visitor and sending the access data to the threat perception tracing platform. The visitor's access data may include at least one of visitor browser feature data, mouse and keyboard event information, touch screen event information, motion sensor event information, and a visitor device IP address.

Specifically, the tracing script can send the acquired visitor access data to the threat perception tracing platform in real time; the collected visitor access data can also be sent to a log collection center, and the threat perception tracing platform acquires the visitor access data from the log collection center.

In addition, in order to improve the security of data transmission, the tracing script can encrypt the access data and send the access data to the threat perception tracing platform or the log collection platform.

In 203, the threat awareness tracing platform collects the visitor's access data sent by the tracing script, and detects the Web attack behavior according to the visitor's access data.

The detection processing of the threat awareness tracing platform on the Web attack behavior may also refer to the related description in the above system embodiment, which is not described herein again.

At 204, the threat awareness platform displays the detection result or alarms when a threat is detected.

The threat perception tracing platform can display the visitor information marked as threat and the access flow information thereof through the threat display interface, or display the life cycle of the threat event obtained by analyzing the historical access track of the visitor marked as the threat. The threat awareness traceability platform may also alarm when a visitor or access traffic marked as a threat is monitored. The manner of the alarm may include, but is not limited to, an interface alarm, an audible alarm, or a manner of sending an alarm message.

The Web honeypot and threat-aware traceability platform in the above-described system may be provided in the form of a computer system or server, respectively, and fig. 3 shows a block diagram of an exemplary computer system/server 012 suitable for use in implementing an embodiment of the invention. The computer system/server 012 shown in fig. 3 is only an example, and should not bring any limitations to the function and the scope of use of the embodiments of the present invention.

As shown in fig. 3, the computer system/server 012 is embodied as a general purpose computing device. The components of computer system/server 012 may include, but are not limited to: one or more processors or processing units 016, a system memory 028, and a bus 018 that couples various system components including the system memory 028 and the processing unit 016.

Bus 018 represents one or more of any of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor, or a local bus using any of a variety of bus architectures. By way of example, such architectures include, but are not limited to, Industry Standard Architecture (ISA) bus, micro-channel architecture (MAC) bus, enhanced ISA bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.

Computer system/server 012 typically includes a variety of computer system readable media. Such media may be any available media that is accessible by computer system/server 012 and includes both volatile and nonvolatile media, removable and non-removable media.

System memory 028 can include computer system readable media in the form of volatile memory, such as Random Access Memory (RAM)030 and/or cache memory 032. The computer system/server 012 may further include other removable/non-removable, volatile/nonvolatile computer system storage media. By way of example only, storage system 034 may be used to read from and write to non-removable, nonvolatile magnetic media (not shown in FIG. 3, commonly referred to as a "hard drive"). Although not shown in FIG. 3, a magnetic disk drive for reading from and writing to a removable, nonvolatile magnetic disk (e.g., a "floppy disk") and an optical disk drive for reading from or writing to a removable, nonvolatile optical disk (e.g., a CD-ROM, DVD-ROM, or other optical media) may be provided. In such cases, each drive may be connected to bus 018 via one or more data media interfaces. Memory 028 can include at least one program product having a set (e.g., at least one) of program modules configured to carry out the functions of embodiments of the present invention.

Program/utility 040 having a set (at least one) of program modules 042 can be stored, for example, in memory 028, such program modules 042 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which examples or some combination thereof might include an implementation of a network environment. Program modules 042 generally perform the functions and/or methodologies of embodiments of the present invention as described herein.

The computer system/server 012 may also communicate with one or more external devices 014 (e.g., keyboard, pointing device, display 024, etc.), hi the present invention, the computer system/server 012 communicates with an external radar device, and may also communicate with one or more devices that enable a user to interact with the computer system/server 012, and/or with any device (e.g., network card, modem, etc.) that enables the computer system/server 012 to communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 022. Also, the computer system/server 012 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network such as the internet) via the network adapter 020. As shown, the network adapter 020 communicates with the other modules of the computer system/server 012 via bus 018. It should be appreciated that although not shown in fig. 3, other hardware and/or software modules may be used in conjunction with the computer system/server 012, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

The processing unit 016 executes programs stored in the system memory 028, thereby executing various functional applications and data processing, such as implementing the method flow provided by the embodiment of the present invention.

The computer program described above may be provided in a computer storage medium encoded with a computer program that, when executed by one or more computers, causes the one or more computers to perform the method flows and/or apparatus operations shown in the above-described embodiments of the invention. For example, the method flows provided by the embodiments of the invention are executed by one or more processors described above.

With the development of time and technology, the meaning of media is more and more extensive, and the propagation path of computer programs is not limited to tangible media any more, and can also be downloaded from a network directly and the like. Any combination of one or more computer-readable media may be employed. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may also be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C + + or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider).

The above description is only exemplary of the present application and should not be taken as limiting the present application, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A system for detecting Web attack behavior, the system comprising: the system comprises a Web service website, a Web honeypot and a threat perception tracing platform;

2. The system of claim 1, wherein the Web honeypot comprises: at least one of a high-simulation Web honeypot and a low-interaction Web honeypot;

3. The system of claim 1, wherein the visitor's access data includes at least one of:

4. The system of claim 1, further comprising: a log collection center;

5. The system according to any one of claims 1 to 4, characterized in that said threat-aware traceability platform is specifically configured to perform at least one of the following detection processes:

marking visitors who visit the Web honeypots and visit data thereof as threats;

6. A method for detecting Web attack behavior is characterized by comprising the following steps:

7. The method of claim 6, wherein the Web honeypot comprises at least one of a high-emulation Web honeypot and a low-interaction Web honeypot:

8. The method of claim 6, wherein the visitor's access data includes at least one of:

9. The method of claim 6, wherein the sending to a threat awareness traceability platform comprises:

10. The method according to any one of claims 6 to 9, wherein the detecting the Web attack behavior according to the visitor's access data comprises: