WO2019205202A1 - 基于大数据的业务逻辑学习、防护方法及学习、防护装置 - Google Patents

基于大数据的业务逻辑学习、防护方法及学习、防护装置 Download PDF

Info

Publication number
WO2019205202A1
WO2019205202A1 PCT/CN2018/087674 CN2018087674W WO2019205202A1 WO 2019205202 A1 WO2019205202 A1 WO 2019205202A1 CN 2018087674 W CN2018087674 W CN 2018087674W WO 2019205202 A1 WO2019205202 A1 WO 2019205202A1
Authority
WO
WIPO (PCT)
Prior art keywords
request
identifier
request identifier
network request
network
Prior art date
Application number
PCT/CN2018/087674
Other languages
English (en)
French (fr)
Inventor
黄梅芬
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP18904497.7A priority Critical patent/EP3585034B1/en
Priority to EP20214229.5A priority patent/EP3809675A1/en
Priority to US16/544,821 priority patent/US20200007499A1/en
Publication of WO2019205202A1 publication Critical patent/WO2019205202A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • G06F16/9566—URL specific, e.g. using aliases, detecting broken or misspelled links
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/60—Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources
    • H04L67/62—Establishing a time schedule for servicing the requests
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/901—Indexing; Data structures therefor; Storage structures
    • G06F16/9017—Indexing; Data structures therefor; Storage structures using directory or table look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/107—Network architectures or network communication protocols for network security for controlling access to devices or network resources wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/121—Timestamp

