WO2020248687A1

WO2020248687A1 - Method and apparatus for preventing malicious attack

Info

Publication number: WO2020248687A1
Application number: PCT/CN2020/084321
Authority: WO
Inventors: 郭旭阳
Original assignee: 深圳前海微众银行股份有限公司
Priority date: 2019-06-12
Filing date: 2020-04-10
Publication date: 2020-12-17
Also published as: CN110266676A; CN110266676B

Abstract

A method and apparatus for preventing a malicious attack, wherein same relate to the technical field of fintech, and are used to solve the problem in the prior art of low security caused by a determination rule corresponding to a single prevention strategy. The method comprises: receiving a first request message sent by a user end; when the first request message matches an identification rule in an identification rule set, determining a target prevention strategy from among prevention strategies corresponding to the matched identification rule; and processing the first request message by means of the target prevention strategy, and updating, according to the number of times that the identification rule is historically matched, the prevention strategies corresponding to the identification rule. Since prevention strategies corresponding to an identification rule are not single, and can be updated according to the number of times that same is historically matched, when initiating an attack, it is difficult for a malicious user to bypass the prevention strategies even with multiple attempts, such that the security of a system can be improved.

Description

Method and device for preventing malicious attacks

Cross references to related applications

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office on June 12, 2019, the application number is 201910506914.8, and the application name is "a method and device for preventing malicious attacks", the entire content of which is incorporated herein by reference Applying.

Technical field

The present invention relates to the technical field of financial technology (Fintech), in particular to a method and device for preventing malicious attacks.

Background technique

With the development of computer technology, more and more technologies are applied in the financial field. The traditional financial industry is gradually shifting to Fintech. However, due to the security and real-time requirements of the financial industry, higher technology is also proposed. Requirements. At present, malicious attacks on the financial system are mainly attacked in a point-to-point manner, that is, a predetermined judgment rule and corresponding prevention strategy are set in advance. When the user's behavior data hits the judgment rule, the corresponding prevention strategy is used for processing. However, since the determination rule in this method corresponds to a single prevention strategy, it is easy for malicious users to crack the prevention strategy after multiple attempts, and then bypass the prevention strategy, thereby affecting the security of the system.

Summary of the invention

The present invention provides a method and device for preventing malicious attacks, which are used to solve the current judgment rule corresponding to a single prevention strategy. After a malicious user tries multiple times, it is easy to crack the prevention strategy, thereby bypassing the prevention strategy, thereby affecting the security of the system Sexual issues.

In the first aspect, the present invention provides a method for preventing malicious attacks, including:

Receive the first request message sent by the user terminal, when the first request message matches the recognition rule in the recognition rule set, determine that the first request message is a suspicious message, and select the prevention strategy from the matching recognition rule Determine the target prevention strategy, the prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule; use the target prevention strategy to process the first request message, and send the processing result to the user end.

In a possible implementation manner, the prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule, including: updating the identification rule according to the matching times of the identification rule in the historical time period The current risk value, the risk level of the identification rule is updated according to the updated risk value of the identification rule, and the identification rule correspondence is updated according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy Preventive strategies.

In a possible implementation manner, the identification rule corresponds to a plurality of prevention strategies, and each prevention strategy corresponds to a matching probability, and the matching probability is the probability that the prevention strategy is selected as the target prevention strategy; The description of determining the target prevention strategy from the prevention strategies corresponding to the matching identification rules includes: determining the target prevention strategy from the multiple prevention strategies corresponding to the matching identification rules according to the matching probability.

In a possible implementation manner, the step of using the target prevention strategy to process the first request message and sending the processing result to the client includes: using the target prevention strategy to determine the first request message The response message corresponding to the request message is sent to the user end, so that the user end sends a second request message different from the first request message.

In a possible implementation manner, when the first request message does not match the recognition rule in the recognition rule set, it is further determined that the first request message is normal.

In a possible implementation manner, when the same verification information exists in the request messages corresponding to M users, a new identification rule is generated according to the verification information, and the new identification rule is added to the set of identification rules Wherein, the request messages corresponding to the M users are normal request messages, and M is a preset integer.

