CN112073427B - System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) - Google Patents
System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) Download PDFInfo
- Publication number
- CN112073427B CN112073427B CN202010979046.8A CN202010979046A CN112073427B CN 112073427 B CN112073427 B CN 112073427B CN 202010979046 A CN202010979046 A CN 202010979046A CN 112073427 B CN112073427 B CN 112073427B
- Authority
- CN
- China
- Prior art keywords
- url
- interface
- keyword
- downlink data
- module
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D30/00—Reducing energy consumption in communication networks
- Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Information Transfer Between Computers (AREA)
- Computer And Data Communications (AREA)
Abstract
An HTTP (hyper text transport protocol) protocol-based uplink and downlink traffic data interface identification system comprises a URL suffix judgment module for judging whether a detected URL is an interface according to a suffix of the detected URL, an HTML (hypertext markup language) webpage judgment module for judging whether the detected URL is not the interface according to webpage key characters through downlink data of the detected URL, a URL keyword matching module for performing URL keyword matching on the detected URL, and an interface possibility calculation module for giving interface possibility according to the result of the URL keyword matching module and judging whether the detected URL is the interface according to the interface possibility. A method for identifying an uplink and downlink flow data interface based on an HTTP protocol comprises the steps of judging a URL suffix, judging an HTML webpage, matching URL keywords and calculating interface possibility by a URL suffix judging module, an HTML webpage judging module, a URL keyword matching module and an interface possibility calculating module in sequence. The invention can reduce the manual workload, enlarge the recognizable interface types and is not limited by a crawler-resisting mechanism.
Description
Technical Field
The invention relates to the technical field of interface identification, in particular to an HTTP (hyper text transport protocol) protocol-based uplink and downlink traffic data interface identification system and method.
Background
Currently, the website access modes on the internet can be divided into two types, namely webpage (including picture) access and interface call. In both ways, there will be a significant difference in monitoring strategy. For example, if the same IP accesses more than 10 web pages within 1 minute, it is abnormal, and if the same IP calls 20 times the interface within 1 minute, it is abnormal. In appearance, both the webpage access and the interface call access to one URL, and cannot be directly distinguished. Therefore, a method is needed to identify whether a URL is a generic web page or an interface available for invocation, so that the subsequent judgment program can make different judgment strategies according to whether the URL is an interface or not.
The current solutions for interface identification are roughly as follows:
1. and (5) manually analyzing.
And screening out access URLs within a certain range (which are smaller than a certain byte and are not analyzed) and do not contain html codes according to the size of downlink data of the access website, manually analyzing access results, and judging whether each URL is an interface or not.
2. And crawling the website to find out the WebService owned by the website.
An organization is looked up according to the WSDL specification instance. Listing all WebService under the website. The following is a piece of code implementing this method.
The code below demonstrates finding an organization according to the WSDL specification instance used by a given registry.
String schemeName＝"uddi-org:types"；
ClassificationScheme uddiOrgTypes＝bqm.findClassificationSchemeByName(null,schemeName)；
Classification wsdlSpecClassification＝blcm.createClassification(uddiOrgTypes,"wsdlSpec","wsdlSpec")；
ArrayList classifications＝new ArrayList()；classifications.add(wsdlSpecClassification)；
//Find concepts
BulkResponse br＝bqm.findConcepts(null,null,classifications,null,null)；
Then you must go through concept, find their corresponding WSDL files, and show the mechanism to use each file:
Collection specConcepts＝br.getCollection()；
Iterator iter＝specConcepts.iterator()；
if(！iter.hasNext()){
System.out.println("No WSDL specification concepts found")；
}else{
while(iter.hasNext()){
try{
Concept concept＝(Concept)iter.next()；
String name＝getName(concept)；
Collection links＝concept.getExternalLinks()；
System.out.println("\nSpecification Concept:\n Name:"+name+"\n Key:"+concept.getKey().getId()+"\n Description:"+getDescription(concept))；
if(links.size()>0){
ExternalLink link＝
(ExternalLink)links.iterator().next()；
System.out.println("URL of WSDL document:'"link.getExternalURI()+"'")；
}
ArrayList specConcepts1＝new ArrayList()；
specConcepts1.add(concept)；
br＝bqm.findOrganizations(null,null,null,specConcepts1,null,null)；
Collection orgs＝br.getCollection()；
}
// lookup service and service binding
The following code demonstrates the use of the getService () and getServiceBindings () methods:
Iterator orgIter＝orgs.iterator()；
while(orgIter.hasNext()){
Organization org＝(Organization)orgIter.next()；
Collection services＝org.getServices()；
Iterator svcIter＝services.iterator()；
while(svcIter.hasNext()){
Service svc＝(Service)svcIter.next()；
Collection serviceBindings＝svc.getServiceBindings()；
Iterator sbIter＝serviceBindings.iterator()；
while(sbIter.hasNext()){
ServiceBinding sb＝
(ServiceBinding)sbIter.next()；
}
}
in the manual analysis mode, the manual workload is too large. And many originally owned interfaces can be missed only by flow and html features, so that the recognition efficiency is greatly reduced.
The mode of crawling the website is only directed to the WebService based on the Soap. If the website has a reverse crawling strategy, the method cannot be used. In addition, most of the current interfaces are changed into a Restful API mode, and the interfaces of the Restful API are not feasible by the crawling method.
Disclosure of Invention
The invention aims to overcome the defects of the prior art and provide a system and a method for identifying an uplink and downlink flow data interface based on an HTTP (hyper text transport protocol), which reduce the manual workload, enlarge the identifiable interface type and are not limited by a crawler-resistant mechanism.
