WO2018014808A1 - 网络攻击行为检测方法及装置 - Google Patents

网络攻击行为检测方法及装置 Download PDF

Info

Publication number
WO2018014808A1
WO2018014808A1 PCT/CN2017/093156 CN2017093156W WO2018014808A1 WO 2018014808 A1 WO2018014808 A1 WO 2018014808A1 CN 2017093156 W CN2017093156 W CN 2017093156W WO 2018014808 A1 WO2018014808 A1 WO 2018014808A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
user
sender
network attack
upload
Prior art date
Application number
PCT/CN2017/093156
Other languages
English (en)
French (fr)
Inventor
何彦军
龙付成
崔藜千
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2018014808A1 publication Critical patent/WO2018014808A1/zh
Priority to US16/026,793 priority Critical patent/US10848505B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services

Definitions

  • the present application relates to the field of data processing technologies, and in particular, to a network attack behavior detection method and related apparatus.
  • the cyber attack behavior is the attack behavior of the network system hardware, software and data in the system by exploiting the vulnerabilities and security flaws of the network.
  • the network attack behavior increasingly affects the security of the network, for example, Some cyber attacks can submit some data that he wants to know, such as user accounts and passwords, by submitting a database query code. Some cyber attacks will be embedded in malicious code. In other pages used by users, they can steal various user accounts or control corporate data by embedding code.
  • the embodiment of the present application provides a network attack behavior detection method and related device, which can implement timely detection of network attack behavior and improve network data security.
  • a method for detecting a network attack behavior comprising:
  • Receiving user upload information where the user upload information is information actively uploaded during the interaction between the client and the server, or the information uploaded by the client responding to the server request;
  • the user upload information is sent to the business logic layer for processing only if the user upload information does not include network attack information.
  • a network attack behavior detecting apparatus includes:
  • the user uploading information receiving module is configured to receive user uploading information, where the user uploading information is information actively uploaded during the interaction between the client and the server, or the information uploaded by the client responding to the server request;
  • a determining module configured to determine whether the user upload information includes network attack information
  • the first user upload information sending module is configured to send the user upload information to the business logic layer for processing only if the user upload information does not include network attack information.
  • An application server includes: a network attack behavior detecting device as described above.
  • the embodiment of the present application discloses a network attack behavior detection method and related device, including: receiving user upload information, determining whether the user upload information includes network attack information; only in the user upload information. If the network attack information is not included, the user upload information is sent to the business logic layer for processing.
  • the process of detecting the uploaded information of the user can timely discover whether the user uploads the information including the network attack information, and uploads the user if the user upload information does not include the network attack information.
  • the information is sent to the business logic layer for processing, and the network attack behavior is detected in time to improve the security of the network data.
  • the user upload information includes the network attack information
  • FIG. 1 is a flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 2 is another flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 3 is still another flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 4 is still another flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 5 is still another flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 6 is still another flowchart of a method for detecting a network attack behavior according to an embodiment of the present application
  • FIG. 7 is a structural block diagram of a network attack behavior detecting apparatus according to an embodiment of the present application.
  • FIG. 8 is a structural block diagram of a determining module according to an embodiment of the present application.
  • FIG. 9 is another structural block diagram of a determining module according to an embodiment of the present application.
  • FIG. 10 is a block diagram showing the hardware structure of a network attack behavior detecting apparatus according to an embodiment of the present application.
  • network attack behavior increasingly affects the security of the network.
  • some network attack behaviors can obtain some of the results according to the results returned by the program by submitting a database query code.
  • the technical solution disclosed in the embodiment of the present application in order to solve the above problem, provides a network attack behavior detection method and related device, including: receiving user upload information, and determining whether the user upload information includes network attack information; When the user upload information does not include the network attack information, the user upload information is sent to the business logic layer for processing.
  • the process of detecting the uploaded information of the user can timely discover whether the user uploads the information including the network attack information, and uploads the user if the user upload information does not include the network attack information.
  • the information is sent to the business logic layer for processing, and the network attack behavior is detected in time to improve the security of the network data.
  • the user upload information includes the network attack information
  • FIG. 1 is a flowchart of a method for detecting a network attack behavior according to an embodiment of the present disclosure.
  • the method may be applied to a server capable of providing network attack behavior detection.
  • the server may be a cluster server, and the server has a network and a client.
  • the method may include:
  • Step S100 Receive user upload information.
  • the user uploading information is information actively uploaded during the interaction between the client and the server, or information uploaded by the client in response to the server request.
  • Step S110 Determine whether the user upload information includes network attack information.
  • the step of determining whether the user upload information includes network attack information may determine whether the sender information in the user upload information is a legitimate sender information, and may also determine an upload request in the user upload information. Whether the network attack information is included in the parameters, this application will be described in detail in the following section.
  • Step S120 Send the user upload information to the service logic layer for processing only if the user upload information does not include network attack information.
  • the framework layer is a reusable design skeleton of the entire system
  • the business logic layer which may also be referred to as a domain layer
  • the framework layer mainly focuses on processing of services in the system domain, and is responsible for generating, processing, and converting logical data.
  • the request is processed by the framework layer and then transferred to the business logic layer. Therefore, the framework layer encapsulates a public method for processing all requests, which requires a high degree of abstraction, and the business logic layer is processed for the domain business. more detail.
  • the network attack behavior detection method disclosed in the embodiment of the present application is mainly performed at the framework layer, and the user upload information is sent to the service only when it is determined in the framework layer that the user upload information does not include network attack information.
  • the logic layer performs processing to implement timely detection of network attack behavior and improve network data security; when the user upload information includes network attack information, the user upload information is not sent to the service logic layer.
  • the processing is performed, thereby avoiding the step of processing the network attack information at the business logic layer, not generating redundant garbage data, and reducing the resource consumption of the server and reducing the burden on the server.
  • FIG. 2 is a flowchart of another method for detecting a network attack behavior according to an embodiment of the present application.
  • the method may include:
  • Step S200 Receive user upload information.
  • Step S210 Extract sender information in the user upload information.
  • the sender information at least includes: a user identifier corresponding to the user that sends the user upload information (for example, an account used by the user to log in to the application, or the like) or a protocol IP that is interconnected between the users of the user that sends the user to upload the information. address;
  • Step S220 Determine whether the sender information is legal sender information
  • a sender whitelist may be maintained on the server side, where
  • the sender white list includes at least the legal sender information corresponding to the legitimate user that sends the user upload information, and the sender white list is stored in the server, and the staff can correspond to the legitimate user in the sender white list.
  • the legal sender information is periodically updated, and is not specifically limited in this embodiment.