Definitions

  • the present application relates to the field of Internet technologies, and in particular, to a business logic learning, protection method, and learning and protection device based on big data.
  • the protection measures of the existing business logic are usually multiple verification or manual verification of the business logic. However, these methods are often accompanied by a complicated authentication process and waste more manpower and resources, and the protection efficiency is not high and will damage the customer. Use experience.
  • the purpose of the present application is to provide a business logic learning, protection method, and learning and protection device based on big data, which can improve the protection efficiency of business logic, can adapt to various business logic scenarios, and can flexibly adapt to various services. Changes in logical requirements.
  • an application of the present invention provides a service logic learning method based on big data, the method comprising: receiving a network request sent by a requester, identifying a current request identifier of the network request, and parsing the network. Requesting process information; extracting a reference request identifier from the process information, and determining whether there is a direction pointing to the current request identifier by the reference request identifier in the process direction table, and updating the process direction table based on the judgment result And responding to the network request, sending, by the network request, a tracking code, where the tracking code includes the current request identifier and a timestamp for sending the tracking code; wherein, if the network requests When the new network request is initiated again, the tracking code adds the current request identifier and the timestamp to the process information of the new network request.
  • another aspect of the present application further provides a big data-based business logic learning device, the device comprising a memory and a processor, wherein the memory stores a computer program, the computer program being the processor When executed, the following steps are implemented: receiving a network request sent by the requesting party, identifying a current request identifier of the network request, and parsing process information of the network request; extracting a reference request identifier from the process information, and determining Whether there is a direction to the current request identifier by the reference request identifier in the flow direction table, and updating the flow direction table according to the judgment result; when responding to the network request, sending a tracking code to the network request, The tracking code includes the current request identifier and a timestamp for delivering the tracking code; wherein the tracking code will be the current request if a new network request is initiated again on the basis of the network request The identification and the timestamp are added to the process information of the new network request.
  • another aspect of the present application further provides a big data-based service logic protection method, the method comprising: receiving a network request sent by a requesting party, and identifying a current request identifier of the network request;
  • the current request identifier is not a start request identifier
  • the reference request identifier is parsed from the flow information of the network request, and it is determined whether the direction of the current request identifier by the reference request identifier exists in the process direction table; Calculating a time difference between a current time when the network request is received and a timestamp of the reference request identifier recorded in the process information, and determining whether the calculated time difference is in the record in the flow direction table.
  • another aspect of the present application further provides a big data-based business logic protection device, the device comprising a memory and a processor, wherein the memory stores a computer program, and the computer program is used by the processor
  • the following steps are implemented: receiving a network request sent by the requester, and identifying a current request identifier of the network request; if the current request identifier is not a start request identifier, parsing the reference from the process information of the network request Determining an identifier, and determining whether a direction of the current request identifier by the reference request identifier exists in the process direction table; if yes, calculating a current time of receiving the network request and the description in the process information Determining a time difference between the timestamps of the request identifiers; determining whether the calculated time difference is within a time difference between the current request identifier and the reference request identifier recorded in the flow direction table, if not, returning To the start request identifier in the request flow in which
  • the technical solution provided by the present application can learn the business logic process for a large number of network requests based on big data learning, thereby summarizing the normal request process.
  • the current request identifier of the network request may be identified, and the process information of the network request may be parsed.
  • the current request identifier may uniquely represent the network request, and the reference request identifier in the process information may represent a reference page of the network request.
  • the direction of the current request identifier may be formed by the reference request identifier, and the process direction table may be updated according to the current trend.
  • the tracking code may be sent in response to the network request, and the tracking code may include the current request identifier and a time stamp for issuing the tracking code.
  • the tracking code may add the current request identifier and the timestamp to the process information of the new network request, thereby The current request identifies the reference request identifier as a new network request.
  • the process may return to the start request identifier in the request process in which the current request identifier is located, thereby restarting the access process of the business logic.
  • the technical solution of the present application can adapt to various business logic scenarios, and can flexibly adapt to changes in various business logic requirements.
  • the complicated authentication process is avoided, and a lot of manpower and material resources can be saved, thereby improving the protection efficiency of the business logic.
  • FIG. 1 is a flowchart of a big data-based business logic learning method in an embodiment of the present application
  • FIG. 2 is a schematic structural diagram of a service logic learning device based on big data in an embodiment of the present application
  • FIG. 3 is a flowchart of a service logic protection method based on big data in the embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a computer terminal in an embodiment of the present application.
  • the present application provides a big data-based business logic learning method.
  • the method may include the following steps.
  • S11 Receive a network request sent by the requesting party, and identify a current request identifier of the network request and process information for parsing the network request.
  • the network request may be an HTTP request including a URL (Uniform Resource Locator).
  • a URL Uniform Resource Locator
  • the network request can be classified according to the parameters carried in the network request, and the network request of the same category is formatted into a format request of the same parameter type, and a large number of network requests can be formatted into different ones by categorization. Format request for parameter type.
  • formatting requests can be divided into integers, strings, hybrids, enumerations, and other types.
  • Table 1 shows the correspondence between the type of network request and the format request
  • a unique identifier can be assigned for each formatting request.
  • the unique identifier may be generated in a fixed format. Specifically, the unique identifier may be composed of a-z and any three digits/numbers of 0-9. For example, after receiving the network request from the requester, the network request can be classified, the network request is formatted into a format request corresponding to the parameter type, and then the format request is assigned a unique identifier, and The unique identifier assigned to the format request is the current request identifier for the network request. For formatted requests with the same parameter type, but if the request path is different, the final assigned unique identifier is also different.
  • the network request includes process information
  • the process information may represent which network request is sent based on the network request.
  • the process information of the request A may represent that the current request A is initiated based on the request B, and may also be understood as The previous request of current request A is request B. Therefore, the process information may include a reference request identifier and a timestamp corresponding to the reference request identifier, so that it is known from the process information that the currently received network request is initiated based on the network request corresponding to the reference request identifier.
  • the process information is parsed from the network request, it indicates that the network request has a higher-level network request.
  • the reference request identifier can be extracted from the process information, and then the direction from the reference request identifier to the current request identifier can be obtained.
  • the reference request identifier is a02
  • the current request identifier is b01
  • the direction of a02 pointing to b01 can be obtained.
  • the direction between network requests can be recorded in the process direction table.
  • the process direction table may be updated according to the result of the judgment. Specifically, if there is a direction in the flow direction table that points to the current request identifier by the reference request identifier, the total number of flows of the trend may be increased by 1, thereby accumulating the total number of flows of the trend. Then, update the time difference of the trend.
  • the time difference range between the current request identifier and the reference request identifier recorded in the flow direction table may be read, and the current time of receiving the network request and the current information recorded in the process information are calculated.
  • the time difference between the timestamps of the reference request identifiers is determined, and whether the calculated time difference is within a time difference recorded in the flow direction table, and the time difference range is updated based on the determination result.
  • a plurality of cases may be included when updating the time difference range. If the calculated time difference is less than the minimum of the time difference range, the minimum value of the time difference range may be changed to the calculated time difference.
  • the time difference ranges from 0.2 s to 1 s, and the calculated time difference is 0.1 s.
  • the time difference range can be modified to be 0.1 s to 1 s. If the calculated time difference is greater than the maximum value of the time difference range, the maximum value of the time difference range is changed to the calculated time difference. For example, the time difference ranges from 0.2 s to 1 s, and the calculated time difference is 1.5 s. At this time, the time difference range can be modified to be 0.2 s to 1.5 s. If the calculated time difference is within the time difference range, the time difference range may be maintained unchanged.
  • the time difference range recited in the flow direction table may be only a fixed value rather than a time interval.
  • the calculated time difference and the magnitude of the fixed value may be compared. If the calculated time difference is less than the fixed value, the time difference range may be modified to a minimum value as the calculated time difference and the maximum value is The interval of the fixed value. For example, the fixed value is 0.2 s, and the calculated time difference is 0.1 s. At this time, the time difference range can be modified to 0.1 s to 0.2 s. Furthermore, if the calculated time difference is greater than the fixed value, the time difference range may be modified to a minimum value of the fixed value and a maximum value being the calculated interval of the time difference.
  • the fixed value is 0.2 s
  • the calculated time difference is 0.5 s.
  • the time difference range can be modified to 0.2 s to 0.5 s.
  • the time difference range may not be changed.
  • the trend may be created in the process direction table, and the direction may be The total number of traffic is set to 1, and the time difference between the current time when the network request is received and the time stamp of the reference request identifier described in the flow information is recorded as the time difference of the trend. If the same trend occurs subsequently, the created trend can be updated.
  • the network request if the network request does not include the process information, it indicates that the network request is not initiated based on other network requests, but is used as a starting point of the network request.
  • the tracking code may be sent for the network request, where the tracking code includes the current request identifier and a timestamp of sending the tracking code.
  • the tracking code has the effect that if a new network request is initiated again on the basis of the network request, the tracking code can add the current request identifier and the timestamp to the new network request.
  • the process information For example, the currently received network request is request A, and the request A does not include the process information.
  • the tracking code may be sent for the request A, and the tracking code may include the current request A.
  • the request identifier a01 that is, the unique identifier of the request A corresponding to the format request
  • the time stamp of the delivery tracking code may be added a01 as a reference request identifier to the process information of the request B, and may also add the timestamp of the delivery tracking code.
  • the timestamp may be used to calculate a time difference corresponding to the direction formed by the current request identifier and the reference request identifier.
  • S15 in response to the network request, send a tracking code to the network request, where the tracking code includes the current request identifier and a timestamp for sending the tracking code; wherein, if the network request The tracking code adds the current request identifier and the timestamp to the flow information of the new network request when the new network request is initiated again.
  • the tracking code may be sent to the network request in response to the network request, and the tracking code may include the The current request identifier and the timestamp of the delivery of the tracking code. Consistent with the description in step S13, the tracking code has the effect that the tracking code can add the current request identifier and the timestamp if a new network request is initiated again on the basis of the network request. In the process information of the new network request. In this way, the process information of the new network request can be updated by issuing the tracking code.
  • the tracking code generally has multiple scenarios when adding request identifiers and timestamps.
  • One of the scenarios is that before the page pointed to by the network request is loaded, the specified label in the document of the page may be traversed, and the current request identifier and the identifier are added to the network request corresponding to the specified label. Timestamp.
  • the designated tags may be, for example, an A tag, a form tag, and an iframe tag. These tags can all reference new network requests, so the tracking code can add corresponding process information for the network requests corresponding to these tags.
  • it may be determined whether a hidden input label needs to be added to the network request corresponding to the specified label. For example, if the network request corresponding to the specified label is a POST request, a hidden input label can be added.
  • hooks can be used to implement page jumps and dynamically initiate requests.
  • These functions can be, for example, the window.open function and the XMLHTTPRequest function.
  • the page can be used to implement the page.
  • the current request identifier and the timestamp are added to the network request corresponding to the function of the jump and the dynamically initiated request.
  • the function can be, for example, an appendChild function and an innerHTML function.
  • the function for dynamically adding a page can be added.
  • the label is specified, the current request identifier and the timestamp are added to the network request corresponding to the specified label.
  • the designated tag may be, for example, the A tag, the form tag, and the iframe tag described above.
  • the inbound and outbound traffic information of each request identifier may be counted according to each trend recorded in the flow direction table.
  • the request identifier of the inbound and outbound traffic information meeting the specified condition may be used as the starting point request identifier.
  • the origin request identifier can be used as a starting point for a request flow.
  • the ratio between the inbound traffic and the outgoing traffic may be less than or equal to the first threshold, and the request identifier whose ratio between the incoming traffic and the total traffic is less than the second threshold is used as the starting point request identifier.
  • the first threshold may be, for example, 1/4
  • the second threshold may be, for example, 1/6.
  • the specific values of the first threshold and the second threshold may be flexibly adjusted. This is not a limitation.
  • the request flow corresponding to the start point request identifier may be counted.
  • a starting point request identifier has the following directions:
  • a time difference range may be provided between two adjacent request identifiers.
  • the present application further provides a big data-based business logic learning device, the device comprising a memory and a processor, wherein the memory stores a computer program, when the computer program is executed by the processor, Implement the following steps:
  • the tracking code is sent to the network request, the tracking code includes the current request identifier and a timestamp for sending the tracking code; wherein, if the network request is based When the new network request is initiated again, the tracking code adds the current request identifier and the timestamp to the process information of the new network request.
  • the memory may include physical means for storing information, typically by digitizing the information and then storing it in a medium that utilizes electrical, magnetic or optical methods.
  • the memory according to the embodiment may further include: a device for storing information by using an electric energy method, such as a RAM, a ROM, etc.; a device for storing information by using a magnetic energy method, such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory, and a USB flash drive; A device that optically stores information, such as a CD or a DVD.
  • an electric energy method such as a RAM, a ROM, etc.
  • a magnetic energy method such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory, and a USB flash drive
  • a device that optically stores information such as a CD or a DVD.
  • computer storage media such as quantum memories, graphene memories, and the like.
  • the processor can be implemented in any suitable manner.
  • the processor can take the form of, for example, a microprocessor or processor and computer readable media, logic gates, switches, and special-purpose integrations for storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • ASIC Application Specific Integrated Circuit
  • programmable logic controller programmable logic controller and embedded microcontroller form.
  • the present application further provides a business logic protection method based on big data.
  • the method includes:
  • S21 Receive a network request sent by the requesting party, and identify a current request identifier of the network request.
  • the service logic requested by the network may be determined.
  • the network request may be first formatted into a format request of the corresponding parameter type.
  • each format request corresponds to a unique identifier, and then the format is queried in the learning result. Whether the request has a corresponding unique identifier.
  • the unique identifier of the format request corresponding to the network request cannot be found, it indicates that the network request does not have a corresponding learning sample during the learning process.
  • the URL in the network request may be recorded, and Accumulate the number of times the URL appears.
  • the tracking code may be sent for the network request, and the tracking code may include the current request identifier of the network request and the time stamp of the delivery tracking code.
  • the start request identifier determined by the learning phase may be determined to determine whether the current request identifier is a start request identifier.
  • the current request identifier is a start request identifier, it indicates that the network request is not initiated based on other network requests, but is a starting point of a request process.
  • the network request is to send a tracking code, where the tracking code may include the current request identifier and a timestamp for sending the tracking code. In this way, if a new network request is initiated again on the basis of the network request, the tracking code may add the current request identifier and the timestamp to the process information of the new network request, thereby Subsequent request processes are tracked.
  • the current request identifier is not a start request identifier, it indicates that the network request should be initiated based on other network requests, and the network request should carry the flow information. At this time, it can be determined whether the network request carries the process information. If the process information is not carried, the network request does not match the normal service logic, and may be a problematic network request. At this time, the identifier of the requesting party that sends the network request may be recorded, and the number of times the requesting party sends the network request that does not have the flow information within a specified time limit may be accumulated.
  • the requester keeps sending the network request without the process information for a short time, it indicates that the requestor is the problematic requestor, and the requestor may be trying to destroy the normal business logic. At this time, when the accumulated number of times reaches the number of times threshold, the network request sent by the requesting party may be rejected.
  • the tracking code may be sent to the network request in response to the network request, where the tracking code may include the current request identifier and issue the tracking code. Timestamp to track the network request.
  • the reference request identifier may be parsed from the process information of the network request, and it is determined whether the direction of the current request identifier is determined by the reference request identifier. The process goes to the table. If it does not exist, it indicates that the trend is the wrong direction and does not conform to the normal business logic.
  • the tracking code is sent for the network request, and the tracking information corresponding to the tracking code is the flow information of the network request and the current request identifier and the lower The timestamp of the tracking code is sent so that the subsequent request flow can be tracked for the network request.
  • the tracking code is sent to the network request corresponding to the start point request identifier, where the tracking code includes the start request identifier and the time when the tracking code is sent. Stamp, thereby continuing to track the reinitiated network request.
  • the time difference of the trend is correct. Specifically, a time difference between a current time when the network request is received and a timestamp of the reference request identifier recorded in the process information may be calculated.
  • S25 Determine whether the calculated time difference is within a time difference between the current request identifier and the reference request identifier recorded in the flow direction table, and if not, return to the current request identifier. Determining the start point request identifier in the request process, and in response to the network request corresponding to the start point request identifier, sending a tracking code to the network request corresponding to the start point request identifier, where the tracking code includes the start point request identifier and the next The timestamp of the tracking code.
  • the time difference can be compared with the time difference range described in the flow direction table. Specifically, if the calculated time difference is within the time difference, it indicates that the network request is in accordance with the normal service logic, and the tracking code may be sent to the network request in response to the network request.
  • the tracking information corresponding to the tracking code is a process information of the network request and a set of the current request identifier and a time stamp for issuing the tracking code. In this way, subsequent network requests can be tracked to perform subsequent network request protection processes.
  • the calculated time difference is not within the time difference, it indicates that there is a problem with the current network request, and at this time, it may return to the start request identifier in the request flow in which the current request identifier is located, thereby restarting the service. Logical access process. Then, in response to the starting point requesting to identify the corresponding network request, the tracking code may be sent to the network request corresponding to the start point request identifier, where the tracking code includes the starting point request identifier and the issuance of the tracking code. Timestamps to continue tracking the reinitiated network request and perform the appropriate protection process.
  • tracking code is usually sent only on the page where the content-type is text/html and the return status code is 200.
  • the location address can be modified and the process information is added. track.
  • the present application also provides a business logic protection device based on big data, the device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the following steps are implemented:
  • the current request identifier is not the start request identifier, parsing the reference request identifier from the process information of the network request, and determining whether the direction of the current request identifier by the reference request identifier exists in the process direction table; If yes, calculating a time difference between a current time when the network request is received and a timestamp of the reference request identifier recorded in the process information;
  • the tracking code is sent to the network request corresponding to the start point request identifier, where the tracking code includes the start request identifier and the delivery office The timestamp of the tracking code.
  • the memory may include physical means for storing information, typically by digitizing the information and then storing it in a medium that utilizes electrical, magnetic or optical methods.
  • the memory according to the embodiment may further include: a device for storing information by using an electric energy method, such as a RAM, a ROM, etc.; a device for storing information by using a magnetic energy method, such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory, and a USB flash drive; A device that optically stores information, such as a CD or a DVD.
  • an electric energy method such as a RAM, a ROM, etc.
  • a magnetic energy method such as a hard disk, a floppy disk, a magnetic tape, a magnetic core memory, a magnetic bubble memory, and a USB flash drive
  • a device that optically stores information such as a CD or a DVD.
  • computer storage media such as quantum memories, graphene memories, and the like.
  • the processor can be implemented in any suitable manner.
  • the processor can take the form of, for example, a microprocessor or processor and computer readable media, logic gates, switches, and special-purpose integrations for storing computer readable program code (eg, software or firmware) executable by the (micro)processor.
  • ASIC Application Specific Integrated Circuit
  • programmable logic controller programmable logic controller and embedded microcontroller form.
  • Computer terminal 10 may include one or more (only one of which is shown) processor 102 (processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), for storing data.
  • processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), for storing data.
  • computer terminal 10 may also include more or fewer components than shown in FIG. 4, or have a different configuration than that shown in FIG.
  • the above-described business logic learning and protection method may be stored as a computer program in the above-described memory 104, and the memory 104 may be coupled to the processor 102, and then the processor 102 executes the memory 104.
  • the steps in the learning and protection methods of the above business logic can be implemented.
  • the memory 104 can be used to store software programs and modules of application software, and the processor 102 executes various functional applications and data processing by running software programs and modules stored in the memory 104.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be coupled to computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is for receiving or transmitting data via a network.
  • the network specific examples described above may include a wireless network provided by a communication provider of the computer terminal 10.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module for communicating with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • the technical solution provided by the present application can learn the business logic process for a large number of network requests based on big data learning, thereby summarizing the normal request process.
  • the current request identifier of the network request may be identified, and the process information of the network request may be parsed.
  • the current request identifier may uniquely represent the network request, and the reference request identifier in the process information may represent a reference page of the network request.
  • the direction of the current request identifier may be formed by the reference request identifier, and the process direction table may be updated according to the current trend.
  • the tracking code may be sent in response to the network request, and the tracking code may include the current request identifier and a time stamp for issuing the tracking code.
  • the tracking code may add the current request identifier and the timestamp to the process information of the new network request, thereby The current request identifies the reference request identifier as a new network request.
  • the process may return to the start request identifier in the request process in which the current request identifier is located, thereby restarting the access process of the business logic.
  • the technical solution of the present application can adapt to various business logic scenarios, and can flexibly adapt to changes in various business logic requirements.
  • the complicated authentication process is avoided, and a lot of manpower and material resources can be saved, thereby improving the protection efficiency of the business logic.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Information Transfer Between Computers (AREA)
  • Storage Device Security (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请公开了一种基于大数据的业务逻辑学习、防护方法及学习、防护装置，其中，所述学习方法包括：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表；针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳。本申请提供的技术方案，能够提高基于大数据的业务逻辑防护效率,可以适应各种各样的业务逻辑场景，能灵活的适应各种业务逻辑需求的变更。