In the second aspect, the present invention provides a device for preventing malicious attacks, including:

The receiving module is used to receive the first request message sent by the user terminal;

The identification module is configured to determine that the first request message is a suspicious message when the first request message matches the identification rule in the identification rule set, and determine the target prevention strategy from the prevention strategy corresponding to the matched identification rule, The prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule;

The processing module is configured to use the target prevention strategy to process the first request message and send the processing result to the client.

In a possible implementation manner, the identification module is specifically configured to: update the current risk value of the identification rule according to the matching times of the identification rule in the historical time period, and update the risk value according to the identification rule The risk level of the identification rule is updated, and the prevention strategy corresponding to the identification rule is updated according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy.

In a possible implementation manner, the identification rule corresponds to a plurality of prevention strategies, and each prevention strategy corresponds to a matching probability, and the matching probability is the probability that the prevention strategy is selected as the target prevention strategy; The identification module is specifically used to determine a target prevention strategy from a plurality of prevention strategies corresponding to the matching identification rule according to the matching probability.

In a possible implementation manner, the processing module is specifically configured to: use the target prevention strategy to determine a response message corresponding to the first request message, and send the response message to the user end, so that all The client sends a second request message that is different from the first request message.

In a possible implementation manner, the identification module is further configured to: when the first request message does not match the identification rule in the identification rule set, determine that the first request message is normal.

In a possible implementation, the device further includes an analysis module; the analysis module is specifically configured to: when the same verification information exists in the request messages corresponding to the M users, generate a new identification based on the verification information. Rule, adding the new identification rule to the identification rule set, the request messages corresponding to the M users are normal request messages, and M is a preset integer.

In a third aspect, the present invention provides a computer device including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The processor implements the method for preventing malicious attacks when the program is executed. step.

In a fourth aspect, the present invention provides a computer-readable storage medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device executes the method for preventing malicious attacks. step.

In the present invention, since the prevention strategy corresponding to each identification rule is not single, when the request message matches the identification rule in the identification rule set, the target prevention strategy determined from the prevention strategy corresponding to the identification rule is different; Secondly, the prevention strategy corresponding to the identification rule will be updated according to the historical matching times of the identification rule, so the selected target identification strategy will also change randomly. When a malicious user attacks, it is difficult to bypass the prevention strategy even after multiple attempts. Can improve the security of the system. In addition, when malicious users find that the prevention strategy is random, they may also reduce the number of malicious attempts, which may reduce the network load.

Description of the drawings

In order to more clearly describe the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings needed in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings may be obtained from these drawings without creative labor.

Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the present invention;

2 is a schematic flowchart of a method for preventing malicious attacks according to an embodiment of the present invention;

FIG. 3 is a schematic flowchart of a method for updating a prevention strategy according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of a corresponding relationship between an identification rule and a prevention strategy provided by an embodiment of the present invention;

FIG. 5 is a schematic flowchart of a method for preventing malicious attacks according to an embodiment of the present invention;

FIG. 6 is a schematic structural diagram of a device for preventing malicious attacks according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of a computer device provided by an embodiment of the present invention.

Detailed ways

In order to make the objectives, technical solutions and beneficial effects of the present invention clearer, the following further describes the present invention in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, but not to limit the present invention.

To facilitate understanding, the terms involved in the embodiments of the present invention are explained below.

Conditional probability: refers to the occurrence probability of event A under the condition that another event B has occurred. The conditional probability is expressed as: P(A|B), read as "the probability of A under the condition of B".

Uniform distribution: The random variable X has n different values, and n different values have the same probability.

The method for preventing malicious attacks in the embodiment of the present invention can be applied to the application scenario shown in FIG. 1, and the application scenario includes the client 101 and the application server 102. The user terminal 101 is an electronic device with network communication capabilities, such as a smart phone, a tablet computer, or a portable personal computer. The application server 102 may be a business server of a financial institution such as a bank. The application server 102 stores the identification rule set and the prevention strategy corresponding to each identification rule in the identification rule set. The identification rules in the identification rule set can be set according to the actual business of the financial institution, and each identification rule in the identification rule set corresponds to The prevention strategy is updated based on the historical matching times of the identification rules. The application server 102 receives the request message sent by the client 101, and then compares the request message with the recognition rules in the recognition rule set. When the request message matches one of the recognition rules, it determines the request message as a suspicious message and matches The recognition rule as the target recognition rule. Then, the target prevention strategy is determined from the prevention strategies corresponding to the target recognition rule, the target prevention strategy is used to process the request message, and the processing result is sent to the client 101. When the request message does not match the recognition rules in the recognition rule set, the request message is determined to be a normal message.