  • the step of determining whether the sender information is legal sender information disclosed in the embodiment of the present application may include: determining whether the sender information is stored in a sender white list, and if yes, confirming the The sender information is the legal sender information, and the user upload information does not include the network attack information; otherwise, the sender information is the illegal sender information, and the user upload information is considered to contain the network attack information.
  • a sender blacklist may be maintained on the server, where the sender blacklist includes at least: illegal sender information corresponding to the illegal user that sends the user upload information.
  • the sender blacklist list is stored in the server, and the staff may periodically update the illegal sender information corresponding to the illegal user in the sender blacklist list, or may send the corresponding information to the user who sends the user upload information through the server.
  • the party information is verified, and the illegal sender information corresponding to the illegal user in the sender blacklist is automatically updated according to the verification result, which is not specifically limited in this embodiment.
  • the step of determining whether the sender information is legal sender information disclosed in the embodiment of the present application may include: determining whether the sender information is not stored in the sender blacklist, if not stored in the sender. In the blacklist, the sender information is confirmed as the legal sender information, and the user upload information does not include the network attack information; if it is stored in the sender blacklist, the sender information is confirmed as Illegal sender information, and the network upload information is considered to be included in the user upload information.
  • the method further includes: extracting, by the user, the sender information in the user upload information that does not include the network attack information; The sender information in the user upload information including the network attack information updates the sender white list.
  • Step S230 only when the sender information is legal sender information, that is, the user When the transmission information does not include a network attack, the user upload information is sent to the business logic layer for processing.
  • the method for detecting a network attack behavior can detect whether the sender information is a legitimate sender information in a timely manner by detecting a user uploading information, and if the sender information is a legitimate sender information, The user upload information is sent to the business logic layer for processing, realizing timely detection of network attack behavior, improving network data security; in the case where the sender information is illegal sender information, it does not The user upload information is sent to the business logic layer for processing, which avoids the step of processing the network attack information at the business logic layer, thereby reducing resource consumption of the server and reducing the burden on the server.
  • FIG. 3 is a flowchart of another method for detecting a network attack behavior according to an embodiment of the present application.
  • the method may include:
  • Step S300 Receive user upload information.
  • Step S310 Extract an upload request parameter in the user upload information.
  • the upload request parameter is a parameter used in a process of uploading information by the user, for example, a login request parameter submitted by the client in the process of logging in to the application, or a query request parameter sent by the client to the server, or at the client.
  • the interaction statement parameters and the like transmitted during the interaction with the server are not specifically limited in this embodiment.
  • Step S320 Determine whether the upload request parameter includes network attack information.
  • XSS injection attack is computer security vulnerabilities that often appear in web applications. They allow malicious web users to embed code into pages that are available to other users to steal various user accounts and control corporate data. . XSS injection attacks are classified into persistent attacks and non-persistent attacks. When persistent attacks are used to persist the attack code, they are affected by other users. Non-persistent attacks affect the current access.
  • the program will save the information in the database, and when other users access the data, they will leak their information without knowing it. For example, if the user enters the uploading information ⁇ script>alert(document.cookie) ⁇ /script> and can take effect, then a script can be constructed to store the currently accessed user. The data information on the user's local terminal is sent to the server designated by him, thereby stealing the login information of the currently accessed user and hijacking the session of the currently accessed user.
  • the SQL injection attack mainly generates attack behavior by constructing special statements in parameters, obfuscating data categories, and unauthorized access to data.
  • XSS injection attacks mainly use the following methods to generate attack behaviors: add spaces, carriage returns, and other characters to the data, and use the Ascii (American Standard Code for Information Interchange) code to encode html (hyper text markup language). Language) properties and mixed case.
  • determining whether the upload request parameter includes a structured query language SQL injection attack feature character for example, determining whether the upload request parameter includes a database special character such as a backquote or a single quotation mark, etc., and the embodiment of the present application does not specifically limited.
  • determining whether the cross-site scripting XSS injection attack feature character is included in the upload request parameter for example, determining whether the upload request parameter includes special characters such as ⁇ , >, ⁇ , &, or #, and the embodiment does not do Specifically limited.
  • step S330 if the network attack information is not included in the upload request parameter, the user upload information is sent to the service logic layer for processing.
  • the network attack behavior detection method can detect whether the upload request parameter includes network attack information in a timely manner, and if the upload request parameter includes the network attack information, The user upload information is sent to the business logic layer for processing, and the network attack behavior is detected in time to improve network data security; when the upload request parameter includes network attack information, the network attack information is not User upload information transmission Processing to the business logic layer avoids the step of processing the network attack information at the business logic layer, thereby reducing the resource consumption of the server and reducing the burden on the server.
  • FIG. 4 is a flowchart of another method for detecting a network attack behavior according to an embodiment of the present application.
  • the method may include:
  • Step S400 Receive user upload information.
  • Step S410 Determine whether the user upload information includes network attack information; if the user upload information includes network attack information, perform step S420; and if the user upload information does not include network attack information, Step S450 is performed to send the user upload information to the business logic layer for processing;
  • Step S420 Count the number of times the user uploads information including the network attack information by the same user in a preset time interval
  • Step S430 Determine whether the number of times the user uploads the information including the network attack information by the same user meets the preset network attack frequency value, and the number of times the user uploads the information including the network attack information by the same user meets the preset network attack frequency value. In the case, step S440 is performed;
  • the preset network attack time value is set by the server according to the frequency of generating the network attack behavior according to the statistics, or is set by the staff according to experience, and is not limited in the embodiment of the present application.
  • Step S440 limiting the access of the user and sending the user the information that the access is restricted.
  • the information uploaded by some users is misidentified by the system as the network attack information
  • the information is added to the blacklist, and the access sent by the user is restricted, which affects the normal operation of the user, considering
  • the hacker's cyberattack behavior is generally a high-frequency situation, that is, when a hacker conducts a cyber attack, it will continuously send users to upload information.
  • the operation of sending the information of the user including the network attack information by the same user is counted in the preset time interval, that is, the user uploads the information by detecting the frequency of the initiated network attack behavior. Whether the operation is a cyber attack behavior.
  • FIG. 5 is a flowchart of another method for detecting a network attack behavior according to an embodiment of the present application.
  • the method may include:
  • Step S500 Receive user upload information.
  • Step S510 Extract sender information in user upload information.
  • Step S520 determining whether the sender information is stored in the security scan whitelist list, if If yes, go to step S530;
  • the security scan whitelist includes at least: sender information adapted to the security platform vulnerability scan.
  • Step S530 determining whether the user upload information includes network attack information; only if the user upload information does not include network attack information, step S540 is performed;
  • Step S540 Send the user upload information to the business logic layer for processing.
  • the uploaded information will also include the network attack information, but this situation is not a malicious network attack behavior of external personnel.
  • the security maintenance process is performed by the internal personnel on the application or the website.
  • the security scan whitelist is pre-stored in the server, and the sender information in the user upload information is determined to be an adaptive security platform vulnerability scan. The step of the sender information can prevent the process of scanning the vulnerability of the security platform by internal personnel as a network attack behavior.
  • FIG. 6 is a flowchart of another method for detecting a network attack behavior according to an embodiment of the present application.
  • the method may include:
  • Step S600 Receive user upload information.
  • Step S610 Extract sender information in user upload information.
  • Step S620 determining whether the sender information contains the request identifier of the vulnerability scan, and if yes, executing step S630;
  • the request identifier of the vulnerability scan identifies that the behavior of sending the user upload information is a vulnerability scanning operation on the security platform of the application or the website, and the request identifier of the vulnerability scan is a vulnerability of the staff member. Pre-added to the sender's information before scanning.
  • Step S630 determining whether the user upload information includes network attack information; only if the user upload information does not include network attack information, step S640 is performed;
  • Step S640 Send the user upload information to the business logic layer for processing.
  • the step of determining whether the sender information includes the request identifier of the vulnerability scan can prevent the internal personnel from performing the vulnerability scanning process on the security platform by mistake.
  • the network attack behavior detecting apparatus provided in the embodiment of the present application is introduced.
  • the network attack behavior detecting apparatus described below may refer to the network attack behavior detecting method.
  • FIG. 7 is a structural block diagram of a network attack behavior detecting apparatus according to an embodiment of the present disclosure.
  • the network attack behavior detecting apparatus may be an application server. Referring to FIG. 7, the network attack behavior detecting apparatus may include:
  • the user uploading information receiving module 100 is configured to receive user uploading information, where the user uploading information is information actively uploaded during the interaction between the client and the server, or the information uploaded by the client in response to the server request;
  • the determining module 110 is configured to determine whether the user upload information includes network attack information
  • the first user upload information sending module 120 is configured to send the user upload information to the business logic layer for processing only if the user upload information does not include network attack information.
  • FIG. 8 shows a structural diagram of the determining module 110.
  • the determining module 110 specifically includes:
  • the first sender information extraction module 200 is configured to extract sender information in the user upload information, where the sender information includes at least: a user identifier corresponding to the user that sends the user upload information or a network of the user that sends the user upload information. Protocol IP address interconnected;
  • the legal sender information determining module 210 is configured to determine whether the sender information is a legitimate sender information. If the sender information is a legitimate sender information, it is determined that the user upload information does not include network attack information, otherwise the user upload information is determined. Contains network attack information.
  • the legal sender information determining module provided by the embodiment of the present application includes a first legal sender information determining submodule or a second legal sender information determining submodule, where:
  • the first legal sender information judging sub-module is configured to determine whether the sender information is stored in the sender whitelist, and the sender whitelist includes at least: a legal sending corresponding to the legal user that sends the user upload information. Party information;
  • the second legal sender information judging sub-module is configured to determine whether the sender information is not stored in the sender blacklist, and the sender blacklist includes at least: an illegal one corresponding to the illegal user that sends the user upload information. Sender information.
  • FIG. 9 shows another structure diagram of the determining module 110.
  • the determining module 110 specifically includes:
  • the upload request parameter extraction module 300 is configured to extract an upload request parameter in the user upload information, where the upload request parameter is a parameter used in a process of uploading information by a user;
  • the upload request parameter determining module 310 is configured to determine whether the upload request parameter includes a network attack Click on the information.
  • the upload request parameter determining module includes at least one of a SQL injection attack feature determining module and an XSS injection attack feature determining module, where:
  • the SQL injection attack feature judging module is configured to determine whether the upload request parameter includes a structured query language SQL injection attack feature character
  • the XSS injection attack feature judging module is configured to determine whether the cross-site scripting XSS injection attack feature character is included in the upload request parameter.
  • the network attack behavior detecting apparatus may further include: a user uploading information frequency statistics module, configured to send, by using the same user, the user uploading information including the network attack information in a preset time interval. The number of times; the prompt information sending module is configured to send the prompt information that the access is restricted to the user when the number of times the user uploads the information including the network attack information by the same user satisfies the preset network attack frequency value.
  • a second sender information extraction module configured to extract sender information in the user upload information
  • the first sender information determining module is configured to determine whether the sender information is stored in the security scan whitelist, and the security scan whitelist includes at least: sender information adapted to the security platform vulnerability scan.
  • a third sender information extraction module configured to extract sender information in the user upload information
  • the second sender information determining module is configured to determine whether the sender information includes a request identifier of the vulnerability scan.
  • a fourth sender information extraction module configured to extract sender information in user upload information that does not include network attack information
  • the whitelist list update module is configured to update the sender whitelist list according to the sender information in the user upload information that does not include the network attack information.
  • the network attack behavior detecting apparatus may further include: a fifth sender information extracting module, configured to extract sender information in user upload information including network attack information;
  • a blacklist update module configured to upload information according to the user that includes the network attack information
  • the sender information updates the sender blacklist.
  • the network attack behavior detecting device may be a hardware device, and the module and unit described above may be disposed in a function module in the network attack behavior detecting device.
  • FIG. 10 is a block diagram showing the hardware structure of the network attack behavior detecting apparatus.
  • the network attack behavior detecting apparatus may include: a processor 1, a communication interface 2, a memory 3, and a communication bus 4; wherein the processor 1 and the communication interface 2 The memory 3 completes communication with each other through the communication bus 4; optionally, the communication interface 2 can be an interface of the communication module, such as an interface of the GSM module;
  • the processor 1 is for executing a program; the memory 3 is for storing a program; the program may include program code, and the program code includes computer operation instructions.
  • the processor 1 may be a central processing unit CPU, or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application;
  • the memory 3 may include a high speed RAM memory. It may also include a non-volatile memory, such as at least one disk storage.
  • the processor may perform the network attack behavior detection method as described above when executing the program stored in the memory, for example:
  • Receiving user upload information where the user upload information is information actively uploaded during the interaction between the client and the server, or the information uploaded by the client responding to the server request;
  • the user upload information does not include network attack information
  • the user upload information is sent to the service logic layer for processing.
  • the steps of a method or algorithm described in connection with the embodiments disclosed herein can be implemented directly in hardware, a software module executed by a processor, or a combination of both.
  • the software module can be placed in random access memory (RAM), memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or technical field. Any other form of storage medium known.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

本申请实施例公开了一种网络攻击行为检测方法及相关装置，包括：接收用户上传信息，判断用户上传信息中是否包含网络攻击信息；在用户上传信息中不包含网络攻击信息的情况下，将用户上传信息发送至业务逻辑层进行处理。通过对用户上传信息的检测过程，及时发现用户上传信息中是否包含网络攻击信息，并仅在用户上传信息中不包含网络攻击信息的情况下，才将用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在用户上传信息中包含网络攻击信息的情况下，并不会将所述用户上传信息发送至业务逻辑层进行处理，避免了在业务逻辑层对网络攻击信息进行处理的步骤，减少服务器的资源消耗，减轻服务器的负担。

Description

网络攻击行为检测方法及装置
本申请要求于2016年7月19日提交中国专利局、申请号为201610575103.X、发明名称为“一种网络攻击行为检测方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及数据处理技术领域，具体涉及一种网络攻击行为检测方法及相关装置。
背景技术
网络攻击行为是利用网络存在的漏洞和安全缺陷对网络系统的硬件、软件及其系统中的数据进行的攻击行为，随着网络技术的发展，网络攻击行为日益影响着网络的安全性，例如，有些网络攻击行为通过提交一段数据库查询代码，就可以根据程序返回的结果，获得某些他想得知的数据，如用户账户、密码等信息；有些网络攻击行为则将恶意代码植入到提供给其它用户使用的页面中，通过植入代码盗取各类用户账户、或者控制企业数据。
因此，如何提供一种网络攻击行为检测方法，提高网络数据安全性，成为目前亟待解决的问题。
发明内容
有鉴于此，本申请实施例提供一种网络攻击行为检测方法及相关装置，能够实现了对网络攻击行为的及时检测，提高网络数据安全性。
为实现上述目的，本申请实施例提供如下技术方案：
一种网络攻击行为检测方法，包括：
接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
判断所述用户上传信息中是否包含网络攻击信息；
仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
一种网络攻击行为检测装置，包括：
用户上传信息接收模块，用于接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
判断模块，用于判断所述用户上传信息中是否包含网络攻击信息；
第一用户上传信息发送模块，用于仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
一种应用服务器，包括：如前所述的网络攻击行为检测装置。
基于上述技术方案，本申请实施例公开了一种网络攻击行为检测方法及相关装置，包括：接收用户上传信息，判断所述用户上传信息中是否包含网络攻击信息；仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。本申请实施例中通过对用户上传信息的检测过程，能够及时发现用户上传信息中是否包含网络攻击信息，并在所述用户上传信息中不包含网络攻击信息的情况下，才将所述用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在所述用户上传信息中包含网络攻击信息的情况下，并不会将所述用户上传信息发送至业务逻辑层进行处理，避免了在业务逻辑层对网络攻击信息进行处理的步骤，从而减少了服务器的资源消耗，减轻了服务器的负担。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据提供的附图获得其他的附图。
图1为本申请实施例提供的网络攻击行为检测方法的流程图；
图2为本申请实施例提供的网络攻击行为检测方法的另一流程图；
图3为本申请实施例提供的网络攻击行为检测方法的又一流程图；
图4为本申请实施例提供的网络攻击行为检测方法的又一流程图；
图5为本申请实施例提供的网络攻击行为检测方法的又一流程图；
图6为本申请实施例提供的网络攻击行为检测方法的又一流程图；
图7为本申请实施例提供的网络攻击行为检测装置的结构框图；
图8为本申请实施例提供的判断模块的结构框图；
图9为本申请实施例提供的判断模块的另一结构框图；
图10为本申请实施例提供的网络攻击行为检测装置的硬件结构框图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整的描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本方案的发明人发现，随着网络技术的发展，网络攻击行为日益影响着网络的安全性，例如，有些网络攻击行为通过提交一段数据库查询代码，就可以根据程序返回的结果，获得某些他想得知的数据，如用户账户、密码等信息；有些网络攻击行为则将恶意代码植入到提供给其它用户使用的页面中，通过植入代码盗取各类用户账户、或者控制企业数据。
基于此，如何提供一种网络攻击行为检测方法，提高网络数据安全性，成为目前亟待解决的问题。
本申请实施例中公开的技术方案为了解决上述问题，提出了一种网络攻击行为检测方法及相关装置，包括：接收用户上传信息，判断所述用户上传信息中是否包含网络攻击信息；仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。本申请实施例中通过对用户上传信息的检测过程，能够及时发现用户上传信息中是否包含网络攻击信息，并在所述用户上传信息中不包含网络攻击信息的情况下，才将所述用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在所述用户上传信息中包含网络攻击信息的情况下，并不会将所述用户上传信息发送至业务逻辑层进行处理，避免了在业务逻辑层对网络攻击信息进行处理的步骤，从而减少了服务器的资源消耗，减轻了服务器的负担。
图1为本申请实施例提供的网络攻击行为检测方法的流程图，该方法可应用于能够提供网络攻击行为检测的服务器，服务器具体可为集群服务器，该服务器具备通过网络与客户端进行通信的功能。参照图1，所述方法可以包括：
步骤S100、接收用户上传信息；
可选地，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息。
步骤S110、判断所述用户上传信息中是否包含网络攻击信息；
可选地，判断所述用户上传信息中是否包含网络攻击信息的步骤，可以判断所述用户上传信息中的发送方信息是否是合法发送方信息，也可以判断所述用户上传信息中的上传请求参数中是否包含网络攻击信息，对此，本申请将在下面的部分详细说明。
步骤S120、仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
可选地，框架层是整个系统的可重用设计骨架，业务逻辑层，也可以称为领域层，主要关注系统领域业务的处理，负责逻辑性数据的生成、处理及转换。一般地，请求会先经过框架层处理之后再流转到业务逻辑层处理，因此，框架层封装的是对所有请求进行处理的公共方法，需要高度抽象，而业务逻辑层是针对领域业务处理的，更具体。
本申请实施例中公开的网络攻击行为检测方法主要在框架层执行，只有在框架层中确定所述用户上传信息中不包含网络攻击信息的情况下，才会将所述用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在所述用户上传信息中包含网络攻击信息的情况下，并不会将所述用户上传信息发送至业务逻辑层进行处理，这样避免了在业务逻辑层对网络攻击信息进行处理的步骤，不会产生多余的垃圾数据，还能够降低服务器的资源消耗，减轻服务器的负担。
优选地，图2示出了本申请实施例提供的另一种网络攻击行为检测方法的流程图，参照图2，该方法可以包括：
步骤S200、接收用户上传信息；
步骤S210、提取所述用户上传信息中的发送方信息；
可选地，所述发送方信息至少包括：发送用户上传信息的用户对应的用户标识(例如，用户登录应用程序采用的账号等)或者发送用户上传信息的用户的网络之间互连的协议IP地址；
步骤S220、判断所述发送方信息是否是合法发送方信息；
可选地，本申请实施例中可以在服务器端维护一发送方白名单列表，所述 发送方白名单列表中至少包括：发送用户上传信息的合法用户对应的合法发送方信息，所述发送方白名单列表存储在服务器中，可以由工作人员对发送方白名单列表中的合法用户对应的合法发送方信息进行定期更新，本申请实施例不做具体限定。
