CN115499203A - Security event monitoring method and device, computer equipment and storage medium - Google Patents

Abstract

The present application relates to a security event monitoring method, device, computer equipment and storage medium. The method includes: acquiring a request to be processed; determining data to be scanned based on the request to be processed, the data to be scanned carries a preset identifier; scanning the data to be scanned to determine whether there is a security event. It realizes the scanning of the data before the data is uploaded to the network site, realizes the pre-warning of the uploaded data in the site, and thus comprehensively improves the security of the network site.

Description

Security event monitoring method, device, computer equipment and storage medium

technical field

The present application relates to the technical field of network security, in particular to a security event monitoring method, device, computer equipment and storage medium.

Background technique

With the rapid development of Internet technology, in the current daily life, the government, universities, hospitals and other units have achieved full coverage of the Internet, and they are faced with various types of security incidents such as dark chains, external chains, tampering, and information leakage. Threats have brought great impact on society, politics and economy. Therefore, network security issues have become one of the issues that are highly valued in today's society.

In the existing network security technology, the cloud detection platform can be used to monitor the network site used by the user. After the user uploads the file through the network site, the security of the network site can be monitored in real time by formulating a scanning service program. However, in the above method, there are limitations in scanning content, and it is not possible to scan the entire traffic of the website, but only the traffic in the uploaded file format.

Aiming at the problem of how to comprehensively improve the security of a network site in related technologies, no effective solution has been proposed so far.

Contents of the invention

Based on this, it is necessary to provide a security event monitoring method, device, computer equipment, and storage medium that can comprehensively improve the security of a network site in view of the above technical problems.

In the first aspect, the present application provides a security event monitoring method applied to a website traffic classification management platform, wherein the method includes:

Get pending requests;

determining data to be scanned based on the request to be processed, where the data to be scanned carries a preset identifier;

Scan the data to be scanned to determine whether there is a security event.

In one of the embodiments, the determining the data to be scanned based on the request to be processed, the data to be scanned before carrying the preset identifier includes:

Responding to a user instruction, receiving and storing a preset identifier.

In one of the embodiments, the scanning of the data to be scanned and determining whether there is a security event includes:

Send the data to be scanned to the cloud for scanning, and receive the scanning result returned by the cloud.

In one of the embodiments, after scanning the data to be scanned and determining whether there is a security incident, it further includes:

If there is no security event, the data to be scanned is sent to the target site;

If there is a security event, the data to be scanned is sent to the host computer.

In one of the embodiments, after sending the data to be scanned to the host computer, it also includes:

receiving the data to be scanned returned by the host computer, the data to be scanned does not carry the preset identification;

Send the data to be scanned to the target site.

In one of the embodiments, after determining the data to be scanned based on the pending request, it further includes:

Sending the safety data to the target site, where the safety data does not carry the preset identifier.

In one of the embodiments, after scanning the data to be scanned and determining whether there is a security incident, it further includes:

The scan results are displayed.

In the second aspect, the present application also provides a security event monitoring device, which is applied to a website traffic classification management platform, and the device includes:

An acquisition module, used to acquire pending requests;

A classification module, configured to determine data to be scanned based on the request to be processed, the data to be scanned carries a preset identifier;

The scanning module is configured to scan the data to be scanned to determine whether there is a security incident.

In a third aspect, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

Get pending requests;

determining data to be scanned based on the request to be processed, where the data to be scanned carries a preset identifier;

Scan the data to be scanned to determine whether there is a security event.

In a fourth aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium has a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

Get pending requests;

determining data to be scanned based on the request to be processed, where the data to be scanned carries a preset identifier;

Scan the data to be scanned to determine whether there is a security event.

The above-mentioned security event monitoring method, device, computer equipment, and storage medium use the website traffic classification management platform to obtain pending requests; determine the data to be scanned based on the pending requests, and the data to be scanned carries a preset identifier; The scanning platform corresponding to the proportion of scanned data diversion scans the data to be scanned to determine whether there is a security incident. It realizes the scanning of the data before the data is uploaded to the network site, realizes the pre-warning of the uploaded data in the site, and thus comprehensively improves the security of the network site.

Description of drawings

Fig. 1 is an application environment diagram of a security event monitoring method in an embodiment;

Fig. 2 is a schematic flow diagram of a security event monitoring method in an embodiment;

Fig. 3 is a schematic flow diagram of a security event monitoring method in a preferred embodiment;

FIG. 4 is a schematic flow diagram of a security event monitoring method in another preferred embodiment;

Fig. 5 is a structural block diagram of a safety event monitoring device in an embodiment;

Figure 6 is an internal block diagram of a computer device in one embodiment.

detailed description

In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present application, and are not intended to limit the present application.

In a traditional method for ensuring the security of a network site, the network site is generally connected to a cloud monitoring platform, and all data on the network site are monitored in real time through the cloud monitoring platform. Due to the advantages of no construction cost, operation and maintenance cost, convenient deployment without perception, no need to occupy hardware space, and intelligent protection, the traditional cloud monitoring platform gradually has a tendency to replace hardware scanners or monitoring software. More and more users use business system It is connected to the cloud monitoring platform and used in conjunction with cloud WAF. However, due to the traditional working principle of "only monitoring existing page security events", the cloud cannot perform comprehensive pre-event monitoring and early warning, and cannot eliminate potential security events in advance to reduce unnecessary security events. Necessary negative effects can only be collected by crawling pages and event analysis after the site content and files are uploaded to the Internet. This monitoring and alarming method is affected by technical issues such as crawler design and site level directory depth. It is impossible to monitor and warn the site in all directions. Sometimes the pages cannot be monitored and bad content is not cleaned up in time, which leads to the identification of serious negative impacts and reduces the user experience.

Therefore, industry users urgently need a platform that is simple to use and can provide early warning of security incidents to reduce the incidence of security incidents.

The security event monitoring method provided in the embodiment of the present application may be applied to the application environment shown in FIG. 1 . Wherein, the terminal 102 communicates with the server 104 through the network. The data storage system can store data that needs to be processed by the server 104 . The data storage system can be integrated on the server 104, or placed on the cloud or other network servers. Specifically, the request to be processed can be obtained through the terminal 102, and the request to be processed can be sent to the server 104; then the server 104 performs preliminary processing on the request to be processed, and determines the data to be scanned from the request to be processed, and the data to be scanned It carries a preset identifier; finally, the server 104 scans the data to be scanned to determine whether there is a security event. When the scanning determines that there is no security event, the data to be scanned may be stored in the data storage system. Further, the corresponding preset identifier may also be stored in the data storage system, so that the server 104 can perform preliminary processing on the request to be processed. It should be noted that the above-mentioned terminal 102 can be, but not limited to, various personal computers, notebook computers, smart phones, tablet computers, Internet of Things devices and portable wearable devices. Portable wearable devices can be smart watches, smart bracelets, headsets, etc. wearing equipment etc. The server 104 can be implemented by an independent server or a server cluster composed of multiple servers.

A security event monitoring method is provided in this embodiment, and Fig. 2 is a flow chart of the security event monitoring method in this embodiment, as shown in Fig. 2, the process includes the following steps:

Step S201, obtaining pending requests;

In this embodiment, it is mainly applied to the website traffic classification management platform, and the security events of the website are monitored by performing classification management on the data uploaded by users in advance. Specifically, the website traffic classification management platform is a platform for intercepting data uploaded by websites. When users upload data to the website, the data is intercepted, and then the intercepted data is analyzed and processed to confirm the processing methods of different types of data.

Wherein, the request to be processed is a request uploaded by a user through a website, which may be a web page in a browser, a dedicated business service system or software program, etc., for example, a campus forum, an institution's official website, an online community, etc. A pending request can be a file uploaded by a user, text in a comment, a shared web link, etc.