Description

基于大数据的业务逻辑学习、防护方法及学习、防护装置 技术领域
本申请涉及互联网技术领域，特别涉及一种基于大数据的业务逻辑学习、防护方法及学习、防护装置。
背景技术
随着互联网和计算机技术的不断发展，业务系统的复杂程度也随着业务需求的发展不断提高，业务的多样性会使得主体业务逻辑延伸出逻辑分支，业务逻辑也变得越来越复杂。复杂的业务逻辑往往会产生一定的缺陷，而业务逻辑的缺陷会导致一些漏洞。例如：订单的业务逻辑出现漏洞时，订单的金额可以被随意修改，从而造成严重的金融问题。
现有的业务逻辑的防护措施通常是对业务逻辑进行多重校验或者人工审核，然而，这些方式往往伴随着复杂的认证过程并且会浪费较多的人力物力，防护效率不高并且会损害客户的使用体验。
发明内容
本申请的目的在于提供一种基于大数据的业务逻辑学习、防护方法及学习、防护装置，能够提高业务逻辑的防护效率,可以适应各种各样的业务逻辑场景，能灵活的适应各种业务逻辑需求的变更。
为实现上述目的，本申请一方面提供一种基于大数据的业务逻辑学习方法，所述方法包括：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求 标识的走向，并基于判断结果更新所述流程走向表；在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
为实现上述目的，本申请另一方面还提供一种基于大数据的业务逻辑学习装置，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表；在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
为实现上述目的，本申请另一方面还提供一种基于大数据的业务逻辑防护方法，所述方法包括：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识；若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
为实现上述目的，本申请另一方面还提供一种基于大数据的业务逻辑防护装置，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识；若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
由上可见，本申请提供的技术方案，一方面，基于大数据学习，可以针对大量的网络请求进行业务逻辑的学习过程，从而总结出正常的请求流程。具体地，在接收到网络请求之后，可以识别该网络请求的当前请求标识，并解析该网络请求的流程信息。其中，所述当前请求标识可以唯一地表征该网络请求，所述流程信息中的引用请求标识则可以体现该网络请求的引用页面。这样，可以构成由所述引用请求标识指向所述当前请求标识的走向，并根据本次的走向，对流程走向表进行更新。后续在响应该网络请求时，可以下发跟踪代码，该跟踪代码中可以包含所述当前请求标识以及下发所述跟踪代码的时间戳。这样，当在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码可以将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中，从而将所述当前请求标识作为新的网络请求的引用请求标识。通过上述的方式，基于大数据学习，对大量的网络请求进行分析后，可以逐步完善流程走向表，从而总结出正常的请求流程。另一方面，当需要对接收到的网络请求进 行分析时，可以识别出该网络请求的当前请求标识，并分析出其引用的引用请求标识。然后，可以判断由引用请求标识指向当前请求标识的走向是否存在于学习得到的流程走向表中，进一步地还可以分析该走向对应的时间差是否处于正常的时间差范围内，从而判断该网络请求是否符合正常的业务逻辑。如果不符合，可以返回至所述当前请求标识所处的请求流程中的起点请求标识，从而重新开始业务逻辑的访问过程。由上可见，本申请提供的技术方案，针对不同的业务逻辑进行大数据学习，根据学习结果对日常的业务逻辑进行防护，能有效的防止未知或隐藏的漏洞被攻击者利用。同时，由于是基于大数据学习后再进行防护，故本申请的技术方案可以适应各种各样的业务逻辑场景，能灵活的适应各种业务逻辑需求的变更。另外，还避免了复杂的认证过程，并且可以节省大量的人力和物力，从而能够提高业务逻辑的防护效率。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例中基于大数据的业务逻辑学习方法流程图；
图2是本申请实施例中基于大数据的业务逻辑学习装置的结构示意图；
图3是本申请实施例中基于大数据的业务逻辑防护方法流程图；
图4是本申请实施例中计算机终端的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
实施例一
本申请提供一种基于大数据的业务逻辑学习方法，请参阅图1，所述方法可以包括以下步骤。
S11：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息。
在本实施方式中，所述网络请求可以是包含URL(Uniform Resource Locator，统一资源定位符)的HTTP请求。针对大量的网络请求，可以根据网络请求中携带的参数将网络请求进行归类，将同一类别的网络请求格式化成同一个参数类型的格式化请求，大量的网络请求通过归类从而可以格式化成不同参数类型的格式化请求。例如，网络请求的URL为http://www.xx.com/xx.php？a＝1，http://www.xx.com/xx.php？a＝2，其中该些URL中携带参数a＝1或a＝2可以统一格式化为一个整型的格式化请求http://www.xx.com/xx.php？a＝[d]。请参阅表1，格式化请求可以划分为整型、字符串型、混合型、枚举型以及其它类型。如表1所示，整型的格式化请求的类型可以通过参数a＝[d]来表示；字符串型的格式化请求的类型可以通过参数a＝[s]来表示；混合型的格式化请求的类型可以通过参数a＝[m]来表示；枚举型的格式化请求的类型则可以按照参数的不同逐一列举，例如表1中的a＝add和a＝delete；而其他类型的格式化请求的类型可以通过参数a＝[e]来表示。
表1网络请求的类型与格式化请求的对应关系示意表
Figure PCTCN2018087674-appb-000001
在本实施方式中，针对每个格式化请求，可以分配唯一标识。所述唯一 标识可以按照固定的格式生成，具体地，所述唯一标识可以由a-z以及0-9中任意三位字母/数字构成。例如，在接收到请求方发来的网络请求后，可以对网络请求进行归类，将该网络请求格式化为对应参数类型的格式化请求，然后再给格式化请求分配一个唯一标识，并将分配给所述格式化请求的唯一标识作为所述网络请求的当前请求标识。对于具备相同参数类型的格式化请求，但如果请求路径不同，那么最终分配的唯一标识也是不同的。
在本实施方式中，所述网络请求中包含流程信息，所述流程信息可以表征该网络请求是基于哪个网络请求发出的。例如，当前接收到的网络请求为请求A，而该请求A是在请求B指向的页面中发起的，那么请求A的流程信息则可以表征当前请求A是基于请求B发起的，也可以理解为当前请求A的上一级请求是请求B。因此，所述流程信息中可以包含引用请求标识以及该引用请求标识对应的时间戳，所以从流程信息中可以知道当前接收到的网络请求是基于该引用请求标识对应的网络请求发起的。
S13：从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表。
在本实施方式中，在从所述网络请求中解析得到流程信息之后，则表明该网络请求存在上一级网络请求。这样，可以从所述流程信息中提取引用请求标识，那么便可以得到由该引用请求标识指向当前请求标识的走向。例如，所述引用请求标识为a02，所述当前请求标识为b01，那么此时可以得到a02指向b01的走向。
在本实施方式中，网络请求之间的走向可以记录于流程走向表中。此时，在得到由所述引用请求标识指向所述当前请求标识的走向之后，可以判断在流程走向表中是否存在该走向，并可以根据判断的结果对流程走向表进行更新。具体地，若在所述流程走向表中存在由所述引用请求标识指向所述当前请求标识的走向，则可以将所述走向的流量总数增加1，从而累计该走向的流量 总数。然后，更新走向的时间差。具体地，可以读取所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围，并计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差，并判断计算的所述时间差是否处于流程走向表中记录的时间差范围内，并基于判断结果，对所述时间差范围进行更新。具体地，在对时间差范围进行更新时，可以包括多种情况。若计算的所述时间差小于所述时间差范围的最小值，则可以将所述时间差范围的最小值更改为计算的所述时间差。例如，所述时间差范围为0.2s至1s，而计算得到的时间差为0.1s，此时则可以将时间差范围修改为0.1s至1s。若计算的所述时间差大于所述时间差范围的最大值，将所述时间差范围的最大值更改为计算的所述时间差。例如，所述时间差范围为0.2s至1s，而计算得到的时间差为1.5s，此时则可以将时间差范围修改为0.2s至1.5s。若计算的所述时间差处于所述时间差范围内，则可以保持所述时间差范围不变。