The purpose of the invention is realized by the following technical scheme:
an interface identification system for uplink and downlink flow data based on an HTTP (hyper text transport protocol), which comprises a URL suffix judgment module, an HTML webpage judgment module, a URL keyword matching module and an interface possibility calculation module;
the URL suffix judging module judges whether the URL to be tested is an interface according to the suffix of the URL to be tested;
the HTML webpage judging module judges whether the URL to be detected is not an interface or not through downlink data of the URL to be detected according to the webpage key characters;
the URL keyword matching module is used for matching the URL keywords of the tested URL;
the interface possibility calculation module gives the interface possibility according to the result of the URL keyword matching module and judges whether the detected URL is an interface or not according to the interface possibility.
Further, the interface identification system also comprises a downlink data keyword matching module, wherein the downlink data keyword matching module performs downlink data keyword matching on downlink data of the detected URL; the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
Further, the interface identification system further comprises a calculation adjustment module, the URL suffix judgment module judges the detected URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively perform URL keyword matching and downlink data keyword matching on the detected URL and the downlink data of the detected URL to obtain a matching result for adjustment, and the calculation adjustment module adjusts the interface possibility calculation module according to the matching result for adjustment.
Furthermore, the interface identification system also comprises a manual analysis judgment module and a manual analysis interface; the manual analysis and judgment module judges the tested URL with the possibility of the interface meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
the calculation adjusting module is further used for adjusting the interface possibility calculating module according to an analysis result of the manual analysis end, a matching result of the URL needing manual analysis by the URL keyword matching module and a matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
Further, the URL suffix judging module comprises a URL suffix blacklist keyword library and a URL suffix white list keyword library; the URL suffix blacklist keyword library contains suffix keywords of a webpage URL, and the URL suffix white list keyword library contains suffix keywords of an interface URL;
the URL suffix judging module identifies whether the detected URL hits a URL suffix blacklist keyword library or a URL suffix white list keyword library, if the detected URL hits the URL suffix white list keyword library, the detected URL is an interface, and if the detected URL hits the URL suffix blacklist keyword library, the detected URL is not the interface;
the HTML webpage judging module identifies whether the downstream data of the URL to be detected has webpage key characters, and if the webpage key characters exist and are in a few lines before the text of the downstream data of the URL to be detected, the URL to be detected is not an interface;
the URL keyword matching module comprises a URL keyword library, the URL keyword library contains URL keywords of interface URLs, and the URL keyword matching module identifies whether the tested URL hits the URL keyword library and the hit URL keywords;
the downlink data keyword matching module comprises a downlink data keyword library, the downlink data keyword library contains downlink data keywords of the interface URL and an application range, and the downlink data keyword matching module identifies whether the downlink data of the detected URL hits the downlink data keyword library and the hit downlink data keywords of the interface URL in the application range;
the interface possibility calculation module comprises a weight library, wherein the weight library comprises the weight of each keyword in a URL keyword library and the weight of each keyword in a downlink data keyword library in a corresponding application range; and the interface possibility calculating module is used for calculating the interface possibility by combining with the weight value in the weight library.
An identification method for uplink and downlink flow data interfaces based on an HTTP protocol comprises the following steps:
s1: the URL suffix judging module judges whether the URL to be detected is an interface according to the suffix of the URL to be detected, and if the URL suffix judging module can judge, the judgment is finished;
s2, accurately acquiring downlink data of the URL to be detected according to the URL to be detected, and skipping the step S3 if the downlink data cannot be acquired or errors are acquired;
s3: the HTML webpage judging module judges whether the detected URL is not an interface or not through the downlink data of the detected URL according to the webpage key characters, and if the HTML webpage judging module can make judgment, the judgment is finished;
s4: the URL keyword matching module is used for matching the URL keyword of the tested URL;
s5: the interface possibility calculation module gives the interface possibility according to the result of the URL keyword matching module, and judges whether the detected URL is an interface or not according to the interface possibility.
Further, if the step S2 succeeds in acquiring the downlink data of the detected URL and the step S5 cannot make a determination, the following steps are performed:
s6: the downlink data keyword matching module performs downlink data keyword matching on the downlink data of the URL to be tested;
s7: the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
Further, the interface identification method further comprises the following steps:
s8: and for the URL suffix judging module to judge the detected URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively perform URL keyword matching and downlink data keyword matching on the detected URL and the downlink data of the detected URL to obtain a matching result for adjustment, and then the calculation and adjustment module adjusts the interface possibility calculation module according to the matching result for adjustment.
Further, the interface identification method further comprises the following steps:
s9: the manual analysis and judgment module judges the tested URL with the possibility of the interface meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
s10: and the calculation adjusting module adjusts the interface possibility calculating module according to the analysis result of the manual analysis end, the matching result of the URL needing manual analysis by the URL keyword matching module and the matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
Further, the step S1 includes the following substeps:
s101: taking out the part without variable parameters from the URL to be tested, matching with the white list keyword library of URL suffix and the black list keyword library of URL suffix,
s102: if the suffix key of the interface URL in the URL suffix white list key library is hit, the tested URL is the interface,
s103: if the suffix key of the webpage URL in the URL suffix blacklist key library is hit, the tested URL is not an interface,
s104: if the URL suffix white list keyword library and the URL suffix blacklist keyword library are not hit, the URL suffix judging module cannot make judgment and the step S2 is carried out;
the step S3 includes the following substeps:
s301: the HTML web page judging module identifies whether the web page key character exists in the downstream data of the URL to be detected, if the web page key character does not exist, the HTML web page judging module can not make a judgment, the step S4 is entered,
s302: if the key characters of the webpage are in the first few lines of the text of the downlink data of the URL to be detected, the URL to be detected is not an interface, otherwise, the HTML webpage judgment module cannot make a judgment, and the step S4 is entered;
the step S4 includes the following substeps:
s401: the part of parameter values which are removed from the tested URL and only the parameter names are reserved is taken out and matched with the URL keyword library,
s402: if the URL keyword library is hit, a hit message and the hit URL keyword are returned,
s403: if the URL keyword library is not hit, returning a miss message;
the step S5 includes the following substeps:
s501: if step S4 returns a miss message, the interface probability obtained by the URL keyword matching module is 0,
if step S4 returns a hit message, the interface probability obtained from the URL keyword matching module is calculated according to the following formula,
ρ 1 ＝(∑φ i )/(∑φ m )
in the formula, ρ 1 Indicating the interface possibilities, phi, obtained from the URL keyword matching module i Weight value, phi, of the URL keyword hit in step S4 m A weight value representing the total URL keyword,
s502: if the interface possibility obtained according to the URL keyword matching module is greater than the interface identification threshold, judging that the tested URL is an interface;
the step S6 includes the following substeps:
s601: aiming at each keyword and the application range in the downlink data keyword library, the downlink data of the URL to be tested is matched,
s602: if the corresponding downstream data key is not hit within the applicable range of each key, a miss message is returned,
s603: if the corresponding keywords are hit in the application range, returning the hit message, the hit downlink data keywords and the corresponding application range;
the step S7 includes the following substeps:
s701: the interface probability obtained in conjunction with the downlink data keyword matching module is calculated according to the following formula,
ρ＝ρ 1 +(∑ω j )/(∑ω n )
where ρ represents the interface probability, ω, obtained by combining the downlink data keyword matching module n Representing the weight values of all the downlink data keywords in the corresponding application ranges, and if step S5 returns a miss message, then Σ ω j 0, if step S5 returns a hit message, ω is j Indicating the weight value of the downlink data keyword hit in step S6 under the corresponding applicable range,
s702: if the interface possibility obtained by combining the downlink data keyword matching module is greater than the interface identification threshold, judging that the URL to be tested is an interface;
the step S8 includes the following substeps:
s801: for the URL suffix judging module to judge the tested URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively carry out URL keyword matching and downlink data keyword matching on the tested URL and the downlink data of the tested URL to obtain a matching result for adjustment, the matching result for adjustment comprises a hit URL keyword, a hit downlink data keyword and a corresponding application range,
s802: adjusting the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range, if the weight value is positive, increasing the adjustment value of the weight value, and if the weight value is negative, subtracting the adjustment value;
the step S10 includes the following sub-steps:
s1001: the URL keyword matching module performs URL keyword matching on URLs needing manual analysis, the downlink data keyword matching module performs downlink data keyword matching on downlink data of the URLs needing manual analysis to obtain hit URL keywords, the hit downlink data keywords and corresponding application ranges,
s1002: the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range are adjusted,
when the analysis result of the manual analysis end is the interface, if the weight value is positive, the weight value is added with the adjustment value, if the weight value is negative, the adjustment value is subtracted,
and when the analysis result of the manual analysis end is a non-interface, if the weight value is positive, subtracting the adjustment value from the weight value, and if the weight value is negative, increasing the adjustment value.
The invention has the beneficial effects that:
(1) The manual workload is effectively reduced in a machine identification mode;
(2) Not only can the Soap type interface be identified, but also the Restful type interface can be identified, and the identifiable interface types are enlarged;
(3) The website is crawled without using a crawler scheme, so the method is not limited by an anti-crawler mechanism.
Drawings
FIG. 1 is a schematic view of the structure of the present invention;
FIG. 2 is a flow chart of the present invention.
Detailed Description
The following embodiments of the present invention are provided by way of specific examples, and other advantages and effects of the present invention will be readily apparent to those skilled in the art from the disclosure herein. The invention is capable of other and different embodiments and of being practiced or of being carried out in various ways, and its several details are capable of modification in various respects, all without departing from the spirit and scope of the present invention. It should be noted that the features in the following embodiments and examples may be combined with each other without conflict.
It should be noted that the drawings provided in the following embodiments are only for illustrating the basic idea of the present invention, and the components related to the present invention are only shown in the drawings rather than drawn according to the number, shape and size of the components in actual implementation, and the type, quantity and proportion of the components in actual implementation may be changed freely, and the layout of the components may be more complicated.
The first embodiment is as follows:
as shown in fig. 1 to fig. 2, an interface identification system for uplink and downlink traffic data based on HTTP protocol includes a URL suffix determination module, an HTML web page determination module, a URL keyword matching module, and an interface possibility calculation module;
the URL suffix judging module judges whether the URL to be tested is an interface according to the suffix of the URL to be tested;
the HTML webpage judging module judges whether the URL to be detected is not an interface or not through the downlink data of the URL to be detected according to the webpage key characters;
the URL keyword matching module is used for matching the URL keywords of the tested URL;
the interface possibility calculation module gives the interface possibility according to the result of the URL keyword matching module and judges whether the detected URL is an interface or not according to the interface possibility.