基于此，本申请实施例中公开的判断所述发送方信息是否是合法发送方信息的步骤可以包括：判断所述发送方信息是否存储在发送方白名单列表中，如果是，则确认所述发送方信息为合法发送方信息，认为所述用户上传信息中不包含网络攻击信息；否则，所述发送方信息为非法发送方信息，认为所述用户上传信息中包含网络攻击信息。
可选地，本申请实施例中可以在服务器端维护一发送方黑名单列表，所述发送方黑名单列表中至少包括：发送用户上传信息的非法用户对应的非法发送方信息。所述发送方黑名单列表存储在服务器中，可以由工作人员对发送方黑名单列表中的非法用户对应的非法发送方信息进行定期更新，也可以通过服务器对发送用户上传信息的用户对应的发送方信息进行验证，依据验证结果，对发送方黑名单列表中的非法用户对应的非法发送方信息进行自动更新，本申请实施例不做具体限定。
基于此，本申请实施例中公开的判断所述发送方信息是否是合法发送方信息的步骤可以包括：判断所述发送方信息是否未存储在发送方黑名单列表中，如果没有存储在发送方黑名单列表中，则确认所述发送方信息为合法发送方信息，并认为所述用户上传信息中不包含网络攻击信息；如果存储在发送方黑名单列表中，则确认所述发送方信息为非法发送方信息，并认为所述用户上传信息中包含网络攻击信息。
可选地，本申请实施例中在确定在所述用户上传信息中不包含网络攻击信息的情况下，还包括：提取不包含网络攻击信息的用户上传信息中的发送方信息；依据所述不包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方白名单列表进行更新。
或者，提取包含网络攻击信息的用户上传信息中的发送方信息；依据所述包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方黑名单列表进行更新。
步骤S230、仅在所述发送方信息是合法发送方信息的情况下，也即用户上 传信息中不包含网络攻击的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
本申请实施例提供的一种网络攻击行为检测方法通过对用户上传信息的检测过程，能够及时发现发送方信息是否是合法发送方信息，并在所述发送方信息是合法发送方信息的情况下，才将所述用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在所述发送方信息是非法发送方信息的情况下，并不会将所述用户上传信息发送至业务逻辑层进行处理，避免了在业务逻辑层对网络攻击信息进行处理的步骤，从而减少了服务器的资源消耗，减轻了服务器的负担。
优选地，图3示出了本申请实施例提供的另一种网络攻击行为检测方法的流程图，参照图3，该方法可以包括：
步骤S300、接收用户上传信息；
步骤S310、提取所述用户上传信息中的上传请求参数；
可选地，所述上传请求参数为用户上传信息过程中采用的参数，例如客户端登录应用程序过程中提交的登录请求参数，或者客户端主动向服务器发送的一条查询请求参数，或者在客户端与服务器交互过程中传输的交互语句参数等，本申请实施例不做具体限定。
步骤S320、判断所述上传请求参数中是否包含网络攻击信息；
需要说明的是，目前网络上常见的攻击方式有：SQL(Structured Query Language，结构化查询语言)注入攻击以及XSS(Cross Site Scripting，跨站脚本)注入攻击，SQL注入攻击指的是用户可以提交一段数据库查询代码，就可以根据程序返回的结果，获得某些他想得知的数据。XSS注入攻击是一种经常出现在网页应用中的计算机安全漏洞，它允许恶意网页用户将代码植入到提供给其它用户使用的页面中，以达到盗取各类用户账户、控制企业数据等目的。XSS注入攻击分为持久型攻击和非持久型攻击，持久型攻击是将攻击代码持久化之后，被其他用户使用时才产生影响，而非持久型攻击则是对当次访问产生影响。
针对以上两种类型的攻击行为，现做如下举例说明：
假设现在程序中有一条SQL语句是SELECT*FROM Users WHERE Username＝'$username'AND Password＝'$password'，如果用户输入的上传信息的内容是$username＝1'or'1'＝'1和$password＝1'or'1'＝'1，那么不进行网络攻击行为检测的话，就会得到 SELECT*FROM Users WHERE Username＝'1'OR'1'＝'1'AND Password＝'1'OR'1'＝'1'，通过这条SQL语句，就会查询出来所有的用户信息，进而泄漏这些用户的数据。
如果用户在请求的参数里构造特定的具有XSS攻击行为的内容，那么程序将这些数据保存到数据库里后，当其他用户访问到这些数据的时候，就会在不知情的情况下泄漏自己的信息，比如登录态信息等，比如，用户如果输入上传信息<script>alert(document.cookie)</script>这段代码，并能够生效的话，那么就可以构造出一段脚本，将当前访问用户的储存在用户本地终端上的数据信息发送到他指定的服务器上，从而盗取了当前访问用户的登录信息，劫持当前访问用户的会话。
需要说明的是，SQL注入攻击主要采用如下方式产生攻击行为：在参数中构造特殊的语句，混淆数据类别以及越权访问数据。XSS注入攻击主要采用如下方式产生攻击行为：在数据中添加空格、回车等字符，用Ascii(American Standard Code for Information Interchange，美国标准信息交换代码)码编码html(hyper text markup language，超文本标记语言)属性以及混合大小写。
结合上述SQL注入攻击以及XSS注入攻击的攻击方式以及攻击特点，本申请实施例中公开的判断所述上传请求参数中是否包含网络攻击信息的具体过程可以采用如下两种方式中的至少一种：
第一：判断所述上传请求参数中是否包含结构化查询语言SQL注入攻击特征字符，例如判断所述上传请求参数中是否含有反引号、单引号等数据库特殊字符等，本申请实施例不做具体限定。
第二：判断所述上传请求参数中是否包含跨站脚本XSS注入攻击特征字符，例如判断所述上传请求参数中是否含有<、>、`、&或#等特殊字符，本申请实施例不做具体限定。
步骤S330、仅在所述上传请求参数中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
本申请实施例提供的一种网络攻击行为检测方法通过对用户上传信息的检测过程，能够及时发现上传请求参数中是否包含网络攻击信息，并在所述上传请求参数中包含网络攻击信息的情况下，才将所述用户上传信息发送至业务逻辑层进行处理，实现了对网络攻击行为的及时检测，提高网络数据安全性；在上传请求参数中包含网络攻击信息的情况下，并不会将所述用户上传信息发送 至业务逻辑层进行处理，避免了在业务逻辑层对网络攻击信息进行处理的步骤，从而减少了服务器的资源消耗，减轻了服务器的负担。
优选地，图4示出了本申请实施例提供的另一种网络攻击行为检测方法的流程图，参照图4，该方法可以包括：
步骤S400、接收用户上传信息；
步骤S410、判断所述用户上传信息中是否包含网络攻击信息；在所述用户上传信息中包含网络攻击信息的情况下，执行步骤S420；在所述用户上传信息中不包含网络攻击信息的情况下，执行步骤S450以将所述用户上传信息发送至业务逻辑层进行处理；
步骤S420、在预设时间间隔中，统计由同一用户发送包含网络攻击信息的用户上传信息的次数；
步骤S430、判断由同一用户发送包含网络攻击信息的用户上传信息的次数是否满足预设网络攻击次数值，在由同一用户发送包含网络攻击信息的用户上传信息的次数满足预设网络攻击次数值的情况下，执行步骤S440；
需要说明的是，预设网络攻击次数值是由服务器依据统计的产生网络攻击行为的频率设定的，或者是由工作人员依据经验设定的，本申请实施例中不做限定。
步骤S440、限制该用户的访问并向该用户发送访问受到限制的提示信息。
本申请实施例中，对于有些用户上传的信息被系统误认为是网络攻击信息的情况下，则会被添加到黑名单中，并且该用户发送的访问受到限制，影响用户的正常操作，考虑到黑客的网络攻击行为一般是高频率情况，即黑客在进行网络攻击的时候，会间隔不断的发送用户上传信息。基于此，本申请实施例中在预设时间间隔中，统计由同一用户发送包含网络攻击信息的用户上传信息的次数的操作，即通过对发起网络攻击行为的频率的检测，确定用户上传信息的操作是否是网络攻击行为。
优选地，图5示出了本申请实施例提供的另一种网络攻击行为检测方法的流程图，参照图5，该方法可以包括：
步骤S500、接收用户上传信息；