在一个实施方式中，流程走向表中记载的时间差范围可以只是一个固定值，而不是一个时间区间。此时，可以对比计算的所述时间差与所述固定值的大小，若计算的所述时间差小于所述固定值，可以将所述时间差范围修改为最小值为计算的所述时间差并且最大值为所述固定值的区间。例如，所述固定值为0.2s，而计算得到的时间差为0.1s，此时则可以将时间差范围修改为0.1s至0.2s。此外，若计算的所述时间差大于所述固定值，可以将所述时间差范围修改为最小值为所述固定值并且最大值为计算的所述时间差的区间。例如，所述固定值为0.2s，而计算得到的时间差为0.5s，此时则可以将时间差范围修改为0.2s至0.5s。当然，若计算的所述时间差与所述固定值相同，则可以不对时间差范围进行更改。
在一个实施方式中，若在所述流程走向表中不存在由所述引用请求标识指向所述当前请求标识的走向，则可以在所述流程走向表中创建所述走向，并将所述走向的流量总数置为1，以及将接收到所述网络请求的当前时间与所述 流程信息中记载的所述引用请求标识的时间戳之间的时间差记录为所述走向的时间差。后续如果出现相同的走向，则可以对创建的该走向进行更新。
在一个实施方式中，若所述网络请求中不包含流程信息，则表明该网络请求并不是基于其它的网络请求发起的，而是作为网络请求的起点。此时，在响应所述网络请求时，可以针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳。所述跟踪代码的作用在于，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码可以将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。例如，当前接收到的网络请求为请求A，该请求A不包含流程信息，此时，在响应该请求A时，可以针对该请求A下发跟踪代码，该跟踪代码中可以包含请求A的当前请求标识a01(也即请求A对应格式化请求的唯一标识)以及下发跟踪代码的时间戳。那么如果从该请求A指向的页面中发起新的请求B时，跟踪代码则可以将a01作为引用请求标识添加于请求B的流程信息中，同时还可以将下发跟踪代码的时间戳一并添加于请求B的流程信息中，该时间戳可以用于计算当前请求标识与引用请求标识形成的走向对应的时间差。
S15：在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
在本实施方式中，在基于步骤S13中的判断结果对流程走向表进行更新之后，可以在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中可以包含所述当前请求标识以及下发所述跟踪代码的时间戳。与步骤S13中的描述一致，所述跟踪代码的作用在于，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码可以将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。这样，通过下发跟踪代码，从而可以对新的网络请求的流程信息进行更新。
在实际应用中，跟踪代码在添加请求标识和时间戳时，一般存在多种场景。其中一种场景为，在所述网络请求指向的页面加载之前，可以遍历该页面的文档(document)中的指定标签，并在所述指定标签对应的网络请求中添加所述当前请求标识和所述时间戳。所述指定标签例如可以是A标签、form标签以及iframe标签。这些标签均可以引用新的网络请求，因此针对这些标签对应的网络请求，跟踪代码可以添加对应的流程信息。此外，根据所述指定标签对应的网络请求中所携带的参数的情况，可以判断是否需要在所述指定标签对应的网络请求中添加隐藏的输入标签。例如，若指定标签对应的网络请求为POST请求时，可以添加一个隐藏的input标签。
另一种场景为，可以钩挂(hook)用于实现页面跳转和动态发起请求的函数，这些函数例如可以是window.open函数和XMLHTTPRequest函数等，此时，可以在所述用于实现页面跳转和动态发起请求的函数对应的网络请求中添加所述当前请求标识和所述时间戳。
还有一种场景为，可以钩挂(hook)用于实现动态添加页面的函数，所述函数例如可以是appendChild函数和innerHTML函数等，此时，可以在所述用于实现动态添加页面的函数添加指定标签时，在所述指定标签对应的网络请求中添加所述当前请求标识和所述时间戳。该指定标签例如可以是上述的A标签、form标签以及iframe标签。
在一个实施方式中，在对流程走向表中的各条走向进行更新之后，可以根据所述流程走向表中记录的各条走向，统计各个请求标识的出入流量信息。其中，出入流量信息符合指定条件的请求标识可以作为起点请求标识。所述起点请求标识可以作为一个请求流程的起点。具体地，可以将入流量与出流量之间的比值小于或者等于第一阈值，并且入流量与总流量之间的比值小于第二阈值的请求标识作为起点请求标识。所述第一阈值例如可以是1/4，所述第二阈值例如可以是1/6，当然，在实际应用中，所述第一阈值和第二阈值的具体数值可以灵活调整，本申请对此并不做限定。
在本实施方式中，在确定了起点请求标识之后，可以统计所述起点请求标识对应的请求流程。举例来说，a作为一个起点请求标识，有以下走向：
a->b，a->c，a->d，b->c，b->d，c->b，c->d；
那么基于上述的走向，可以统计得到以下请求流程：
a->b->c->b，a->b->c->d，a->b->d，a->c->b->c，a->c->d，a->d。
上述的请求流程中，相邻两个请求标识之间可以具备时间差范围。
这样，基于大数据学习，针对大量的网络请求进行学习之后，可以得到比较完备的流程走向表，从而可以总结得到正常业务逻辑的请求流程。
实施例二
请参阅图2，本申请还提供一种基于大数据的业务逻辑学习装置，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；
从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表；
在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
在本实施方式中，所述存储器可以包括用于存储信息的物理装置，通常是将信息数字化后再以利用电、磁或者光学等方法的媒体加以存储。本实施方式所述的存储器又可以包括：利用电能方式存储信息的装置，如RAM、ROM等；利用磁能方式存储信息的装置，如硬盘、软盘、磁带、磁芯存储器、磁泡 存储器、U盘；利用光学方式存储信息的装置，如CD或DVD。当然，还有其他方式的计算机存储介质，例如量子存储器、石墨烯存储器等等。
在本实施方式中，所述处理器可以按任何适当的方式实现。例如，所述处理器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式等等。
本说明书实施方式提供的基于大数据的业务逻辑学习装置，其实现的具体功能，可以与本说明书中的前述实施方式相对照解释，并能够达到前述实施方式的技术效果，这里便不再赘述。
实施例三
基于大数据学习，在完成业务逻辑学习过程后，本申请还提供一种基于大数据的业务逻辑防护方法，请参阅图3，所述方法包括：
S21：接收请求方发来的网络请求，并识别所述网络请求的当前请求标识。在本实施方式中，在接收到网络请求后，可以对该网络请求的业务逻辑进行判断。具体地，首先可以将该网络请求格式化为对应的参数类型的格式化请求，根据前述实施例一的学习方法可知，每个格式化请求都对应一个唯一标识，然后去学习结果中查询该格式化请求是否存在对应的唯一标识。
需要说明的是，如果无法查找到该网络请求对应的格式化请求的唯一标识，则说明该网络请求在学习过程中没有对应的学习样本，此时，可以记录该网络请求中的URL，并可以累计该URL出现的次数。同时，为了完善请求流程，可以针对该网络请求下发跟踪代码，该跟踪代码中可以包含该网络请求的当前请求标识以及下发跟踪代码的时间戳。
S23：若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标 识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差。
在本实施方式中，在识别出所述当前请求标识之后，可以根据学习阶段确定出的起点请求标识，判断该当前请求标识是否为起点请求标识。请参阅图3，若所述当前请求标识为起点请求标识，则表明该网络请求并非基于其它网络请求发起的，而是一个请求流程的起点，此时，可以在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中可以包含所述当前请求标识以及下发所述跟踪代码的时间戳。这样，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码可以将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中，从而对后续的请求流程进行跟踪。