Based on the application scenario shown in FIG. 1, the embodiment of the present invention provides a method for preventing malicious attacks, and the process of the method can be executed by a malicious attack preventing device, such as the application server 102 in FIG. 1. As shown in Figure 2, the method includes the following steps:

Step 201: Receive a first request message sent by a user terminal.

Specifically, the first request message may include the personal identity information of the user, the Internet Protocol (IP) address of the user end, the device number, and the number of historical requests, etc.

Exemplarily, after receiving the first request message from the user terminal, the validity of the data in the first request message may be verified first. For example, when the user's first request message is used to log in, and the format of the login password is preset to be a combination of characters and numbers, when the login password in the first request message is all numbers or all characters, it can be directly determined The login password is invalid, so the prompt message can be returned directly to the client. In this way, when the request message is received, the data in the request message is first determined to be valid, and then the subsequent identification steps are performed, so the validity and accuracy of the subsequent request message matching the identification rule can be guaranteed.

Step 202: When the first request message matches the recognition rule in the recognition rule set, determine that the first request message is a suspicious message, and determine the target prevention strategy from the prevention strategy corresponding to the matched recognition rule.

In the embodiment of the present application, the identification rule set may include preset identification rules, and the identification rules in the identification rule set may also be updated according to actual needs. Among them, the identification rule is used to determine whether the user's request message is suspicious. For example, the identification rule can be an incorrect login password, an incorrect verification code, an incorrect registration information, and no login in the past 7 days. When the first request message matches the identification rule, it indicates that the first request message is a suspicious message, that is, the first request message may be sent by a malicious attacker, and there is a certain risk, and further verification is required.

In addition, the identification rule corresponds to one or more prevention strategies. For example, the prevention strategy may be to refuse to log in, re-enter the login password, re-enter the verification code, mobile phone number verification, face verification, etc. The prevention strategy corresponding to the identification rule can be updated according to the number of historical matching of the identification rule. The number of historical matching is the number of matching of the identification rule with the request message in the historical setting period.

In an optional implementation manner, when the first request message does not match the recognition rule in the recognition rule set, it is determined that the first request message is normal.

Step 203: Use the target prevention strategy to process the first request message, and send the processing result to the client.

In an optional implementation manner, the target prevention strategy may be used to determine the response message corresponding to the first request message, and then the response message is sent to the user end, so that the user end can send a second request message that is different from the first request message. Request message.

Exemplarily, the first request message is set as a login request message, the first request message includes the user's account and login password, and a certain identification rule is that the login password is incorrect. In specific implementation, when the user's login password is wrong, it can be determined that the first request message matches the identification rule, and then the target prevention strategy corresponding to the identification rule can be determined. If the target prevention strategy corresponding to the identification rule is: enter a mobile phone number for verification, then according to the target prevention strategy, it can be determined that the response message is: enter a mobile phone number. In this way, the response message can be sent to the user terminal, and after receiving the response message, the user terminal can enter the mobile phone number to log in, instead of entering the login password.

Since the prevention strategy corresponding to each identification rule is not single, when the request message matches the identification rule in the identification rule set, the target prevention strategy determined from the prevention strategy corresponding to the identification rule is also different; secondly, the identification rule The corresponding prevention strategy will be updated according to the historical matching times of the identification rules, so the selected target identification strategy will also change randomly. In this case, when a malicious user attacks, it is difficult to bypass the prevention strategy even after multiple attempts , Which can improve the safety of the system. In addition, when malicious users find that the prevention strategy is random, they may also reduce the number of malicious attempts, which may reduce the network load.