步骤S510、提取用户上传信息中的发送方信息；
步骤S520、判断所述发送方信息是否存储在安全扫描白名单列表中，如果 是，则执行步骤S530；
需要说明的是，所述安全扫描白名单列表中至少包括：适配安全平台漏洞扫描的发送方信息。
步骤S530、判断所述用户上传信息中是否包含网络攻击信息；仅在所述用户上传信息中不包含网络攻击信息的情况下，执行步骤S540；
步骤S540、将所述用户上传信息发送至业务逻辑层进行处理。
需要说明的是，内部人员在定期对应用程序或者网站的安全平台进行漏洞扫描的时候，所发送的上传信息中也会包含网络攻击信息，但是此种情况并不是外部人员恶意的网络攻击行为，而是内部人员对应用程序或者网站进行的安全维护过程，本申请实施例中通过在服务器中预先存储安全扫描白名单列表，通过判断用户上传信息中的发送方信息是否是适配安全平台漏洞扫描的发送方信息的步骤，能够防止误将内部人员对安全平台进行漏洞扫描的过程认为是网络攻击行为。
优选地，图6示出了本申请实施例提供的另一种网络攻击行为检测方法的流程图，参照图6，该方法可以包括：
步骤S600、接收用户上传信息；
步骤S610、提取用户上传信息中的发送方信息；
步骤S620、判断所述发送方信息中是否包含漏洞扫描的请求标识，如果是，则执行步骤S630；
需要说明的是，所述漏洞扫描的请求标识标识着发送用户上传信息的行为是一种对应用程序或者网站的安全平台进行漏洞扫描的行为，所述漏洞扫描的请求标识是工作人员在进行漏洞扫描之前，预先添加到发送方信息中的。
步骤S630、判断所述用户上传信息中是否包含网络攻击信息；仅在所述用户上传信息中不包含网络攻击信息的情况下，执行步骤S640；
步骤S640、将所述用户上传信息发送至业务逻辑层进行处理。
本申请实施例中通过判断所述发送方信息中是否包含漏洞扫描的请求标识的步骤，能够防止误将内部人员对安全平台进行漏洞扫描的过程认为是网络攻击行为。
下面对本申请实施例提供的网络攻击行为检测装置进行介绍，下文描述的网络攻击行为检测装置可与上文网络攻击行为检测方法相互对应参照。
图7为本申请实施例提供的网络攻击行为检测装置的结构框图，该网络攻击行为检测装置具体可以为应用服务器，参照图7，该网络攻击行为检测装置可以包括：
用户上传信息接收模块100，用于接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
判断模块110，用于判断所述用户上传信息中是否包含网络攻击信息；
第一用户上传信息发送模块120，用于仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
可选地，图8示出了判断模块110的结构图，参阅图8，该判断模块110具体包括：
第一发送方信息提取模块200，用于提取所述用户上传信息中的发送方信息，所述发送方信息至少包括：发送用户上传信息的用户对应的用户标识或者发送用户上传信息的用户的网络之间互连的协议IP地址；
合法发送方信息判断模块210，用于判断所述发送方信息是否是合法发送方信息，如果发送方信息是合法发送方信息，则确定用户上传信息不包含网络攻击信息，否则确定用户上传信息中包含网络攻击信息。
进一步需要说明的是，本申请实施例提供的合法发送方信息判断模块包括第一合法发送方信息判断子模块或第二合法发送方信息判断子模块，其中：
第一合法发送方信息判断子模块，用于判断所述发送方信息是否存储在发送方白名单列表中，所述发送方白名单列表中至少包括：发送用户上传信息的合法用户对应的合法发送方信息；
第二合法发送方信息判断子模块，用于判断所述发送方信息是否未存储在发送方黑名单列表中，所述发送方黑名单列表中至少包括：发送用户上传信息的非法用户对应的非法发送方信息。
可选地，图9示出了判断模块110的另一种结构图，参阅图9，该判断模块110具体包括：
上传请求参数提取模块300，用于提取所述用户上传信息中的上传请求参数，所述上传请求参数为用户上传信息过程中采用的参数；
上传请求参数判断模块310，用于判断所述上传请求参数中是否包含网络攻 击信息。
所述上传请求参数判断模块包括SQL注入攻击特征判断模块和XSS注入攻击特征判断模块中的至少一个，其中：
SQL注入攻击特征判断模块，用于判断所述上传请求参数中是否包含结构化查询语言SQL注入攻击特征字符；
XSS注入攻击特征判断模块，用于判断所述上传请求参数中是否包含跨站脚本XSS注入攻击特征字符。
进一步需要说明的是，本申请实施例提供的网络攻击行为检测装置还可以包括：用户上传信息次数统计模块，用于在预设时间间隔中，统计由同一用户发送包含网络攻击信息的用户上传信息的次数；提示信息发送模块，用于在由同一用户发送包含网络攻击信息的用户上传信息的次数满足预设网络攻击次数值的情况下，向该用户发送访问受到限制的提示信息。
进一步需要说明的是，本申请实施例提供的网络攻击行为检测装置还可以包括：
第二发送方信息提取模块，用于提取用户上传信息中的发送方信息；
第一发送方信息判断模块，用于判断所述发送方信息是否存储在安全扫描白名单列表中，所述安全扫描白名单列表中至少包括：适配安全平台漏洞扫描的发送方信息。
进一步需要说明的是，本申请实施例提供的网络攻击行为检测装置还可以包括：
第三发送方信息提取模块，用于提取用户上传信息中的发送方信息；
第二发送方信息判断模块，用于判断所述发送方信息中是否包含漏洞扫描的请求标识。
本申请实施例提供的网络攻击行为检测装置还包括：
第四发送方信息提取模块，用于提取不包含网络攻击信息的用户上传信息中的发送方信息；
白名单列表更新模块，用于依据所述不包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方白名单列表进行更新。
另外，本申请实施例提供的网络攻击行为检测装置还可以包括：第五发送方信息提取模块，用于提取包含网络攻击信息的用户上传信息中的发送方信息；
黑名单列表更新模块，用于依据所述包含网络攻击信息的用户上传信息中 的发送方信息，对所述发送方黑名单列表进行更新。
可选地，网络攻击行为检测装置可以为硬件设备，上文描述的模块、单元可以设置于网络攻击行为检测装置内的功能模块。
图10示出了网络攻击行为检测装置的硬件结构框图，参照图10，网络攻击行为检测装置可以包括：处理器1，通信接口2，存储器3和通信总线4；其中处理器1、通信接口2、存储器3通过通信总线4完成相互间的通信；可选地，通信接口2可以为通信模块的接口，如GSM模块的接口；
处理器1，用于执行程序；存储器3，用于存放程序；程序可以包括程序代码，所述程序代码包括计算机操作指令。
处理器1可能是一个中央处理器CPU，或者是特定集成电路ASIC(Application Specific Integrated Circuit)，或者是被配置成实施本申请实施例的一个或多个集成电路；存储器3可能包含高速RAM存储器，也可能还包括非易失性存储器(non-volatile memory)，例如至少一个磁盘存储器。
其中，处理器在执行存储在存储器中的程序时可实施如前面所述的网络攻击行为检测方法，例如：
接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
判断所述用户上传信息中是否包含网络攻击信息；
在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其他实施例的不同之处，各个实施例之间相同相似部分互相参见即可。对于实施例公开的装置而言，由于其与实施例公开的方法相对应，所以描述的比较简单，相关之处参见方法部分说明即可。
专业人员还可以进一步意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各示例的组成及步骤。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
结合本文中所公开的实施例描述的方法或算法的步骤可以直接用硬件、处理器执行的软件模块，或者二者的结合来实施。软件模块可以置于随机存储器(RAM)、内存、只读存储器(ROM)、电可编程ROM、电可擦除可编程ROM、寄存器、硬盘、可移动磁盘、CD-ROM、或技术领域内所公知的任意其它形式的存储介质中。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本申请。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文所示的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。