Step S202, determining data to be scanned based on the request to be processed, the data to be scanned carries a preset identifier;

Wherein, the preset identifier is a traffic identifier preset by the site administrator through the host computer, and is used to distinguish data that needs to be scanned and data that does not need to be scanned. In this embodiment, the preset identifier may be specified information (Uniform Resource Locator, URL for short) determined based on a Uniform Resource Locator system. In Internet protocols such as HTTP or FTP, a URL is identified as identification information that can identify a specific computer, directory, or file location. Operations such as uploading files and posting comments on the user's network site are all operations performed under the specified URL. Further, the website traffic classification management platform can determine the type of the pending request and the corresponding forwarding destination according to whether the pending request contains a preset identifier. Pending requests with preset identifiers can be regarded as data that may pose a security risk, and the data to be scanned needs to be extracted and forwarded to the corresponding scanning platform.

Step S203, scanning the data to be scanned to determine whether there is a security event.

Wherein, a security event may be expressed as sensitive content or a malicious connection in the data to be scanned, which will bring negative effects to the network site. Exemplarily, the security event may be that the file to be scanned contains content links that violate social morality or laws and regulations, user identity feature information, sensitive political content, game links, or malicious virus links.

Specifically, when scanning, the event scanning engine of the scanning platform can be called to perform content identification on the data to be scanned, and field matching can be performed according to the custom word library and threat link library. If some of the content matches the custom word library or threat link library, it means that there is a security incident, and an alarm message needs to be generated and fed back to the host computer.

Exemplarily, when the network site is a campus service site, the hyperlink engine can be customized to identify irrelevant game links hidden in text, and identify sensitive information such as user ID numbers. And generate corresponding alarm information.

Through the above steps S201 to S203, after the pending request is obtained, the pending request can be distributed according to the customized preset identifier in the website traffic classification management platform, and the data packet corresponding to the pending request containing the preset identifier can be confirmed Scan the data to be scanned and scan it before uploading it to the target site to identify whether there are security incidents in the data to be scanned, and then realize the pre-warning of the data before it is uploaded to the target site, eliminating its potential security in advance risks, and comprehensively improve the security of network sites.

It should be noted that the website in the embodiment of the present application belongs to a SaaS (Software as a Service) website. Through the SaaS provider, we can build all the network infrastructure, software and hardware operation platforms required for informatization for enterprises, and are responsible for a series of services such as all early implementation and later maintenance. Enterprises do not need to purchase software and hardware, build computer rooms, and recruit IT. Personnel can use the information system through the Internet. The Web site, also known as the World Wide Web, or the Web system, is based on the Hypertext Markup Language HTML (Hyper Text Markup Language) and the Hypertext Transfer Protocol HTTP (HyperText Transfer Protocol), which can provide a consistent user interface for Internet services. information browsing system.

In one of the real-time examples, the specific process of determining the data to be scanned includes:

Step 1: Drain the obtained pending requests through the Domain Name System (DNS for short), and divert the pending requests to the website traffic classification management platform;

Step 2: Determine whether there is a preset identifier in the pending request in the website traffic classification management platform, and if there is a preset identifier, obtain the data to be scanned in the pending request, and forward the data to be scanned to the pre-scan early warning platform; If there is no preset identification, the data to be scanned is directly uploaded to the network site.

Exemplarily, if the operation request for uploading a file is recorded as a URL identifier, when the request to be processed is obtained as a user uploading a file request, the corresponding uploaded file can be forwarded to the pre-scan early warning platform for scanning processing.

In the above steps, through the website traffic classification management platform, the requests to be processed are classified and processed, and only the requests containing the preset identifiers are diverted to the pre-scan and early warning platform, which avoids repeated changes to DNS resolution and improves the processing of pending requests efficiency.

In some of the embodiments, the determining the data to be scanned based on the request to be processed, before the data to be scanned carries a preset identifier, includes: receiving and storing the preset identifier in response to a user instruction.

Wherein, the preset identifier may be based on actual use scenarios or actual needs of users, and at least one URL identifier may be added by the site administrator through customization of the host computer. The above optional URL identifiers are not fixed, and URL identifiers can be added or deleted according to different usage scenarios or other factors. Optionally, the above URL identifier can limit the file upload path, and scan the data uploaded through the specified path. For example, for a campus network site, all data uploaded by the user needs to be scanned. If the user’s pending request is a search request Or view requests without scanning.

In this embodiment, the preset identifier is set according to the actual application scenario and user needs, which is beneficial to distinguish the request corresponding to the uploaded file from other user requests in the future, avoiding scanning all request data, and improving scanning efficiency .

In some of the embodiments, the scanning the data to be scanned to determine whether there is a security event includes: sending the data to be scanned to a cloud for scanning, and receiving a scanning result returned by the cloud.

Optionally, the pre-scan early warning platform on the cloud can scan the data to be scanned to detect whether the data to be scanned contains sensitive information or threat links. Specifically, according to actual usage scenarios or user wishes, you can first define, select and identify sensitive information, and generate a custom thesaurus. Exemplarily, the custom-defined vocabulary can include ID number-related content, junk advertisement text, and vocabulary related to illegal content. For threat links, a threat link library can be generated based on existing known network virus links. Further, game promotion links can also be added to the threat link library, sensitive links can be screened through sensitive word identification, and the above sensitive links can be updated to threat links. link library.

Optionally, after scanning through the pre-scan early warning platform, feedback can be given according to the scanning results.

In this embodiment, pre-scanning data to be scanned is pre-scanned by the pre-scan early warning platform, and the possibility of security incidents reaching the network site is ruled out in advance. The advance warning of security incidents is realized, thereby further improving the security of the network site.

In some of these embodiments, after scanning the data to be scanned and determining whether there is a security event, it further includes: if there is no security event, sending the data to be scanned to the target site; if there is a security event , then send the data to be scanned to the host computer.

If there is a security incident, alarm information can be generated according to the scanning results, and returned to the host computer for pre-preparation, and then the site administrator will process the alarm information received by the host computer.

If there is no security event, it means that there are no threat links and sensitive information in the data to be scanned, and the information can be directly forwarded to the target site. Optionally, the target site may be a target network site, or a platform for monitoring missed scans. The target site is the final storage location of the data, and the monitoring and scanning platform refers to the traditional platform that provides customers with real-time post-event security incident warnings and vulnerability warnings, manually reviews the site risk information collected after the event, and issues alarm notifications . It can monitor all the data in the network site in real time after the file is uploaded to the network site, avoiding missing scans during pre-scanning, and can also perform traceability inspection when security incidents are detected after the event.

In this embodiment, by classifying and processing situations in which security incidents exist and situations in which security incidents do not exist, it is beneficial to improve data processing efficiency, and at the same time, an alarm can be issued in time when a security incident is detected.

In some of the embodiments, after sending the data to be scanned to the host computer, it further includes: receiving the data to be scanned returned by the host computer, the data to be scanned does not carry the preset identification; The data to be scanned is sent to the target site.

It can be understood that when pre-alarming security events, since the preset logo is determined manually, according to the change of the application scenario, the preset logo in different scenarios is not the same, so there may be logo setting errors. Therefore, after the upper computer receives the alarm information, the site administrator can check the corresponding data to be scanned and the scanning results in the upper computer. The platform returns the data to be scanned.

Optionally, the URL identifier corresponding to the current data to be scanned may also be determined, and the URL identifier is deleted from the preset identifier library in the website traffic classification management.

In this embodiment, the security event is checked again through the host computer to eliminate the situation of wrong identification, avoid the occurrence of false detection, and improve the success rate of security event monitoring.

In some of the embodiments, after determining the data to be scanned based on the request to be processed, the method further includes: sending safety data to a target site, where the safety data does not carry the preset identifier.

Specifically, when draining pending requests, if the pending request does not contain a preset identifier, the pending request can be considered as safe data, and the pending request can be directly drained to target site.

In this embodiment, the data packets without the preset identifier are directly sent to the target site instead of being scanned on the scanning platform, which is beneficial to improve the efficiency of data transmission.

In some of the embodiments, after scanning the data to be scanned and determining whether there is a security incident, the scanning further includes: displaying the scanning result.

