Application program attack defense method and system based on code injection and behavior analysis

Abstract

The present invention proposes an application program attack defense method and system based on code injection and behavior analysis. By injecting protection codes into applications that need protection, identifying attack behaviors in applications includes: injecting protection codes into applications that need protection Program, mount the hook point at the predetermined key call position, and the protection code monitors the marked parameters and the operation behavior of calling key functions in the application; run a unified protection plug-in, and conduct security risk analysis in combination with the operation behavior, marked parameters and context information , identify whether there is a suspicious webshell in the monitored code in the application program; send a corresponding alarm message according to the security risk analysis result, or directly block the operation of the application program. The above method can detect attacks and protect itself at runtime through reasonable deployment of protection codes, achieving fewer false negatives and false negatives, more comprehensive and accurate protection, and faster vulnerability response.

Description

technical field [0001] The invention relates to the technical field of application security protection, in particular to a code injection-based self-protection technology for runtime applications, which is mainly used in the security protection of Web application programs. Background technique [0002] Currently, there are two main categories of web application security protection technologies: [0003] 1. WAF (Web Application Firewall): It specifically provides protection for Web applications by implementing a series of security policies for HTTP / HTTPS. In the early days, WAF was a protection device based on rule protection. WAF manufacturers maintained the rule base and updated it in real time. Users can protect applications in all aspects according to these rules. However, as the offensive and defensive sides continue to fight each other, various bypass techniques have appeared in this traditional defense system, breaking this line of defense. s attack. In the past few...

AI Technical Summary

Problems solved by technology

However, the WAF function has natural defects. He is only interested in requests and responses, but does not pay attention to the web application itself

Images