Claims (23)

  1. 一种网络攻击行为检测方法，其特征在于，包括：
    接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
    判断所述用户上传信息中是否包含网络攻击信息；
    仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述判断所述用户上传信息中是否包含网络攻击信息的步骤包括：
    提取所述用户上传信息中的发送方信息，所述发送方信息至少包括：发送用户上传信息的用户对应的用户标识或者发送用户上传信息的用户的网络之间互连的协议IP地址；
    判断所述发送方信息是否是合法发送方信息，其中，如果所述发送方信息是合法发送方信息，则确定所述用户上传信息中不包含网络攻击信息，如果发送方信息不是合法的发送方信息，则确定所述用户上传信息中包含网络攻击信息。
  3. 根据权利要求2所述的方法，其特征在于，所述判断所述发送方信息是否是合法发送方信息的步骤包括：
    判断所述发送方信息是否存储在发送方白名单列表中，所述发送方白名单列表中至少包括：发送用户上传信息的合法用户对应的合法发送方信息。
  4. 根据权利要求2所述的方法，其特征在于，所述判断所述发送方信息是否是合法发送方信息的步骤包括：
    判断所述发送方信息是否未存储在发送方黑名单列表中，所述发送方黑名单列表中至少包括：发送用户上传信息的非法用户对应的非法发送方信息。
  5. 根据权利要求1所述的方法，其特征在于，所述判断所述用户上传信息中是否包含网络攻击信息的步骤包括：
    提取所述用户上传信息中的上传请求参数，所述上传请求参数为用户上传信息过程中采用的参数；
    判断所述上传请求参数中是否包含网络攻击信息。
  6. 根据权利要求5所述的方法，其特征在于，所述判断所述上传请求参数中是否包含网络攻击信息的步骤包括下述步骤中的至少一个：
    判断所述上传请求参数中是否包含结构化查询语言注入攻击特征字符；和
    判断所述上传请求参数中是否包含跨站脚本注入攻击特征字符。
  7. 根据权利要求1所述的方法，其特征在于，还包括：
    在预设时间间隔中，统计由同一用户发送包含网络攻击信息的用户上传信息的次数；
    在由同一用户发送包含网络攻击信息的用户上传信息的次数满足预设网络攻击次数值的情况下，向该用户发送访问受到限制的提示信息。
  8. 根据权利要求1所述的方法，其特征在于，在判断所述用户上传信息中是否包含网络攻击信息之前，还包括：
    提取用户上传信息中的发送方信息；
    判断所述发送方信息是否存储在安全扫描白名单列表中，所述安全扫描白名单列表中至少包括：适配安全平台漏洞扫描的发送方信息；
    在所述发送方信息存储在安全扫描白名单列表中的情况下，判断所述用户上传信息中是否包含网络攻击信息。
  9. 根据权利要求1所述的方法，其特征在于，在判断所述用户上传信息中是否包含网络攻击信息之前，还包括：
    提取用户上传信息中的发送方信息；
    判断所述发送方信息中是否包含漏洞扫描的请求标识；
    在所述发送方信息中包含漏洞扫描的请求标识的情况下，判断所述用户上传信息中是否包含网络攻击信息。
  10. 根据权利要求1或3所述的方法，其特征在于，在确定在所述用户上传信息中不包含网络攻击信息的情况下，还包括：
    提取不包含网络攻击信息的用户上传信息中的发送方信息；
    依据所述不包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方白名单列表进行更新。
  11. 根据权利要求1或4所述的方法，其特征在于，在确定在所述用户上传信息中包含网络攻击信息的情况下，还包括：
    提取包含网络攻击信息的用户上传信息中的发送方信息；
    依据所述包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方黑名单列表进行更新。
  12. 一种网络攻击行为检测装置，其特征在于，包括：
    用户上传信息接收模块，用于接收用户上传信息，所述用户上传信息为客户端与服务器交互过程中主动上传的信息或者客户端响应服务器请求所上传的信息；
    判断模块，用于判断所述用户上传信息中是否包含网络攻击信息；
    第一用户上传信息发送模块，用于仅在所述用户上传信息中不包含网络攻击信息的情况下，将所述用户上传信息发送至业务逻辑层进行处理。
  13. 根据权利要求12所述的装置，其特征在于，所述判断模块包括：
    第一发送方信息提取模块，用于提取所述用户上传信息中的发送方信息，所述发送方信息至少包括：发送用户上传信息的用户对应的用户标识或者发送用户上传信息的用户的网络之间互连的协议IP地址；
    合法发送方信息判断模块，用于判断所述发送方信息是否是合法发送方信息，其中，如果所述发送方信息是合法发送方信息，则确定所述用户上传信息中不包含网络攻击信息；如果发送方信息不是合法的发送方信息，则确定所述用户上传信息中包含网络攻击信息。
  14. 根据权利要求13所述的装置，其特征在于，所述合法发送方信息判断模块包括：
    第一合法发送方信息判断子模块，用于判断所述发送方信息是否存储在发送方白名单列表中，所述发送方白名单列表中至少包括：发送用户上传信息的合法用户对应的合法发送方信息。
  15. 根据权利要求13所述的装置，其特征在于，所述合法发送方信息判断模块包括：
    第二合法发送方信息判断子模块，用于判断所述发送方信息是否未存储在发送方黑名单列表中，所述发送方黑名单列表中至少包括：发送用户上传信息的非法用户对应的非法发送方信息。
  16. 根据权利要求12所述的装置，其特征在于，所述判断模块包括：
    上传请求参数提取模块，用于提取所述用户上传信息中的上传请求参数，所述上传请求参数为用户上传信息过程中采用的参数；
    上传请求参数判断模块，用于判断所述上传请求参数中是否包含网络攻击信息。
  17. 根据权利要求16所述的装置，其特征在于，所述上传请求参数判断模块包括结构化查询语言注入攻击特征判断模块和跨站脚本注入攻击特征判断模 块中的至少一个，其中：
    结构化查询语言注入攻击特征判断模块，用于判断所述上传请求参数中是否包含结构化查询语言注入攻击特征字符；
    跨站脚本注入攻击特征判断模块，用于判断所述上传请求参数中是否包含跨站脚本注入攻击特征字符。
  18. 根据权利要求12所述的装置，其特征在于，还包括：
    用户上传信息次数统计模块，用于在预设时间间隔中，统计由同一用户发送包含网络攻击信息的用户上传信息的次数；
    提示信息发送模块，用于在由同一用户发送包含网络攻击信息的用户上传信息的次数满足预设网络攻击次数值的情况下，向该用户发送访问受到限制的提示信息。
  19. 根据权利要求12所述的装置，其特征在于，还包括：
    第二发送方信息提取模块，用于提取用户上传信息中的发送方信息；
    第一发送方信息判断模块，用于判断所述发送方信息是否存储在安全扫描白名单列表中，所述安全扫描白名单列表中至少包括：适配安全平台漏洞扫描的发送方信息。
  20. 根据权利要求12所述的装置，其特征在于，还包括：
    第三发送方信息提取模块，用于提取用户上传信息中的发送方信息；
    第二发送方信息判断模块，用于判断所述发送方信息中是否包含漏洞扫描的请求标识。
  21. 根据权利要求12或14所述的装置，其特征在于，还包括：
    第四发送方信息提取模块，用于提取不包含网络攻击信息的用户上传信息中的发送方信息；
    白名单列表更新模块，用于依据所述不包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方白名单列表进行更新。
  22. 根据权利要求12或15所述的装置，其特征在于，还包括：
    第五发送方信息提取模块，用于提取包含网络攻击信息的用户上传信息中的发送方信息；
    黑名单列表更新模块，用于依据所述包含网络攻击信息的用户上传信息中的发送方信息，对所述发送方黑名单列表进行更新。
  23. 一种应用服务器，其特征在于，包括：
    如权利要求12至权利要求22任意一项所述的网络攻击行为检测装置。
PCT/CN2017/093156 2016-07-19 2017-07-17 网络攻击行为检测方法及装置 WO2018014808A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/026,793 US10848505B2 (en) 2016-07-19 2018-07-03 Cyberattack behavior detection method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610575103.XA CN105959335B (zh) 2016-07-19 2016-07-19 一种网络攻击行为检测方法及相关装置
CN201610575103.X 2016-07-19

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/026,793 Continuation US10848505B2 (en) 2016-07-19 2018-07-03 Cyberattack behavior detection method and apparatus

Publications (1)

Publication Number Publication Date
WO2018014808A1 true WO2018014808A1 (zh) 2018-01-25

Family

ID=56901040

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/093156 WO2018014808A1 (zh) 2016-07-19 2017-07-17 网络攻击行为检测方法及装置

Country Status (3)