Specifically, the scan result may include a set of sensitive words in the data packet and a set of threat links. After the scan result is obtained, it can be displayed on the upper computer, so as to reconfirm whether the security event exists in the upper computer.

In this embodiment, the display of the scanning result is beneficial to intuitively understand the content of the security event in the host computer, so as to facilitate reconfirmation in the host computer, and is beneficial to improve the processing efficiency of the host computer.

Fig. 3 is a schematic flow chart of the security event monitoring method of this preferred embodiment, as shown in Fig. 3, the security event monitoring method includes the following steps:

Step S301, adding the domain name of the main site that needs to be monitored and warned to the website traffic classification management platform through the host computer, and custom-adding URL information of the file upload path in the website traffic classification management platform to determine the URL identification.

In step S302, the acquired request to be processed is transmitted to the website traffic classification management platform, and DNS analysis is performed on the website traffic classification management platform to determine whether the request to be processed contains a URL identifier.

Optionally, the above DNS resolution method can be CNAME diversion, which is a technical way to divert traffic to a designated domain name and then forward the traffic to a designated site.

Step S303, if there is a URL identifier, then determine the corresponding data to be scanned, and forward the data to be scanned to the pre-scan early warning platform for data scanning; if there is no URL identifier, then use the pre-scan early warning platform to include The data is synchronized to the monitoring missing scan platform.

Step S304, the pre-scan early warning platform scans the data to be scanned to determine whether there is a security event in the data to be scanned.

In step S305, if there is no security event, the data to be scanned is directly forwarded to the target site, and the data is saved at the same time.

Step S306, if there is a security incident, feed back the scanning result to the host computer.

Step S307, after the upper computer receives the scanning result, customize whether to continue to upload the data to be scanned, if continue to upload, delete the corresponding URL identifier in the website traffic classification management platform, and continue to forward the data to be scanned through the website traffic classification management platform to the target site; if not uploaded, the corresponding data packet will be discarded.

Step S308, after the data packet is sent to the target site, real-time monitoring is performed on all data of the target site.

In this embodiment, after the request to be processed is obtained, the request to be processed can be divided according to the customized preset identifier in the website traffic classification management platform, and the data packet corresponding to the pending request containing the preset identifier is confirmed to be scanned It scans the data before it is uploaded to the target site to identify whether there are security incidents in the data to be scanned, and then realizes the pre-warning of the data before it is uploaded to the target site, and eliminates its potential security risks in advance. At the same time, the traditional monitoring and missing detection platform is added to monitor all the data in the network site in real time, and its safety can be ensured after the data is uploaded. It cooperates with the pre-scan early warning platform to realize the monitoring of the network site before and after receiving the data. Monitor and protect the whole process, and then comprehensively improve the security of the network site.

Optionally, in another embodiment of the present application, product linkage can also be realized, that is, two or more products are used at the same time. After simple adjustments and settings, new functions appear or the original single product makes the function more convenient. ,Complete. Exemplarily, the website traffic classification management platform can be linked with the cloud WAF platform. Through the cloud WAF, the website traffic classification management platform can classify and divert traffic received from pending requests. When the network site is connected to the cloud WAF, it will perform security detection, protection and interception on the access requests initiated to the target site, and normal requests will be lead back to the target site. In the cloud WAF product, the site security protection can be cleaned by changing the DNS resolution mode to cname to clean the site layer 7 traffic.

Fig. 4 is the flowchart of the security event monitoring method of another preferred embodiment of the present application, as shown in Fig. 4, this security event monitoring method comprises the following steps:

Step S401, add the domain name of the main site that needs monitoring and warning to the cloud WAF website traffic classification management platform through the host computer, and add file upload path URL information in the cloud WAF website traffic classification management platform to determine the URL identification.

In step S402, the obtained request to be processed is transmitted to the cloud WAF website traffic classification management platform, and the DNS analysis is performed on the cloud WAF website traffic classification management platform to determine whether the pending request contains a URL identifier.

Step S403, if there is a URL identifier, determine the corresponding data to be scanned, and forward the data to be scanned to the pre-scan early warning platform for data scanning; if there is no URL identifier, directly send the data packet to the target site.