The interface identification method adopted by the interface identification system comprises the following steps:
s1: the URL suffix judging module judges whether the URL to be detected is an interface according to the suffix of the URL to be detected, and if the URL suffix judging module can judge, the judgment is finished;
s2, accurately acquiring downlink data of the URL to be detected according to the URL to be detected, and skipping the step S3 if the downlink data cannot be acquired or errors are acquired;
s3: the HTML webpage judging module judges whether the detected URL is not an interface or not through downlink data of the detected URL according to the webpage key characters, and if the HTML webpage judging module can make judgment, the judgment is finished;
s4: the URL keyword matching module is used for matching the URL keywords of the tested URL;
s5: the interface possibility calculation module gives the interface possibility according to the result of the URL keyword matching module, and judges whether the detected URL is an interface or not according to the interface possibility.
The working principle is as follows:
the more common interfaces now fall into two categories, restful and Soap. REST refers to a set of architectural constraints and principles. The application or design that satisfies these constraints and principles is Restful. The Web Service Description Language (WSDL) in the Web service of the SOAP scheme and the Simple Object Access Protocol (SOAP) together constitute a structural unit of the Web service in the SOAP scheme. The system can judge the two interfaces indiscriminately.
For the soap style interface, the url typically ends in wsdl (Web services description language). Even if not ending with wsdl, add one after url? (or &) wsdl, which would normally display the interface definition, would be presented in an xml. Such as:
<wsdl:types>
<s:schema elementFormDefault＝"qualified"targetNamespace＝"http://tempuri.org/">
<s:element name＝"HelloWorld">
<s:complexType/>
</s:element>
<s:element name＝"HelloWorldResponse">
<s:complexType>
<s:sequence>
<s:element minOccurs＝"0"maxOccurs＝"1"name＝"HelloWorldResult"type＝"s:string"/>
</s:sequence>
</s:complexType>
</s:element>
certain URL suffixes (e.g., html,. Xml,. Jpg, etc. static files) are certainly not interfaces. Certain URL suffixes (e.g.,. Asmx,. Jws, etc., or ending in wsdl) must be interfaces. Therefore, the judgment is carried out according to the URL suffix, and the judgment result can be directly given without manual audit.
Therefore, the URL suffix judging module judges whether the URL to be tested is an interface according to the suffix of the URL to be tested;
in addition, if the body of the downstream data of the URL has a webpage keyword (i.e., < html) and is in front, the URL must be a webpage, not an interface. The data is downloaded from the URL:
<！DOCTYPE html>
<html lang＝"zh-CN">
<head>
<meta charset＝"GB2312">
<meta http-equiv＝"X-UA-Compatible"content＝"IE＝Edge"/>
</head>
<！DOCTYPE html>
<html>
<head>
<meta http-equiv＝"Content-type"content＝"text/html；charset＝utf-8"/>
<meta http-equiv＝"X-UA-Compatible"content＝"IE＝edge"/>
therefore, whether the tested URL is not an interface is judged through the HTML webpage judging module according to the webpage key characters through the downlink data of the tested URL.
Thirdly, after analyzing the characteristics of a certain amount of interface URLs (the number is not less than 100), the following can be found: the interface URL contains some characters which are likely to occur, such as api, v1, v2, v3 and the like.
Such as the following 5 interface URLs:
https://api.***bce.com/rest/2.0/ocr/v1/general_basicaccess_token＝xxxxxxx
http://www.api51.cn/api/CaptchaApi/getres
https://ocr.tencentcloudapi.com/？Action＝BizLicenseOCR
http://dongwu.market.alicloudapi.com/do
https://api.jisuapi.com/invoicerecognition/recognize
therefore, the URL keyword matching module is used for carrying out URL keyword matching on the tested URL and calculating and judging through the interface possibility calculating module.
Example two:
as shown in fig. 1 to 2, the second embodiment has all the features of the first embodiment, except that:
the interface identification system also comprises a downlink data keyword matching module, and the downlink data keyword matching module performs downlink data keyword matching on downlink data of the URL to be detected; the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
The interface identification method further comprises the following steps:
if the downlink data of the tested URL is successfully acquired in the step S2 and the step S5 cannot make a judgment, the following steps are carried out:
s6: the downlink data keyword matching module performs downlink data keyword matching on the downlink data of the URL to be tested;
s7: the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
The working principle is as follows:
when the downlink data is json and xml, the URL is likely to be an interface.
Downlink data example:
example three:
as shown in fig. 1 to 2, the third embodiment has all the features of the second embodiment, and the differences are as follows:
the interface identification system also comprises a calculation adjusting module, the URL suffix judging module judges the URL to be detected of the interface, the URL keyword matching module and the downlink data keyword matching module respectively carry out URL keyword matching and downlink data keyword matching on the URL to be detected and the downlink data of the URL to be detected to obtain a matching result for adjustment, and the calculation adjusting module adjusts the interface possibility calculating module according to the matching result for adjustment.
The interface identification method further comprises the following steps:
s8: and for the URL suffix judging module to judge the detected URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively perform URL keyword matching and downlink data keyword matching on the detected URL and the downlink data of the detected URL to obtain a matching result for adjustment, and then the calculation and adjustment module adjusts the interface possibility calculation module according to the matching result for adjustment.
Through the adjustment of the calculation adjustment module, the calculation accuracy can be improved.