Country Link
US (1) US10848505B2 (zh)
CN (1) CN105959335B (zh)
WO (1) WO2018014808A1 (zh)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105959335B (zh) 2016-07-19 2019-11-19 腾讯科技（深圳）有限公司 一种网络攻击行为检测方法及相关装置
CN106888211A (zh) * 2017-03-10 2017-06-23 北京安赛创想科技有限公司 一种网络攻击的检测方法及装置
CN107392027A (zh) * 2017-07-13 2017-11-24 福建中金在线信息科技有限公司 一种网站漏洞测试方法、测试系统、电子设备及存储介质
CN108667854A (zh) * 2018-06-29 2018-10-16 北京奇虎科技有限公司 网络漏洞检测方法及装置、网络漏洞自动发布系统
CN109711166B (zh) * 2018-12-17 2020-12-11 北京知道创宇信息技术股份有限公司 漏洞检测方法及装置
US10498760B1 (en) * 2019-07-16 2019-12-03 ALSCO Software LLC Monitoring system for detecting and preventing a malicious program code from being uploaded from a client computer to a webpage computer server
CN112565271B (zh) * 2020-12-07 2022-09-02 瑞数信息技术（上海）有限公司 Web攻击检测方法和装置
CN112583845B (zh) * 2020-12-24 2023-11-07 深信服科技股份有限公司 一种访问检测方法、装置、电子设备和计算机存储介质
CN114692147A (zh) * 2020-12-30 2022-07-01 苏州国双软件有限公司 一种攻击语句处理方法、装置、电子设备及存储介质
CN112954379B (zh) * 2021-02-09 2023-04-21 中国工商银行股份有限公司 直播控制方法和装置
CN113190837A (zh) * 2021-03-29 2021-07-30 贵州电网有限责任公司 一种基于文件服务系统的web攻击行为检测方法及系统
CN113329032B (zh) * 2021-06-23 2023-02-03 深信服科技股份有限公司 一种攻击检测方法、装置、设备和介质
CN113596064B (zh) * 2021-09-30 2021-12-24 成都诺比侃科技有限公司 一种安防平台的分析控制方法及系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102082810A (zh) * 2009-11-30 2011-06-01 中国移动通信集团广西有限公司 一种用户终端访问互联网的方法、系统及装置
US20130152189A1 (en) * 2011-12-09 2013-06-13 Electronics And Telecommunications Research Institute Authentication method and apparatus for detecting and preventing source address spoofing packets
CN103248472A (zh) * 2013-04-16 2013-08-14 华为技术有限公司 一种处理操作请求的方法、系统以及攻击识别装置
CN105704146A (zh) * 2016-03-18 2016-06-22 四川长虹电器股份有限公司 Sql防注入的系统与方法
CN105959335A (zh) * 2016-07-19 2016-09-21 腾讯科技（深圳）有限公司 一种网络攻击行为检测方法及相关装置

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050108272A1 (en) * 2003-11-13 2005-05-19 Christian Behrens Intermediate software layer
WO2008047351A2 (en) * 2006-10-19 2008-04-24 Checkmarx Ltd. Locating security vulnerabilities in source code
CN101526906A (zh) * 2008-03-07 2009-09-09 上海汇和信息技术有限公司 运行维护服务管理系统
EP2513793B1 (en) * 2009-12-15 2018-11-14 Synopsys, Inc. Method and system of runtime analysis
US9930011B1 (en) * 2012-11-30 2018-03-27 United Services Automobile Association (Usaa) Private network request forwarding
KR101455167B1 (ko) * 2013-09-03 2014-10-27 한국전자통신연구원 화이트리스트 기반의 네트워크 스위치
US9392007B2 (en) * 2013-11-04 2016-07-12 Crypteia Networks S.A. System and method for identifying infected networks and systems from unknown attacks
CN106134230A (zh) * 2013-11-21 2016-11-16 哥莱菲特软件公司 用于移动信息设备上的远程内容和配置控制的管理域
US10645043B2 (en) * 2014-06-23 2020-05-05 Lenovo (Singapore) Pte. Ltd. Stateful notification
US9398028B1 (en) * 2014-06-26 2016-07-19 Fireeye, Inc. System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers
CN104601540B (zh) * 2014-12-05 2018-11-16 华为技术有限公司 一种跨站脚本XSS攻击防御方法及Web服务器
CN107113313A (zh) * 2015-03-02 2017-08-29 微软技术许可有限责任公司 将数据从源上传到目的地的代理服务
US10114957B2 (en) * 2015-04-17 2018-10-30 Dropbox, Inc. Collection folder for collecting file submissions and using facial recognition

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102082810A (zh) * 2009-11-30 2011-06-01 中国移动通信集团广西有限公司 一种用户终端访问互联网的方法、系统及装置
US20130152189A1 (en) * 2011-12-09 2013-06-13 Electronics And Telecommunications Research Institute Authentication method and apparatus for detecting and preventing source address spoofing packets
CN103248472A (zh) * 2013-04-16 2013-08-14 华为技术有限公司 一种处理操作请求的方法、系统以及攻击识别装置
CN105704146A (zh) * 2016-03-18 2016-06-22 四川长虹电器股份有限公司 Sql防注入的系统与方法
CN105959335A (zh) * 2016-07-19 2016-09-21 腾讯科技（深圳）有限公司 一种网络攻击行为检测方法及相关装置

Also Published As

Publication number Publication date
CN105959335A (zh) 2016-09-21
CN105959335B (zh) 2019-11-19
US10848505B2 (en) 2020-11-24
US20180332057A1 (en) 2018-11-15

Similar Documents

Publication Publication Date Title
WO2018014808A1 (zh) 网络攻击行为检测方法及装置
US11632379B2 (en) Method and system for detecting restricted content associated with retrieved content
US9900346B2 (en) Identification of and countermeasures against forged websites
Ghasemisharif et al. O single {Sign-Off}, where art thou? An empirical analysis of single {Sign-On} account hijacking and session management on the web
US20200137110A1 (en) Systems and methods for threat detection and warning
US8561182B2 (en) Health-based access to network resources
US9059984B2 (en) Authenticating an auxiliary device from a portable electronic device
WO2016188256A1 (zh) 一种应用接入鉴权的方法、系统、装置及终端
US7752269B2 (en) Adhoc secure document exchange
US20100100950A1 (en) Context-based adaptive authentication for data and services access in a network
CN107046544B (zh) 一种识别对网站的非法访问请求的方法和装置
US20110258326A1 (en) Method, device, and system for implementing resource sharing
US20180255066A1 (en) Enhanced authentication security
CN107295116B (zh) 一种域名解析方法、装置及系统
WO2019095856A1 (zh) 一种网络身份认证方法、系统及其使用的用户代理设备
JP2008539519A (ja) 不正インターネットアカウントアクセスの防止
US11770385B2 (en) Systems and methods for malicious client detection through property analysis
US20090216795A1 (en) System and method for detecting and blocking phishing attacks
CN106899561B (zh) 一种基于acl的tnc权限控制方法和系统
US20210083881A1 (en) Dynamically analyzing third-party application website certificates across users to detect malicious activity
CN111786996B (zh) 一种跨域同步登录态的方法、装置及跨域同步登录系统
US20180039771A1 (en) Method of and server for authorizing execution of an application on an electronic device
CN112291204B (zh) 访问请求的处理方法、装置及可读存储介质
CN114866247B (zh) 一种通信方法、装置、系统、终端及服务器
KR101815145B1 (ko) 크로스 도메인간 인증서 공유방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17830442

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17830442

Country of ref document: EP

Kind code of ref document: A1