在本实施方式中，若所述当前请求标识不是起点请求标识，那么说明该网络请求应当是基于其它网络请求发起的，那么该网络请求应当携带流程信息。此时，可以判断该网络请求是否携带流程信息，如果没有携带流程信息，则说明该网络请求与正常的业务逻辑不符，可能是存在问题的网络请求。此时，可以记录发送该网络请求的请求方的标识，并累计所述请求方在指定时限内发送不具备所述流程信息的所述网络请求的次数。如果该请求方在短时间内一直发送不携带流程信息的该网络请求，则说明该请求方是存在问题的请求方，该请求方可能在试图破坏正常的业务逻辑。此时，当累计的次数达到次数阈值时，可以拒绝所述请求方发来的网络请求。在本实施方式中，在累计次数之后，还可以在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中可以包含所述当前请求标识以及下发所述跟踪代码的时间戳，从而对该网络请求进行跟踪。
在本实施方式中，若所述网络请求存在流程信息，可以从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中。若不存在，则说明该走向是错误的走向，不符合正常的业务逻辑。此时，一方面可以在响应所述网络请求时，针 对所述网络请求下发跟踪代码，所述跟踪代码对应的跟踪信息为所述网络请求的流程信息和所述当前请求标识的集合以及下发所述跟踪代码的时间戳，这样可以对该网络请求后续的请求流程进行跟踪。另一方面，还可以直接返回至所述当前请求标识所处的请求流程中的起点请求标识，从而重新开始业务逻辑的访问过程。然后可以在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳，从而继续对重新发起的网络请求继续跟踪。
在本实施方式中，若在学习得到的流程走向表中存在上述的走向，可以进一步判断该走向的时间差是否正确。具体地，可以计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差。
S25：判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
在本实施方式中，在计算得到所述时间差之后，可以将该时间差与流程走向表中记载的时间差范围进行对比。具体地，若计算的所述时间差处于所述时间差范围内，则表明该网络请求是符合正常业务逻辑的，此时可以在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码对应的跟踪信息为所述网络请求的流程信息和所述当前请求标识的集合以及下发所述跟踪代码的时间戳。这样，可以对后续的网络请求进行跟踪，从而进行后续的网络请求的防护过程。然而，若计算的所述时间差不处于所述时间差范围内，则表明当前的网络请求存在问题，此时可以返回至所述当前请求标识所处的请求流程中的起点请求标识，从而重新开始业务逻辑的访问过程。然后，可以在响应所 述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳，从而继续对重新发起的网络请求继续跟踪，并执行相应的防护过程。
需要说明的是，跟踪代码通常只在content-type是text/html以及返回状态码是200的页面下发,在返回状态码为30X的页面中，可以对location地址进行修改并加上流程信息进行跟踪。
实施例四
本申请还提供一种基于大数据的业务逻辑防护装置，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
接收请求方发来的网络请求，并识别所述网络请求的当前请求标识；
若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；
判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
在本实施方式中，所述存储器可以包括用于存储信息的物理装置，通常是将信息数字化后再以利用电、磁或者光学等方法的媒体加以存储。本实施方式所述的存储器又可以包括：利用电能方式存储信息的装置，如RAM、ROM等；利用磁能方式存储信息的装置，如硬盘、软盘、磁带、磁芯存储器、磁泡存储器、U盘；利用光学方式存储信息的装置，如CD或DVD。当然，还有其 他方式的计算机存储介质，例如量子存储器、石墨烯存储器等等。
在本实施方式中，所述处理器可以按任何适当的方式实现。例如，所述处理器可以采取例如微处理器或处理器以及存储可由该(微)处理器执行的计算机可读程序代码(例如软件或固件)的计算机可读介质、逻辑门、开关、专用集成电路(Application Specific Integrated Circuit，ASIC)、可编程逻辑控制器和嵌入微控制器的形式等等。
本说明书实施方式提供的基于大数据的业务逻辑防护装置，其实现的具体功能，可以与本说明书中的前述实施方式相对照解释，并能够达到前述实施方式的技术效果，这里便不再赘述。
请参阅图4，在本申请中，上述实施例中的技术方案可以应用于如图4所示的计算机终端10上。计算机终端10可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)、用于存储数据的存储器104、以及用于通信功能的传输模块106。
本领域普通技术人员可以理解，图4所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，计算机终端10还可包括比图4中所示更多或者更少的组件，或者具有与图4所示不同的配置。
具体地，在本申请中，上述的业务逻辑的学习和防护方法可以作为计算机程序存储于上述的存储器104中，所述存储器104可以与处理器102耦合，那么当处理器102执行所述存储器104中的计算机程序时，便可以实现上述的业务逻辑的学习和防护方法中的各个步骤。
存储器104可用于存储应用软件的软件程序以及模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程 存储器可以通过网络连接至计算机终端10。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106用于经由一个网络接收或者发送数据。上述的网络具体实例可包括计算机终端10的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其用于通过无线方式与互联网进行通讯。
由上可见，本申请提供的技术方案，一方面，基于大数据学习，可以针对大量的网络请求进行业务逻辑的学习过程，从而总结出正常的请求流程。具体地，在接收到网络请求之后，可以识别该网络请求的当前请求标识，并解析该网络请求的流程信息。其中，所述当前请求标识可以唯一地表征该网络请求，所述流程信息中的引用请求标识则可以体现该网络请求的引用页面。这样，可以构成由所述引用请求标识指向所述当前请求标识的走向，并根据本次的走向，对流程走向表进行更新。后续在响应该网络请求时，可以下发跟踪代码，该跟踪代码中可以包含所述当前请求标识以及下发所述跟踪代码的时间戳。这样，当在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码可以将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中，从而将所述当前请求标识作为新的网络请求的引用请求标识。通过上述的方式，对大量的网络请求进行分析后，可以逐步完善流程走向表，从而总结出正常的请求流程。另一方面，当需要对接收到的网络请求进行分析时，可以识别出该网络请求的当前请求标识，并分析出其引用的引用请求标识。然后，可以判断由引用请求标识指向当前请求标识的走向是否存在于学习得到的流程走向表中，进一步地还可以分析该走向对应的时间差是否处于正常的时间差范围内，从而判断该网络请求是否符合正常的业务逻辑。如果不符合，可以返回至所述当前请求标识所处的请求流程中的起点请求标识，从而重新开始业务逻辑 的访问过程。由上可见，本申请提供的技术方案，针对不同的业务逻辑进行大数据学习，根据学习结果对日常的业务逻辑进行防护，能有效的防止未知或隐藏的漏洞被攻击者利用。同时，由于是基于大数据学习后再进行防护，故本申请的技术方案可以适应各种各样的业务逻辑场景，能灵活的适应各种业务逻辑需求的变更。另外，还避免了复杂的认证过程，并且可以节省大量的人力和物力，从而能够提高业务逻辑的防护效率。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件来实现。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行各个实施例或者实施例的某些部分所述的方法。
以上所述仅为本申请的较佳实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (14)