Example four:
as shown in fig. 1 to 2, the fourth embodiment has all the features of the third embodiment, except that:
the interface identification system also comprises a manual analysis judgment module and a manual analysis interface; the manual analysis judging module judges the detected URL with the interface possibility meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
the calculation adjusting module is further used for adjusting the interface possibility calculating module according to an analysis result of the manual analysis end, a matching result of the URL needing manual analysis by the URL keyword matching module and a matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
The interface identification method further comprises the following steps:
s9: the manual analysis and judgment module judges the tested URL with the possibility of the interface meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
s10: and the calculation adjusting module adjusts the interface possibility calculating module according to the analysis result of the manual analysis end, the matching result of the URL needing manual analysis by the URL keyword matching module and the matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
And the URL needing to be manually analyzed is adjusted by the interface possibility calculation module according to the manual analysis result, so that the recognition rate can be improved.
Example five:
as shown in fig. 1 to 2, the fifth embodiment has all the features of the fourth embodiment, except that:
the URL suffix judging module comprises a URL suffix blacklist keyword library and a URL suffix white list keyword library; the URL suffix blacklist keyword library contains suffix keywords of webpage URLs, and the URL suffix white list keyword library contains suffix keywords of interface URLs;
the URL suffix judging module identifies whether the tested URL hits a URL suffix blacklist keyword library or a URL suffix white list keyword library, if the URL suffix white list keyword library is hit, the tested URL is an interface, and if the URL suffix blacklist keyword library is hit, the tested URL is not the interface;
the HTML webpage judging module identifies whether the downstream data of the URL to be detected has webpage key characters, and if the webpage key characters exist and are in a few lines before the text of the downstream data of the URL to be detected, the URL to be detected is not an interface;
the URL keyword matching module comprises a URL keyword library, the URL keyword library contains URL keywords of interface URLs, the URL keyword matching module identifies whether the tested URL hits the URL keyword library and the hit URL keywords, and the URL keywords can be regular expressions;
the downlink data keyword matching module comprises a downlink data keyword library, the downlink data keyword library contains downlink data keywords of the interface URL and an application range, the downlink data keyword matching module identifies whether downlink data of the detected URL hits the downlink data keyword library and the hit downlink data keywords of the interface URL in the application range, the downlink data keywords can be regular expressions, the application range comprises a head and a body, and some keywords appear in the head and the body, so that downlink data keyword matching is performed according to the application range, and the same keywords in different application ranges have different weights;
the interface possibility calculation module comprises a weight library, wherein the weight library comprises the weight of each keyword in a URL keyword library and the weight of each keyword in a downlink data keyword library in a corresponding application range; and the interface possibility calculating module is used for calculating the interface possibility by combining with the weight value in the weight library.
In the interface identification method, the step S1 includes the following substeps:
s101: a part without variable parameters is taken from the tested URL, for example, api.test.com/v1/ta =12&b =34 will propose api.test.com/v1/t and match with the URL suffix white list keyword library and the URL suffix black list keyword library,
s102: if the suffix key words of the interface URL in the URL suffix white list key word library are hit, the tested URL is the interface,
s103: if the suffix key of the webpage URL in the URL suffix blacklist key library is hit, the tested URL is not an interface,
s104: if the URL suffix white list keyword library and the URL suffix blacklist keyword library are not hit, the URL suffix judging module cannot make judgment and the step S2 is carried out;
the step S3 includes the following substeps:
s301: the HTML web page judging module identifies whether the web page key character exists in the downstream data of the URL to be detected, if the web page key character does not exist, the HTML web page judging module can not make a judgment, the step S4 is entered,
s302: if the key characters of the webpage are in the first few lines of the text of the downlink data of the URL to be detected, the URL to be detected is not an interface, otherwise, the HTML webpage judgment module cannot make a judgment, and the step S4 is entered;
the step S4 includes the following substeps:
s401: remove the part of parameter value from the URL to be measured and only keep the parameter name, such as api. Test. Com/v1/t? a =12&b =34will propose api.test.com/v1/ta = & b =, and match with the URL keyword library,
s402: if the URL keyword library is hit, a hit message and the hit URL keyword are returned,
s403: if the URL keyword library is not hit, returning a miss message;
the step S5 includes the following substeps:
s501: if step S4 returns a miss message, the interface probability obtained by the URL keyword matching module is 0,
if step S4 returns a hit message, the interface probability obtained from the URL keyword matching module is calculated according to the following formula,
ρ1＝(∑φi)/(∑φm)
where ρ 1 represents the interface possibility obtained by the URL keyword matching module, Φ i represents the weight value of the URL keyword hit in step S4, Φ m represents the weight values of all URL keywords,
s502: if the interface possibility obtained according to the URL keyword matching module is greater than the interface identification threshold, judging that the detected URL is an interface;
the step S6 includes the following substeps:
s601: aiming at each keyword and the application range in the downlink data keyword library, the downlink data of the URL to be tested is matched,
s602: if the corresponding downstream data key is not hit within the applicable range of each key, a miss message is returned,
s603: if the corresponding keywords are hit in the application range, returning hit messages, the hit downlink data keywords and the corresponding application range;
the step S7 includes the following substeps:
s701: the interface probability obtained in conjunction with the downlink data keyword matching module is calculated according to the following formula,
ρ＝ρ1+(∑ωj)/(∑ωn)
wherein ρ represents the interface possibility obtained by combining the downlink data keyword matching module, ω n represents the weight value of all downlink data keywords in the corresponding application range, Σ ω j is 0 if a miss message is returned in step S5, ω j represents the weight value of the downlink data keyword hit in step S6 in the corresponding application range if a hit message is returned in step S5,
because the applicable scope of some keywords not only has the head but also has the text, different weight values are set for the same keyword with different applicable scopes,
s702: if the interface possibility obtained by combining the downlink data keyword matching module is greater than the interface identification threshold, judging that the URL to be tested is an interface;
the step S8 includes the following substeps:
s801: for the URL suffix judging module to judge the tested URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively carry out URL keyword matching and downlink data keyword matching on the tested URL and the downlink data of the tested URL to obtain a matching result for adjustment, the matching result for adjustment comprises a hit URL keyword, a hit downlink data keyword and a corresponding application range,
s802: adjusting the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range, if the weight value is positive, increasing the adjustment value by the weight value, and if the weight value is negative, subtracting the adjustment value;
the step S10 includes the following sub-steps:
s1001: the URL keyword matching module performs URL keyword matching on URLs needing manual analysis, the downlink data keyword matching module performs downlink data keyword matching on downlink data of the URLs needing manual analysis to obtain hit URL keywords, the hit downlink data keywords and corresponding application ranges,
s1002: the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range are adjusted,
when the analysis result of the manual analysis end is the interface, if the weight value is positive, the weight value is added with the adjustment value, if the weight value is negative, the adjustment value is subtracted,
and when the analysis result of the manual analysis end is a non-interface, if the weight value is positive, subtracting the adjustment value from the weight value, and if the weight value is negative, increasing the adjustment value.