In the above step 202, there are many ways to update the prevention strategy corresponding to the identification rule according to the historical matching times of the identification rule, and the embodiment of the present invention provides a possible implementation manner. As shown in Figure 3, the method includes the following steps:

Step 301: Update the current risk value of the identification rule according to the matching times of the identification rule in the historical time period.

Specifically, the identification rule has an initial risk value, and the initial risk value of the identification rule may be set in advance according to the severity of the identification rule. Correspondingly, the historical time period may be a set time period in the past. By counting the number of times the identification rule is matched with the request message in the past period of time, the number of matching times of the identification rule in the historical time period is obtained.

Exemplarily, count the number of times the identification rule i matches the request message in the past 7 days and the past 30 days, and then use the following formula (1) to determine the risk value after the identification rule i is updated:

Wherein, S _i1 to identify rules i risk value updated, S _i0 for the identification rules i current risk values, m _i7 is the number of times the last 7 days, the identification rules i and the request message matches, m _i30 is identified in the last 30 days The number of times that rule i matches the request message. When the number of recent matches of an identification rule increases, it needs attention. Therefore, the risk value of the identification rule increases. When the number of recent matches of the identification rule decreases, it may be safer and the risk value of the identification rule can be reduced.

Step 302: Update the risk level of the identification rule according to the updated risk value of the identification rule.

Specifically, the identification rules can be divided into different risk levels according to the risk values of the identification rules. For example, the higher the risk value, the higher the risk level. When the risk value is between 90-100 points, the corresponding risk level is level 1, and when the risk value is between 70-90 points, the corresponding risk level is level 2. When the risk value is between 50-70 points, the corresponding risk level is level 3. When the risk value is between 0-50 points, the corresponding risk level is level 4.

When the risk value of the identification rule changes, the risk level of the identification rule will also change accordingly. For example, the risk level before the update of the identification rule is level 1, and if the risk value after the update of the identification rule is 80 points, it can be determined that the risk level after the update of the identification rule is level 2.

Step 303: Update the prevention strategy corresponding to the identification rule according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy.

Specifically, prevention strategies with similar prevention strengths can be combined into one type of prevention strategy, and there may be duplicate prevention strategies between different types of prevention strategies. According to the prevention strength of the prevention strategy, the prevention strategy is divided into different prevention levels. The level correspondence between identification rules and prevention strategies can be one level of identification rule corresponding to one level of prevention strategy, or one level of identification rule corresponding to multiple levels This is not specifically limited in the embodiment of the present invention.

Illustratively, as shown in Figure 4, the set identification rules are classified into identification rule type 1, identification rule type 2, identification rule type three, and identification rule type four according to the risk level from high to low risk level. The prevention strategy is based on the high level of prevention To the low level of prevention, it is divided into prevention strategy one, prevention strategy two, prevention strategy three, and prevention strategy four. Identification rule category one corresponds to prevention strategy category one, identification rule category two corresponds to prevention strategy category one and prevention strategy category two, identification rule category three corresponds to prevention strategy category two and prevention strategy category three, identification rule category four corresponds to prevention strategy category three and Prevention strategy category four. If the target recognition rule currently belongs to the recognition rule category 1, the corresponding prevention strategy is the prevention strategy category 1. After updating the risk level of the target recognition rule, if the target recognition rule belongs to the recognition rule category 2, the corresponding prevention strategies are the prevention strategy category 1 and the prevention strategy category 2. After the target identification rules update the risk level, the prevention strategy corresponding to the identification rule is updated according to the level correspondence between the identification rule and the prevention strategy, so that the prevention strategy corresponding to the identification rule is randomized, so that malicious users can avoid brute force cracking the prevention strategy and improve the system safety.

For ease of description, the following will refer to the recognition rule category 1 as the recognition rule category A, the recognition rule category 2 as the recognition rule category B, the recognition rule category 3 as the recognition rule category C, and the recognition rule category 4 as the recognition rule Class D. Moreover, the prevention strategy category 1 is called the prevention strategy category a, the prevention strategy category 2 is called the prevention strategy category b, the prevention strategy category 3 is called the prevention strategy category c, and the prevention strategy category 4 is called the prevention strategy category d.