Step S404, the pre-scan early warning platform scans the data to be scanned to determine whether there is a security event in the data to be scanned.

Step S405, if there is no security event, directly forward the data to be scanned to the target site, and at the same time transfer the data.

Step S406, if there is a security incident, feed back the scanning result to the host computer.

Step S407, after the upper computer receives the scanning result, customize whether to continue to upload the data to be scanned, if continue uploading, delete the corresponding URL identifier in the cloud WAF website traffic classification management platform, and continue to pass the website traffic classification management platform to upload the data to be scanned. The scanned data is forwarded to the target site; if not uploaded, the corresponding data packet is discarded.

Step S408, after the data packets are sent to the target site, all data of the target site are monitored in real time.

In this embodiment, by pre-setting the URL identifier in the cloud WAF, after intercepting the pending request for accessing the target site, the pending request is divided, and it is confirmed that the data packet corresponding to the pending request containing the URL identifier is to be scanned It scans the data before it is uploaded to the target site to identify whether there are security incidents in the data to be scanned, and then realizes the pre-warning of the data before it is uploaded to the target site, and eliminates its potential security risks in advance. At the same time, the traditional monitoring and missing detection platform is added to monitor all the data in the network site in real time, and its security can also be ensured after the data is uploaded. Cooperating with the cloud WAF to realize the whole process monitoring of the network site before and after receiving the data Protection, and thus comprehensively improve the security of the network site. Furthermore, it can be used in conjunction with traditional cloud protection products and traditional cloud monitoring products to bring customers a better experience.

It should be understood that although the steps in the flow charts involved in the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed sequentially in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least some of the steps in the flow charts involved in the above-mentioned embodiments may include multiple steps or stages, and these steps or stages are not necessarily executed at the same time, but may be performed at different times For execution, the execution order of these steps or stages is not necessarily performed sequentially, but may be executed in turn or alternately with other steps or at least a part of steps or stages in other steps.

Based on the same inventive concept, an embodiment of the present application further provides a security event monitoring device for implementing the above mentioned security event monitoring method. The solution to the problem provided by the device is similar to the implementation described in the above method, so the specific limitations in one or more embodiments of the security event monitoring device provided below can be referred to above for the security event monitoring method limited and will not be repeated here.

In one embodiment, as shown in FIG. 5 , a security event monitoring device is provided, which is applied to a website traffic classification management platform, including: an acquisition module 51, a classification module 52 and a scanning module 53, wherein:

An acquisition module 51, configured to acquire pending requests;

A classification module 52, configured to determine data to be scanned based on the request to be processed, the data to be scanned carries a preset identifier;

The scanning module 53 is configured to scan the data to be scanned to determine whether there is a security incident.

Through the device of the embodiment of the present application, after obtaining the pending request, the pending request can be distributed according to the customized preset identifier in the website traffic classification management platform, and it is confirmed that the data packet corresponding to the pending request containing the preset identifier is Scan the data to be scanned and scan it before it is uploaded to the target site to identify whether there are security incidents in the data to be scanned, and then realize the pre-warning of the data before it is uploaded to the target site, and eliminate its potential security risks in advance , Comprehensively improve the security of the website.

Further, the acquisition module 51 is also configured to receive and store a preset identifier in response to a user instruction.

Further, the scanning module 53 is also configured to send the data to be scanned to the cloud for scanning, and receive the scanning result returned by the cloud.

Further, the scanning module 53 is also configured to send the data to be scanned to the host computer if there is a security event.

Further, the scanning module 53 is also used to receive the data to be scanned returned by the host computer, the data to be scanned does not carry the preset identification; and send the data to be scanned to the target site.

Further, the classification module 52 is further configured to send the safety data to the target site, and the safety data does not carry the preset identifier.

Further, the device further includes a display module for displaying the scanning results.

Each module in the above-mentioned safety event monitoring device can be fully or partially realized by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.

In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure may be as shown in FIG. 6 . The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, mobile cellular network, NFC (Near Field Communication) or other technologies. When the computer program is executed by the processor, a security event monitoring method is implemented. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or a button, a trackball or a touch pad provided on the casing of the computer device , and can also be an external keyboard, touchpad, or mouse.