The calculation adjusting module adjusts the weight value in a mode of increasing/decreasing the weight value, and the URL suffix judging module can dynamically adjust the weight value after judging that the interface and the manual analysis are carried out each time, so that the identification accuracy is continuously improved. The above-mentioned embodiments only express the specific embodiments of the present invention, and the description thereof is more specific and detailed, but not construed as limiting the scope of the present invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the inventive concept, which falls within the scope of the present invention.
Claims (10)
1. An identification system for uplink and downlink flow data interfaces based on an HTTP (hyper text transport protocol), which is characterized in that: the interface identification system comprises a URL suffix judgment module, an HTML webpage judgment module, a URL keyword matching module and an interface possibility calculation module;
the URL suffix judging module judges whether the URL to be tested is an interface according to the suffix of the URL to be tested;
the URL suffix judging module comprises a URL suffix blacklist keyword library and a URL suffix white list keyword library; the URL suffix blacklist keyword library contains suffix keywords of webpage URLs, and the URL suffix white list keyword library contains suffix keywords of interface URLs;
the URL suffix judging module identifies whether the detected URL hits a URL suffix blacklist keyword library or a URL suffix white list keyword library, if the detected URL hits the URL suffix white list keyword library, the detected URL is an interface, and if the detected URL hits the URL suffix blacklist keyword library, the detected URL is not the interface;
the HTML webpage judging module judges whether the URL to be detected is not an interface or not through the downlink data of the URL to be detected according to the webpage key characters;
the HTML webpage judging module identifies whether the downstream data of the URL to be detected has webpage key characters, and if the webpage key characters exist and are in a few lines before the text of the downstream data of the URL to be detected, the URL to be detected is not an interface;
the URL keyword matching module is used for carrying out URL keyword matching on the tested URL;
the URL keyword matching module comprises a URL keyword library, the URL keyword library contains URL keywords of the interface URL, and the URL keyword matching module identifies whether the tested URL hits the URL keyword library and the hit URL keywords;
the interface possibility calculation module gives interface possibility according to the result of the URL keyword matching module and judges whether the detected URL is an interface or not according to the interface possibility;
the interface possibility calculation module comprises a weight library, wherein the weight library comprises the weight of each keyword in a URL keyword library and the weight of each keyword in a downlink data keyword library in a corresponding application range; and the interface possibility calculating module is used for calculating the interface possibility by combining with the weight value in the weight library.
2. The system according to claim 1, wherein said system comprises: the interface identification system also comprises a downlink data keyword matching module, and the downlink data keyword matching module is used for performing downlink data keyword matching on the downlink data of the URL to be detected; the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
3. The system according to claim 2, wherein the system comprises: the interface identification system further comprises a calculation adjusting module, the URL suffix judging module judges the detected URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively perform URL keyword matching and downlink data keyword matching on the detected URL and downlink data of the detected URL to obtain a matching result for adjustment, and the calculation adjusting module adjusts the interface possibility calculating module according to the matching result for adjustment.
4. The system according to claim 3, wherein said system comprises:
the interface recognition system also comprises a manual analysis judgment module and a manual analysis interface; the manual analysis and judgment module judges the tested URL with the possibility of the interface meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
the calculation adjusting module is further used for adjusting the interface possibility calculating module according to an analysis result of the manual analysis end, a matching result of the URL needing manual analysis by the URL keyword matching module and a matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
5. The system according to claim 2, wherein the system comprises:
the downlink data keyword matching module comprises a downlink data keyword library, the downlink data keyword library contains downlink data keywords of the interface URL and an application range, and the downlink data keyword matching module identifies whether the downlink data of the detected URL hits the downlink data keyword library and the hit downlink data keywords of the interface URL in the application range.
