JNI hostile attack detection method and device based on RASP zero rule

Abstract

The invention provides a JNI hostile attack detection method based on an RASP zero rule. The method comprises the steps of enabling a real-time application program self-protection system RASP to monitor an operation event generated in a webpage in real time; analyzing the operation event, and scanning the operation event by calling a corresponding JIN scanning thread; and according to a scanning result of the operation event, calling a corresponding zero rule vulnerability detection algorithm in the RASP to carry out attack behavior detection on the operation event, and uploading a detection result to a JAVA layer. According to the detection method disclosed by the invention, the detection efficiency of the hostile attack is effectively improved based on the accuracy of the JIN thread and the flexibility of the preset rule in the RASP in the hostile attack detection process. In addition, the invention further provides a JNI hostile attack detection device based on the RASP zero rule.

Description

technical field [0001] The invention belongs to the technical field of information security detection, in particular to a JNI malicious attack detection method and device based on RASP zero rules. Background technique [0002] With the continuous development of network technology, the increasing demand of mobile terminals for the network is also formed based on the continuous increase of application software. The application software market integrates software marketing, installation and update, so developers can easily integrate application programs. In the application market, people can also easily obtain and use corresponding application programs from the application market. [0003] By analyzing the typical vulnerability attack process, the summary of the vulnerability attack utilization rule set has a certain degree of versatility. However, for traditional WAFs, on the one hand, they cannot get the query statement of the database, and can only look for SQL injection fe...

AI Technical Summary

Problems solved by technology

However, for the traditional WAF, on the one hand, it cannot get the query statement of the database, and can only look for SQL injection features in the request; on the other hand, it cannot recognize user input, so there is a possibility of bypassing

In addition, there is no effective JNI consistency check scheme in the prior art

When performing vulnerability detection, the vulnerability detection cannot be performed according to the consistency of JIN, thus causing network threats

Images