Those skilled in the art can understand that the structure shown in FIG. 6 is only a block diagram of a part of the structure related to the solution of this application, and does not constitute a limitation on the computer equipment to which the solution of this application is applied. The specific computer equipment can be More or fewer components than shown in the figures may be included, or some components may be combined, or have a different arrangement of components.

In one embodiment, a computer device is provided, including a memory and a processor, a computer program is stored in the memory, and the processor implements the following steps when executing the computer program:

Get pending requests;

determining data to be scanned based on the request to be processed, where the data to be scanned carries a preset identifier;

Scan the data to be scanned to determine whether there is a security event.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

Get pending requests;

determining data to be scanned based on the request to be processed, where the data to be scanned carries a preset identifier;

Scan the data to be scanned to determine whether there is a security event.

It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all Information and data authorized by the user or fully authorized by all parties.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be implemented through computer programs to instruct related hardware, and the computer programs can be stored in a non-volatile computer-readable memory In the medium, when the computer program is executed, it may include the processes of the embodiments of the above-mentioned methods. Wherein, any reference to storage, database or other media used in the various embodiments provided in the present application may include at least one of non-volatile and volatile storage. Non-volatile memory can include read-only memory (Read-Only Memory, ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive variable memory (ReRAM), magnetic variable memory (Magnetoresistive Random Access Memory, MRAM), Ferroelectric Random Access Memory (FRAM), Phase Change Memory (Phase Change Memory, PCM), graphene memory, etc. The volatile memory may include random access memory (Random Access Memory, RAM) or external cache memory. As an illustration and not a limitation, the RAM can be in various forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM). The databases involved in the various embodiments provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a blockchain-based distributed database, etc., but is not limited thereto. The processors involved in the various embodiments provided by this application can be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, data processing logic devices based on quantum computing, etc., and are not limited to this.

The technical features of the above embodiments can be combined arbitrarily. To make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be It is considered to be within the range described in this specification.

The above-mentioned embodiments only express several implementation modes of the present application, and the description thereof is relatively specific and detailed, but should not be construed as limiting the patent scope of the present application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be determined by the appended claims.

Claims (10)

1. A security event monitoring method is applied to a website traffic classification management platform and is characterized by comprising the following steps:

acquiring a request to be processed;

determining data to be scanned based on the request to be processed, wherein the data to be scanned carries a preset identifier;

and scanning the data to be scanned to determine whether a security event exists.

2. The method according to claim 1, wherein the determining data to be scanned based on the request to be processed, before the data to be scanned carries a preset identifier, comprises:

and responding to a user instruction, receiving a preset identification and storing.

3. The method of claim 1, wherein scanning the data to be scanned to determine whether a security event exists comprises:

and sending the data to be scanned to a cloud end for scanning, and receiving a scanning result returned by the cloud end.

4. The method of claim 1 or 3, wherein the scanning the data to be scanned to determine whether the security event exists further comprises:

if the security event does not exist, sending the data to be scanned to a target site;

and if the security event exists, sending the data to be scanned to an upper computer.

5. The method according to claim 4, wherein after sending the data to be scanned to an upper computer, the method further comprises:

receiving the data to be scanned returned by the upper computer, wherein the data to be scanned does not carry the preset identification;

and sending the data to be scanned to a target site.

6. The method of claim 1, wherein determining data to be scanned based on the pending request further comprises:

and sending the safety data to a target site, wherein the safety data does not carry the preset identification.

7. The method of claim 3, wherein the scanning the data to be scanned to determine whether the security event exists further comprises:

and displaying the scanning result.

8. A security incident monitoring device is applied to a website traffic classification management platform, and comprises:

the acquisition module is used for acquiring the request to be processed;

the classification module is used for determining data to be scanned based on the request to be processed, and the data to be scanned carries a preset identifier;

and the scanning module is used for scanning the data to be scanned and determining whether a security event exists.

9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 7.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.

Images