6. An identification method for uplink and downlink flow data interfaces based on an HTTP protocol comprises the following steps:
s1: the URL suffix judging module judges whether the URL to be detected is an interface according to the suffix of the URL to be detected, and if the URL suffix judging module can judge, the judgment is finished;
the step S1 includes the following substeps:
s101: taking out the part without variable parameter from the URL to be measured, matching with the URL suffix white list keyword library and the URL suffix black list keyword library,
s102: if the suffix key of the interface URL in the URL suffix white list key library is hit, the tested URL is the interface,
s103: if the suffix key of the webpage URL in the URL suffix blacklist key library is hit, the tested URL is not an interface,
s104: if the URL suffix white list keyword library and the URL suffix blacklist keyword library are not hit, the URL suffix judging module cannot make judgment and the step S2 is carried out;
s2, accurately acquiring downlink data of the URL to be detected according to the URL to be detected, and skipping the step S3 if the downlink data cannot be acquired or errors are acquired;
s3: the HTML webpage judging module judges whether the detected URL is not an interface or not through downlink data of the detected URL according to the webpage key characters, and if the HTML webpage judging module can make judgment, the judgment is finished;
the step S3 includes the following substeps:
s301: the HTML web page judging module identifies whether the web page key character exists in the downstream data of the URL to be detected, if the web page key character does not exist, the HTML web page judging module can not make a judgment, the step S4 is entered,
s302: if the key characters of the webpage are in the first few lines of the text of the downlink data of the URL to be detected, the URL to be detected is not an interface, otherwise, the HTML webpage judgment module cannot make a judgment, and the step S4 is entered;
s4: the URL keyword matching module is used for matching the URL keywords of the tested URL;
the step S4 includes the following substeps:
s401: the part of parameter values which are removed from the tested URL and only the parameter names are reserved is taken out and matched with the URL keyword library,
s402: if the URL keyword library is hit, a hit message and the hit URL keyword are returned,
s403: if the URL keyword library is not hit, returning a miss message;
s5: the interface possibility calculation module gives interface possibility according to the result of the URL keyword matching module and judges whether the detected URL is an interface or not according to the interface possibility;
the step S5 includes the following substeps:
s501: if step S4 returns a miss message, the interface probability obtained by the URL keyword matching module is 0,
if step S4 returns a hit message, the interface probability obtained from the URL keyword matching module is calculated according to the following formula,
ρ 1 ＝(∑φ i )/(∑φ m )
in the formula, ρ 1 Indicating the interface possibilities, phi, obtained from the URL keyword matching module i Weight value, phi, of the URL keyword hit in step S4 m A weight value representing the total URL keyword,
s502: and if the interface possibility obtained according to the URL keyword matching module is greater than the interface identification threshold, judging that the detected URL is the interface.
7. The method for identifying the uplink and downlink traffic data interfaces based on the HTTP protocol according to claim 6, wherein: if the downlink data of the tested URL is successfully acquired in the step S2 and the step S5 cannot make a judgment, the following steps are carried out:
s6: the downlink data keyword matching module performs downlink data keyword matching on the downlink data of the URL to be tested;
s7: the interface possibility calculation module also gives the interface possibility by combining the result of the downlink data keyword matching module.
8. The method for identifying the uplink and downlink traffic data interfaces based on the HTTP protocol according to claim 7, wherein: the interface identification method further comprises the following steps:
s8: and for the URL suffix judging module to judge the detected URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively perform URL keyword matching and downlink data keyword matching on the detected URL and the downlink data of the detected URL to obtain a matching result for adjustment, and then the calculation and adjustment module adjusts the interface possibility calculation module according to the matching result for adjustment.
9. The method for identifying the uplink and downlink traffic data interfaces based on the HTTP protocol according to claim 8, wherein: the interface identification method further comprises the following steps:
s9: the manual analysis and judgment module judges the tested URL with the possibility of the interface meeting the manual analysis condition as the URL needing manual analysis; the manual analysis interface sends the URL to be manually analyzed to a manual analysis end and receives an analysis result of the manual analysis end;
s10: and the calculation adjusting module adjusts the interface possibility calculating module according to the analysis result of the manual analysis end, the matching result of the URL needing manual analysis by the URL keyword matching module and the matching result of the downlink data of the URL needing manual analysis by the downlink data keyword matching module.
10. The method for identifying the uplink and downlink traffic data interfaces based on the HTTP protocol according to claim 9, wherein: the step S6 includes the following substeps:
s601: aiming at each keyword and the application range in the downlink data keyword library, the downlink data of the URL to be tested is matched,
s602: if the corresponding downstream data key is not hit within the applicable range of each key, a miss message is returned,
s603: if the corresponding keywords are hit in the application range, returning the hit message, the hit downlink data keywords and the corresponding application range;
the step S7 includes the following substeps:
s701: the interface probability obtained in conjunction with the downlink data keyword matching module is calculated according to the following formula,
ρ＝ρ 1 +(∑ω j )/(∑ω n )
where ρ represents the interface probability, ω, obtained by combining the downlink data keyword matching module n Indicating all downlinksWeighted value of data keyword in corresponding application range, if step S5 returns miss message, then sigma omega j 0, if step S5 returns a hit message, ω is j Indicating the weight value of the downlink data keyword hit in step S6 under the corresponding applicable range,
s702: if the interface possibility obtained by combining the downlink data keyword matching module is greater than the interface identification threshold, judging that the URL to be tested is an interface;