Optionally, in the above step 202, when determining the target prevention strategy from the prevention strategies corresponding to the matching identification rules, the target prevention strategy may be determined from the multiple prevention strategies corresponding to the matching identification rules according to the matching probability.

Exemplarily, the identification rule corresponds to a plurality of prevention strategies, each prevention strategy corresponds to a matching probability, and the matching probability is the probability that the prevention strategy is selected as the target prevention strategy. Among them, the matching probability can be set according to the actual situation. For example, based on the embodiment shown in FIG. 4, the set prevention strategy category a includes n prevention strategies, and the prevention strategy category b includes m prevention strategies. For the recognition rule class A, the matching probability of the recognition rule class A and the prevention strategy class a is P(A)=1. Identify the matching probability of each identification rule j in the identification rule class A with each prevention strategy in the prevention strategy class a

That is, when the identification rule is j, the probability that each prevention strategy in the prevention strategy class a is selected as the target strategy is

For identification rule class B, the matching probability of identification rule class B and prevention strategy class a is P(a|B), and the matching probability of identification rule class B and prevention strategy class b is P(b|B), where P( a|B)+P(b|B)=1. Since the recognition rule class B matches the prevention strategy class b more closely, you can set P(b|B) to a larger probability and P(a|B) to a smaller probability, that is, P(b|B)> P(a|B).

For any recognition rule k in the recognition rule class B, the matching probability between the recognition rule k and each prevention strategy in the prevention strategy class a

That is, when the recognition rule is k, the probability that each prevention strategy in the prevention strategy class a is selected as the target strategy is

Identify the matching probability between rule k and each prevention strategy in prevention strategy class b

That is, when the recognition rule is k, the probability that each prevention strategy in the prevention strategy class b is selected as the target strategy is

By setting the matching probability of the prevention strategy, the selected prevention strategy is more matched with the identification rule. Secondly, when one type of identification rule corresponds to one or more types of prevention strategies, it can ensure that users cannot brute force the prevention strategy to a greater extent, thereby improving the security of the system.

In an optional implementation, when the request message is a normal request message, some potential risks still need to be considered. These risks are generally not seen through the request behavior of a single user, and need to integrate the aggregate behavior of multiple users. determination. For example, in an account opening scenario, when the back of an ID card is used by a user, it cannot be determined that the back of the ID card is at risk. When the back of the same ID is used for multiple different user account opening requests and all are judged to be approved, the issuing authority on the back of the ID and the authenticity of the validity period of the ID need to be considered.

To this end, the embodiment of the present invention can also analyze normal request messages. When the same verification information exists in the request messages corresponding to M (M is a preset integer) users, a new recognition rule is generated according to the verification information, and the new recognition rule is added to the recognition rule set. Among them, the request messages corresponding to the M users are normal request messages. Exemplarily, when M users are opening an account, and the back of the ID card in the account opening request message is the same, a new identification rule can be generated: the same back side of the ID card is received again when opening an account. Then add the new recognition rule to the recognition rule set. Further, it is also possible to set a corresponding prevention strategy for the new identification rule. Through the analysis of multiple normal request messages, potential risks are discovered from the aggregate behaviors of multiple users, and new identification rules are generated, and the new identification rules are used to supplement the identification rule set, which can improve the accuracy of preventing malicious attacks. Sex.

In order to better explain the embodiments of the present invention, the method for preventing malicious attacks provided by the embodiments of the present invention will be described below in conjunction with specific implementation scenarios. The method may be executed by a malicious attack preventing device, such as the application server 102 in FIG. 1. As shown in Figure 5, the method includes the following steps:

Step 501: Receive a first request message sent by a user terminal.

Step 502: It is judged whether the first request message matches the identification rule in the identification rule set, if yes, step 503 is executed, otherwise, step 508 is executed.

Step 503: Determine that the first request message is a suspicious message.

Exemplarily, the offline audit module of the device for preventing malicious attacks can count the number of times each identification rule matches the request message, and the statistical result can be used to update the prevention strategy corresponding to the identification rule.

Step 504: Determine a target prevention strategy from the prevention strategies corresponding to the matched identification rules.

In the embodiment of the present application, each identification rule may correspond to multiple prevention strategies, there may be a matching probability between the identification rule and each prevention strategy, and the target prevention strategy is determined from the multiple prevention strategies according to the matching probability. Among them, the multiple prevention strategies corresponding to each identification rule can be updated regularly according to the historical matching times of the identification rule.

Step 505: Determine the response message corresponding to the first request message using the target prevention strategy.

Step 506: Send the response message to the client.

Step 507: Receive a second request message sent by the user terminal.

Wherein, the first request message and the second request message may be different.

Step 508: Determine that the first request message is normal.

Exemplarily, the offline audit module of the device for preventing malicious attacks can analyze normal request messages. When the same verification information exists in the request messages corresponding to multiple users, new identification rules can be generated based on the verification information, and then The new recognition rule is added to the recognition rule set.

In the embodiment of the present application, since the prevention strategy corresponding to each identification rule is not single, when the request message matches the identification rule in the identification rule set, the target prevention strategy determined from the prevention strategy corresponding to the identification rule is different Secondly, the prevention strategy corresponding to the identification rule will be updated according to the historical matching times of the identification rule, so the selected target identification strategy will also change randomly. When a malicious user attacks, it is difficult to bypass the prevention strategy even after multiple attempts , Which can improve the security of the system. In addition, when malicious users find that the prevention strategy is random, they may also reduce the number of malicious attempts, thereby reducing network load.

Based on the same technical concept, an embodiment of the present invention also provides a device for preventing malicious attacks. As shown in FIG. 6, the device 600 includes:

The receiving module 601 is configured to receive the first request message sent by the user terminal;

The identification module 602 is configured to determine that the first request message is a suspicious message when the first request message matches the identification rule in the identification rule set, and determine the target prevention strategy from the prevention strategy corresponding to the matching identification rule , The prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule;

The processing module 603 is configured to use the target prevention strategy to process the first request message and send the processing result to the client.

Optionally, the identification module 602 is specifically configured to:

Update the current risk value of the identification rule according to the matching times of the identification rule in the historical time period;

Update the risk level of the identification rule according to the updated risk value of the identification rule;

Update the prevention strategy corresponding to the identification rule according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy.

Optionally, the identification rule corresponds to a plurality of prevention strategies, and each prevention strategy corresponds to a matching probability, and the matching probability is the probability that the prevention strategy is selected as the target prevention strategy;

The identification module 602 is specifically configured to:

According to the matching probability, the target prevention strategy is determined from the multiple prevention strategies corresponding to the matching identification rules.

Optionally, the processing module 603 is specifically configured to:

The target prevention strategy is used to determine the response message corresponding to the first request message, and the response message is sent to the user end, so that the user end sends a second request message different from the first request message .

Optionally, the identification module 602 is further configured to:

When the first request message does not match the recognition rule in the recognition rule set, it is determined that the first request message is normal.

Optionally, it further includes an analysis module 604;

The analysis module 604 is specifically configured to:

When the same verification information exists in the request messages corresponding to M users, a new identification rule is generated according to the verification information, the request messages corresponding to the M users are normal request messages, and M is a preset integer;

The new recognition rule is added to the recognition rule set.

Based on the same technical concept, an embodiment of the present invention also provides a computer device, as shown in FIG. 7, including at least one processor 701 and a memory 702 connected to the at least one processor. The embodiment of the present invention does not limit the processing. For the specific connection medium between the processor 701 and the memory 702, the connection between the processor 701 and the memory 702 in FIG. 7 is taken as an example. The bus can be divided into address bus, data bus, control bus, etc.

In the embodiment of the present invention, the memory 702 stores instructions that can be executed by at least one processor 701. By executing the instructions stored in the memory 702, the at least one processor 701 can execute the steps included in the aforementioned method for preventing malicious attacks.

Among them, the processor 701 is the control center of the computer equipment, which can use various interfaces and lines to connect various parts of the computer equipment, and prevent maliciousness by running or executing instructions stored in the memory 702 and calling data stored in the memory 702. attack. Optionally, the processor 701 may include one or more processing units, and the processor 701 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, and application programs. The adjustment processor mainly deals with wireless communication. It can be understood that the foregoing modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 may be implemented on the same chip, and in some embodiments, they may also be implemented on separate chips.

The processor 701 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present invention may be directly embodied as being executed and completed by a hardware processor, or executed and completed by a combination of hardware and software modules in the processor.

The memory 702, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. The memory 702 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk , CD, etc. The memory 702 is any other medium that can be used to carry or store desired program codes in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. The memory 702 in the embodiment of the present invention may also be a circuit or any other device capable of realizing a storage function for storing program instructions and/or data.

Based on the same technical concept, the embodiments of the present invention provide a computer-readable storage medium that stores a computer program executable by a computer device. When the program runs on the computer device, the computer device is executed to prevent malicious Steps of the method of attack.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods or computer program products. Therefore, the present invention may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

The present invention is described with reference to flowcharts and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or block in the flowchart and/or block diagram, and the combination of processes and/or blocks in the flowchart and/or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are generated It is a device that realizes the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device. The device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment. The instructions provide steps for implementing functions specified in a flow or multiple flows in the flowchart and/or a block or multiple blocks in the block diagram.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make additional changes and modifications to these embodiments once they learn the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

A method for preventing malicious attacks, characterized in that it includes:

Receiving the first request message sent by the user terminal;

When the first request message matches the recognition rule in the recognition rule set, it is determined that the first request message is a suspicious message, and the target prevention strategy is determined from the prevention strategy corresponding to the matching recognition rule, and the recognition rule corresponds to The prevention strategy is updated according to the historical matching times of the identification rule;

The target prevention strategy is used to process the first request message, and the processing result is sent to the client.
The method according to claim 1, wherein the prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule, comprising:

Update the current risk value of the identification rule according to the matching times of the identification rule in the historical time period;

Update the risk level of the identification rule according to the updated risk value of the identification rule;

Update the prevention strategy corresponding to the identification rule according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy.
The method according to claim 2, wherein the identification rule corresponds to a plurality of prevention strategies, and each prevention strategy corresponds to a matching probability, and the matching probability is the probability that the prevention strategy is selected as the target prevention strategy;

Said determining the target prevention strategy from the prevention strategy corresponding to the matching identification rule includes:

According to the matching probability, the target prevention strategy is determined from the multiple prevention strategies corresponding to the matching identification rules.
The method according to claim 1, wherein said using said target prevention strategy to process said first request message and sending a processing result to said user end comprises:

The target prevention strategy is used to determine the response message corresponding to the first request message, and the response message is sent to the user end, so that the user end sends a second request message different from the first request message .
The method according to any one of claims 1 to 4, further comprising:

When the first request message does not match the recognition rule in the recognition rule set, it is determined that the first request message is normal.
The method of claim 5, further comprising:

When the same verification information exists in the request messages corresponding to M users, a new identification rule is generated according to the verification information, the request messages corresponding to the M users are normal request messages, and M is a preset integer;

The new recognition rule is added to the recognition rule set.
A device for preventing malicious attacks, characterized in that it includes:

The receiving module is used to receive the first request message sent by the user terminal;

The identification module is configured to determine that the first request message is a suspicious message when the first request message matches the identification rule in the identification rule set, and determine the target prevention strategy from the prevention strategy corresponding to the matched identification rule, The prevention strategy corresponding to the identification rule is updated according to the historical matching times of the identification rule;

The processing module is configured to use the target prevention strategy to process the first request message and send the processing result to the client.
The device according to claim 7, wherein the identification module is specifically configured to:

Update the current risk value of the identification rule according to the matching times of the identification rule in the historical time period;

Update the risk level of the identification rule according to the updated risk value of the identification rule;

Update the prevention strategy corresponding to the identification rule according to the updated risk level of the identification rule and the level correspondence between the identification rule and the prevention strategy.
A computer device, comprising a memory, a processor, and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the program when the program is executed by any one of claims 1 to 6 The steps of the method.
A computer-readable storage medium, characterized in that it stores a computer program executable by a computer device, and when the program runs on a computer device, the computer device executes the method described in any one of claims 1 to 6 A step of.