  1. 一种基于大数据的业务逻辑学习方法，其特征在于，所述方法包括：
    接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；
    从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表；
    在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
  2. 根据权利要求1所述的方法，其特征在于，识别所述网络请求的当前请求标识包括：
    将所述网络请求格式化为对应参数类型的格式化请求，为所述格式化请求请求分配唯一标识，并将所述唯一标识作为所述网络请求的当前请求标识。
  3. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    若所述网络请求中不存在流程信息，在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
  4. 根据权利要求1所述的方法，其特征在于，基于判断结果更新所述流 程走向表包括：
    若在所述流程走向表中存在由所述引用请求标识指向所述当前请求标识的走向，将所述走向的流量总数增加1；
    读取所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围，并计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；
    判断计算的所述时间差是否处于所述时间差范围内，并基于判断结果，对所述时间差范围进行更新。
  5. 根据权利要求1所述的方法，其特征在于，基于判断结果更新所述流程走向表包括：
    若在所述流程走向表中不存在由所述引用请求标识指向所述当前请求标识的走向，在所述流程走向表中创建所述走向，并将所述走向的流量总数置为1，以及将接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差记录为所述走向的时间差。
  6. 根据权利要求1所述的方法，其特征在于，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中包括以下至少一种：
    在所述网络请求指向的页面加载之前，遍历文档中的指定标签，并在所述指定标签对应的网络请求中添加所述当前请求标识和所述时间戳；
    或者
    钩挂用于实现页面跳转和动态发起请求的函数，并在所述用于实现页面跳转和动态发起请求的函数对应的网络请求中添加所述当前请求标识和所述时间戳；
    或者
    钩挂用于实现动态添加页面的函数，并在所述用于实现动态添加页面的函数添加指定标签时，在所述指定标签对应的网络请求中添加所述当前请求标识和所述时间戳。
  7. 根据权利要求1所述的方法，其特征在于，在针对所述网络请求下发跟踪代码之后，所述方法还包括：
    根据所述流程走向表中记录的各条走向，统计各个请求标识的出入流量信息，并将出入流量信息符合指定条件的请求标识作为起点请求标识，并统计所述起点请求标识对应的请求流程。
  8. 一种基于大数据的业务逻辑学习装置，其特征在于，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
    接收请求方发来的网络请求，并识别所述网络请求的当前请求标识以及解析所述网络请求的流程信息；
    从所述流程信息中提取引用请求标识，并判断在流程走向表中是否存在由所述引用请求标识指向所述当前请求标识的走向，并基于判断结果更新所述流程走向表；
    在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
  9. 一种基于大数据的业务逻辑防护方法，其特征在于，所述方法包括：
    接收请求方发来的网络请求，并识别所述网络请求的当前请求标识；
    若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；
    判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    若所述当前请求标识为起点请求标识，在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳；其中，若在所述网络请求的基础上再次发起新的网络请求时，所述跟踪代码将所述当前请求标识和所述时间戳添加于所述新的网络请求的流程信息中。
  11. 根据权利要求9所述的方法，其特征在于，若所述网络请求不具备流程信息，所述方法还包括：
    记录所述请求方的标识，并累计所述请求方在指定时限内发送不具备所述流程信息的所述网络请求的次数；其中，当累计的次数达到次数阈值时，拒绝所述请求方发来的网络请求；
    在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码中包含所述当前请求标识以及下发所述跟踪代码的时间戳。
  12. 根据权利要求9所述的方法，其特征在于，若由所述引用请求标识指 向所述当前请求标识的走向不存在于流程走向表中，所述方法还包括：
    在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码对应的跟踪信息为所述网络请求的流程信息和所述当前请求标识的集合以及下发所述跟踪代码的时间戳；
    或者
    返回至所述当前请求标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
  13. 根据权利要求9所述的方法，其特征在于，若计算的所述时间差处于所述时间差范围内，所述方法还包括：
    在响应所述网络请求时，针对所述网络请求下发跟踪代码，所述跟踪代码对应的跟踪信息为所述网络请求的流程信息和所述当前请求标识的集合以及下发所述跟踪代码的时间戳。
  14. 一种基于大数据的业务逻辑防护装置，其特征在于，所述装置包括存储器和处理器，所述存储器中存储有计算机程序，所述计算机程序被所述处理器执行时，实现以下步骤：
    接收请求方发来的网络请求，并识别所述网络请求的当前请求标识；
    若所述当前请求标识不是起点请求标识，从所述网络请求的流程信息中解析出引用请求标识，并判断由所述引用请求标识指向所述当前请求标识的走向是否存在于流程走向表中；若存在，计算接收到所述网络请求的当前时间与所述流程信息中记载的所述引用请求标识的时间戳之间的时间差；
    判断计算的所述时间差是否处于所述流程走向表中记录的所述当前请求标识和所述引用请求标识之间的时间差范围内，若不处于，返回至所述当前请求 标识所处的请求流程中的起点请求标识，并在响应所述起点请求标识对应的网络请求时，针对所述起点请求标识对应的网络请求下发跟踪代码，所述跟踪代码中包含所述起点请求标识以及下发所述跟踪代码的时间戳。
PCT/CN2018/087674 2018-04-26 2018-05-21 基于大数据的业务逻辑学习、防护方法及学习、防护装置 WO2019205202A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18904497.7A EP3585034B1 (en) 2018-04-26 2018-05-21 Big data-based method for learning and protecting service logic and device for learning and protection
EP20214229.5A EP3809675A1 (en) 2018-04-26 2018-05-21 Big-data-based business logic learning method and protection method and apparatuses thereof
US16/544,821 US20200007499A1 (en) 2018-04-26 2019-08-19 Big-data-based business logic learning method and protection method and apparatuses thereof

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810385971.0 2018-04-26
CN201810385971.0A CN108683716B (zh) 2018-04-26 2018-04-26 基于大数据的业务逻辑学习、防护方法及学习、防护装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/544,821 Continuation US20200007499A1 (en) 2018-04-26 2019-08-19 Big-data-based business logic learning method and protection method and apparatuses thereof

Publications (1)

Publication Number Publication Date
WO2019205202A1 true WO2019205202A1 (zh) 2019-10-31

Family

ID=63802444

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/087674 WO2019205202A1 (zh) 2018-04-26 2018-05-21 基于大数据的业务逻辑学习、防护方法及学习、防护装置

Country Status (4)

Country Link
US (1) US20200007499A1 (zh)
EP (2) EP3585034B1 (zh)
CN (1) CN108683716B (zh)
WO (1) WO2019205202A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4315020A1 (en) * 2021-03-30 2024-02-07 Jio Platforms Limited System and method of data ingestion and processing framework

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102722581A (zh) * 2012-06-07 2012-10-10 重庆电力设计院 数据处理的方法、代理装置及系统
US9158828B1 (en) * 2011-12-19 2015-10-13 Emc Corporation Techniques using associated object properties
CN106897810A (zh) * 2015-12-17 2017-06-27 北京奇虎科技有限公司 业务处理方法和系统、工作流引擎和系统、业务系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101019405B (zh) * 2005-01-28 2011-09-28 美国博通公司 用于在通信网络中缓解拒绝服务的方法和系统
CN103412783A (zh) * 2013-08-27 2013-11-27 杭州友声科技有限公司 一种基于业务逻辑层的脚本代码转换成用户流程图的方法
CN107196980B (zh) * 2016-03-14 2020-11-13 创新先进技术有限公司 页面展现流的控制方法、系统及其装置

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9158828B1 (en) * 2011-12-19 2015-10-13 Emc Corporation Techniques using associated object properties
CN102722581A (zh) * 2012-06-07 2012-10-10 重庆电力设计院 数据处理的方法、代理装置及系统
CN106897810A (zh) * 2015-12-17 2017-06-27 北京奇虎科技有限公司 业务处理方法和系统、工作流引擎和系统、业务系统

Also Published As

Publication number Publication date
EP3585034A4 (en) 2020-07-22
EP3585034B1 (en) 2021-04-07
CN108683716A (zh) 2018-10-19
EP3809675A1 (en) 2021-04-21
EP3585034A1 (en) 2019-12-25
US20200007499A1 (en) 2020-01-02
CN108683716B (zh) 2019-12-10

Similar Documents

Publication Publication Date Title
US10560261B1 (en) Systems and techniques for capture of trusted media data
US10560465B2 (en) Real time anomaly detection for data streams
CN111414334A (zh) 基于云技术的文件分片上传方法、装置、设备及存储介质
CN106936791B (zh) 拦截恶意网址访问的方法和装置
CN103607385A (zh) 基于浏览器进行安全检测的方法和装置
CN112769775B (zh) 一种威胁情报关联分析方法、系统、设备及计算机介质
CN112104663B (zh) 一种用于管理登录用户和用户设备的方法与设备
CN111314174A (zh) 基于区块链和sdn边缘计算网络系统的网络拨测方法及装置
CN110096363A (zh) 一种网络事件与进程的关联方法及装置
CN110807050B (zh) 性能分析方法、装置、计算机设备及存储介质
CN108319688A (zh) 一种用于对用户进行阅读提醒的方法与设备
CN111651140A (zh) 基于工作流的服务方法及装置
CN110362993A (zh) 恶意进程识别方法、终端、服务器、系统及存储介质
WO2019205202A1 (zh) 基于大数据的业务逻辑学习、防护方法及学习、防护装置
CN115858320A (zh) 操作日志记录方法、装置、介质及产品
CN107977381B (zh) 数据配置方法、索引管理方法、相关装置以及计算设备
CN114239963A (zh) 有向图循环路径检测方法及装置
CN113839948A (zh) 一种dns隧道流量检测方法、装置、电子设备和存储介质
CN115080504A (zh) 文件管理方法、终端及存储介质
CN114640522B (zh) 防火墙安全策略的处理方法、装置、设备及存储介质
CN111858782A (zh) 基于信息安全的数据库构建方法、装置、介质与设备
CN109743188A (zh) 日志数据处理方法和装置
CN111291127A (zh) 一种数据同步方法、装置、服务器及存储介质
CN113839826B (zh) 一种检测windows终端的方法、装置和计算机可读存储介质
CN111240750A (zh) 一种目标应用程序的唤醒方法及装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018904497

Country of ref document: EP

Effective date: 20190814

NENP Non-entry into the national phase

Ref country code: DE