the step S8 includes the following substeps:
s801: for the URL suffix judging module to judge the tested URL of the interface, the URL keyword matching module and the downlink data keyword matching module respectively carry out URL keyword matching and downlink data keyword matching on the tested URL and the downlink data of the tested URL to obtain a matching result for adjustment, the matching result for adjustment comprises a hit URL keyword, a hit downlink data keyword and a corresponding application range,
s802: adjusting the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range, if the weight value is positive, increasing the adjustment value by the weight value, and if the weight value is negative, subtracting the adjustment value;
the step S10 includes the following substeps:
s1001: the URL keyword matching module performs URL keyword matching on the URL needing manual analysis, the downlink data keyword matching module performs downlink data keyword matching on the downlink data of the URL needing manual analysis to obtain a hit URL keyword, the hit downlink data keyword and a corresponding application range,
s1002: the weight value of the hit URL keyword and the weight value of the hit downlink data keyword in the corresponding application range are adjusted,
when the analysis result of the manual analysis end is the interface, if the weight value is positive, the weight value is added with the adjustment value, if the weight value is negative, the adjustment value is subtracted,
and when the analysis result of the manual analysis end is a non-interface, if the weight value is positive, subtracting the adjustment value from the weight value, and if the weight value is negative, increasing the adjustment value.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010979046.8A CN112073427B (en) | 2020-09-17 | 2020-09-17 | System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010979046.8A CN112073427B (en) | 2020-09-17 | 2020-09-17 | System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112073427A CN112073427A (en) | 2020-12-11 |
| CN112073427B true CN112073427B (en) | 2023-04-07 |
Family
ID=73680650
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010979046.8A Active CN112073427B (en) | 2020-09-17 | 2020-09-17 | System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112073427B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102790762A (en) * | 2012-06-18 | 2012-11-21 | 东南大学 | Phishing website detection method based on uniform resource locator (URL) classification |
| CN103838798A (en) * | 2012-11-27 | 2014-06-04 | 阿里巴巴集团控股有限公司 | Page classification system and method |
| CN106302440A (en) * | 2016-08-11 | 2017-01-04 | 国家计算机网络与信息安全管理中心 | A kind of method obtaining suspicious fishing website by all kinds of means |
| CN107203562A (en) * | 2016-03-18 | 2017-09-26 | 北京京东尚科信息技术有限公司 | The method and apparatus that automation inspection is carried out based on page parsing that computer is performed |
| US10009375B1 (en) * | 2017-12-01 | 2018-06-26 | KnowBe4, Inc. | Systems and methods for artificial model building techniques |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8838767B2 (en) * | 2010-12-30 | 2014-09-16 | Jesse Lakes | Redirection service |
-
2020
- 2020-09-17 CN CN202010979046.8A patent/CN112073427B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102790762A (en) * | 2012-06-18 | 2012-11-21 | 东南大学 | Phishing website detection method based on uniform resource locator (URL) classification |
| CN103838798A (en) * | 2012-11-27 | 2014-06-04 | 阿里巴巴集团控股有限公司 | Page classification system and method |
| CN107203562A (en) * | 2016-03-18 | 2017-09-26 | 北京京东尚科信息技术有限公司 | The method and apparatus that automation inspection is carried out based on page parsing that computer is performed |
| CN106302440A (en) * | 2016-08-11 | 2017-01-04 | 国家计算机网络与信息安全管理中心 | A kind of method obtaining suspicious fishing website by all kinds of means |
| US10009375B1 (en) * | 2017-12-01 | 2018-06-26 | KnowBe4, Inc. | Systems and methods for artificial model building techniques |
Non-Patent Citations (2)
| Title |
|---|
| An empirical study of third party APK"s URL using scriptable API and fast identifier-specific filter;Ruo Ando;《2017 IEEE 9th International Conference on Communication Software and Networks (ICCSN)》;20171121;全文 * |
| 移动终端用户上网行为分析***的设计与实现;王娜1215;《信息科技辑》;20131215;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112073427A (en) | 2020-12-11 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8527504B1 (en) | Data network content filtering using categorized filtering parameters | |
| EP2023531B1 (en) | Method, apparatus, system, user terminal application server for selecting service | |
| CN107256232B (en) | Information recommendation method and device | |
| US8601120B2 (en) | Update notification method and system | |
| US20180212918A1 (en) | Methods and apparatus for inserting content into conversations in on-line and digital environments | |
| US8713003B2 (en) | System and method for ranking content and applications through human assistance | |
| US9239884B2 (en) | Electronic document processing with automatic generation of links to cited references | |
| US7188216B1 (en) | Method and system for an extensible caching framework | |
| US9141697B2 (en) | Method, system and computer-readable storage medium for detecting trap of web-based perpetual calendar and building retrieval database using the same | |
| US10262341B2 (en) | Resource downloading method and device | |
| US20020120721A1 (en) | Client capability detection in a client and server system | |
| US20020138525A1 (en) | Computer method and apparatus for determining content types of web pages | |
| US20070038646A1 (en) | Ranking blog content | |
| WO2007080413A1 (en) | Search platform | |
| US20070256033A1 (en) | System and method for flagging information content | |
| US20080229251A1 (en) | System and method for providing web system services for storing data and context of client applications on the web | |
| WO2006027973A1 (en) | Information search providing device and information search providing system | |
| JP2000235540A (en) | Method and device for automatically filtering information using url hierarchy structure | |
| US20080028284A1 (en) | System and method for web-based interactive gathering hyperlinks and email addresses | |
| WO2007071202A1 (en) | Rss information interactive processing method based on xml files | |
| US20130305131A1 (en) | Method, system and computer storage medium for pre-reading network data | |
| JP2012053893A (en) | Method and system for providing search result | |
| CN112073427B (en) | System and method for identifying uplink and downlink flow data interfaces based on HTTP (hyper text transport protocol) | |
| US20140337069A1 (en) | Deriving business transactions from web logs | |
| CN111131236A (en) | Web fingerprint detection device, method, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |