A method and device for detecting malicious behavior

Abstract

The present invention discloses a malicious behavior detection method and device, the method includes obtaining the current behavior monitored by the registered security manager method, when determining that the current behavior is not the default allowed behavior, analyzing the current behavior monitored by the registered security manager method, determining whether the current behavior is normal behavior, if the current behavior is not normal behavior, determining whether the current behavior matches a preset white list, if not, determining that the current behavior is malicious behavior, and sending the malicious behavior to a preset processing class for processing. By analyzing the current behavior monitored by the registered security manager, malicious behavior at the application method call level can be discovered, and combined with the preset white list, the false alarm rate can be reduced and manual intervention can be reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of financial technology (Fintech), and in particular to a malicious behavior detection method and device. Background Art

[0002] With the development of computer technology, more and more technologies are applied in the financial field. Traditional finance is gradually transforming into financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. In the network security technology in the financial field, detecting some behaviors in the network is an important issue.

[0003] The current host-based intrusion detection system (HIDS) is an intrusion detection system that can monitor and analyze the internal operations of a computing system, as well as network packets on its network interface. HIDS can monitor all or part of the dynamic behavior and status of a computer system, depending on how it is configured. In addition to dynamically checking activities such as network packets targeting this specific host, HIDS can also detect which program accesses which resources. HIDS can be thought of as an agent that monitors whether any object or person, internal or external, has bypassed the system's security policy. However, for malicious behavior in Java programs, the HIDS cannot detect malicious behavior at the method call level, and is prone to false positives. Summary of the invention

[0004] The embodiments of the present invention provide a malicious behavior detection method and device, which are used to implement malicious behavior detection at the method call level and reduce the false alarm rate.

[0005] In a first aspect, an embodiment of the present invention provides a malicious behavior detection method, comprising:

[0006] Get the current behavior monitored by the registered security manager method, where the current behavior is a monitored behavior that conforms to a preset type;

[0007] When it is determined that the current behavior is not a default allowed behavior, analyzing the current behavior monitored by the registered security manager method to determine whether the current behavior is a normal behavior;

[0008] If the current behavior is not a normal behavior, determine whether the current behavior matches a preset whitelist, if not, determine that the current behavior is a malicious behavior, and send the malicious behavior to a preset processing class for processing.

[0009] In the above technical solution, by analyzing the current behavior monitored by the registered security manager, malicious behavior at the application method call level can be discovered, and combined with the preset whitelist, the false alarm rate can be reduced and manual intervention can be reduced.

[0010] Optionally, analyzing the current behavior monitored by the registered security manager method to determine whether the current behavior is normal behavior includes:

[0011] According to the type of the current behavior, the call stack and the call parameters when the method registered by the security manager monitors the current behavior, the current behavior is analyzed to determine whether the current behavior is normal behavior.

[0012] Optionally, the type of the current behavior includes creating a process behavior;

[0013] The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes:

[0014] When the type of the current behavior is a create process behavior, determining a process path corresponding to a create process method called when monitoring the create process behavior;

[0015] Obtaining the original code of the called process creation method, analyzing the original code of the called process creation method, and determining the specified process path;

[0016] If the specified process path is consistent with the process path corresponding to the call to create a process method, then the current behavior is determined to be a normal behavior; otherwise, the current behavior is determined to be not a normal behavior.

[0017] In the above technical solution, by analyzing the creation process method called when monitoring the creation process behavior, it is possible to identify whether the creation process behavior is normal behavior.

[0018] Optionally, the obtaining the original code of the called creation process method includes:

[0019] If the class corresponding to the create process behavior is a class file generated after the application is compiled, decompile the class file generated after the application is compiled to obtain the original code of the called create process method;

[0020] If the class corresponding to the creation process behavior is a class file in a compressed package, determining whether there is a source code file in the compressed package, and if so, determining that the source code file is the original code of the called creation process method, otherwise after decompressing the compressed package, decompiling the class file in the compressed package to obtain the original code of the called creation process method;

[0021] If the class corresponding to the creation process behavior is a class file generated by compiling a server page file, the original code of the called creation process method is generated using a preset Web middleware.

[0022] In the above technical solution, by analyzing the files in the class corresponding to the creation process behavior and performing corresponding processing, the original code can be quickly obtained, so that the specified process path can be obtained from the original code.

[0023] Optionally, the type of the current behavior includes a listening port behavior;

[0024] The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes:

[0025] When the type of the current behavior is a listening port behavior, determining a detection listening method to be called when monitoring the listening port behavior, and obtaining the port that the listening port behavior listens to from the parameters of the detection listening method;

[0026] According to the thread corresponding to the listening port behavior, a call stack of the thread corresponding to the listening port behavior is obtained, and according to the call stack, a class name and a method name corresponding to triggering the listening port behavior are determined, and the class name and the method name corresponding to triggering the listening port behavior are analyzed to determine a designated listening port;

[0027] If the port monitored by the monitoring port behavior is consistent with the designated monitoring port, it is determined that the current behavior is a normal behavior; otherwise, it is determined that the current behavior is not a normal behavior.

[0028] In the above technical solution, by analyzing the detection monitoring method called when monitoring the monitoring port behavior, it is possible to identify whether the monitoring port behavior is normal.

[0029] Optionally, analyzing the class name and method name corresponding to the behavior of triggering the listening port to determine the designated listening port includes:

[0030] Identify the class name and method name corresponding to the triggering of the listening port behavior. If it is identified that the listening port behavior belongs to the listening of the HTTP service port, read the configuration file of the current process to obtain the specified listening port, or obtain the system property of the current process to obtain the specified listening port;

[0031] If it is identified that the port listening behavior belongs to the monitoring of the TCP port, the original code for calling the port listening method is obtained, and the port parameter is passed into the original code of the port listening method to obtain the specified port.

[0032] Optionally, the type of the current behavior includes establishing a Socket connection behavior;

[0033] The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes:

[0034] When the type of the current behavior is a Socket connection establishment behavior, determining a server IP address and a server port corresponding to a Socket connection establishment method called to monitor the Socket connection establishment behavior;

[0035] According to the thread corresponding to the Socket connection establishment behavior, a call stack of the thread corresponding to the Socket connection establishment behavior is obtained, and according to the call stack of the thread corresponding to the Socket connection establishment behavior, a class name and a method name corresponding to the triggering of the Socket connection establishment behavior are determined;

[0036] Analyze the class name and method name corresponding to the behavior of triggering the establishment of the Socket connection, and identify the operation type of the behavior of establishing the Socket connection;

[0037] The operation type of the Socket connection establishment behavior is analyzed to determine whether the current behavior is normal.

[0038] In the above technical solution, by analyzing the Socket connection establishment method called when monitoring the Socket connection establishment behavior, it is possible to identify whether the Socket connection establishment behavior is a normal behavior.

[0039] Optionally, analyzing the operation type of the Socket connection establishment behavior to determine whether the current behavior is a normal behavior includes:

[0040] If the operation type of the Socket connection establishment behavior is to access a database, then obtain the data source object that manages the database connection, obtain the server IP address and port of the actually connected database, or read the server IP address and port of the database to be accessed from a preset configuration file, and determine whether the server IP address and port of the database are consistent with the server IP address and server port of the Socket connection establishment method. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal;

[0041] If the operation type of the Socket connection establishment behavior is accessing a message queue server, determine from the configuration management database of the network access policy whether there is a network access policy for accessing the server IP address and server port of the Socket connection establishment method from the IP address of the server where the application corresponding to the Socket connection establishment behavior is located; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal;

[0042] If the operation type of establishing the Socket connection behavior is accessing TCP or HTTP services, the configuration file of the application corresponding to the establishing the Socket connection behavior is read, and based on the configuration file, it is determined from the configuration management database whether there is a network access policy corresponding to the establishing the Socket connection behavior; if so, it is determined that the current behavior is normal; otherwise, it is determined that the current behavior is not normal.

[0043] Optionally, the type of the current behavior includes a Socket connection acceptance behavior;

[0044] The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes:

[0045] When the type of the current behavior is a Socket connection acceptance behavior, determining a client IP address and a server port corresponding to a Socket connection acceptance method called when monitoring the Socket connection acceptance behavior;

[0046] Obtain the server IP address where the application corresponding to the Socket connection acceptance behavior is located, and determine from the network access policy configuration management database whether there is a network access policy for the client IP address to access the server port corresponding to the server IP address; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal.

[0047] In the above technical solution, by analyzing the accepting Socket connection method called when monitoring the accepting Socket connection behavior, it is possible to identify whether the accepting Socket connection behavior is normal behavior.

[0048] Optionally, before getting the current behavior, also include:

[0049] Get the configuration file for malicious behavior detection;

[0050] Obtaining the preset whitelist configuration information from the configuration file and storing it;

[0051] Initializing a dynamic update function of the preset whitelist and determining a preset processing class for processing malicious behavior;

[0052] A new security manager is created, a monitoring function of the security manager is configured according to the configuration file, and the security manager is registered in the Java virtual machine.

[0053] In a second aspect, an embodiment of the present invention provides a malicious behavior detection device, including:

[0054] An acquisition unit, used to acquire a current behavior monitored by a registered security manager method, wherein the current behavior is a monitored behavior that conforms to a preset type;

[0055] The processing unit is used to analyze the current behavior monitored by the registered security manager method to determine whether the current behavior is normal behavior when it is determined that the current behavior is not the default allowed behavior; if the current behavior is not normal behavior, determine whether the current behavior matches a preset whitelist; if not, determine that the current behavior is malicious behavior, and send the malicious behavior to a preset processing class for processing.

[0056] Optionally, the processing unit is specifically used for:

[0057] According to the type of the current behavior, the call stack and the call parameters when the method registered by the security manager monitors the current behavior, the current behavior is analyzed to determine whether the current behavior is normal behavior.

[0058] Optionally, the type of the current behavior includes creating a process behavior;

[0059] The processing unit is specifically used for:

[0060] When the type of the current behavior is a create process behavior, determining a process path corresponding to calling a create process method when monitoring the create process behavior;

[0061] Obtaining the original code of the called process creation method, analyzing the original code of the called process creation method, and determining the specified process path;

[0062] If the specified process path is consistent with the process path corresponding to the call to create a process method, then the current behavior is determined to be a normal behavior; otherwise, the current behavior is determined to be not a normal behavior.

[0063] Optionally, the processing unit is specifically used for:

[0064] If the class corresponding to the create process behavior is a class file generated after the application is compiled, decompile the class file generated after the application is compiled to obtain the original code of the called create process method;

[0065] If the class corresponding to the creation process behavior is a class file in a compressed package, determining whether there is a source code file in the compressed package, and if so, determining that the source code file is the original code of the called creation process method, otherwise after decompressing the compressed package, decompiling the class file in the compressed package to obtain the original code of the called creation process method;

[0066] If the class corresponding to the creation process behavior is a class file generated by compiling a server page file, the original code of the called creation process method is generated using a preset Web middleware.

[0067] Optionally, the type of the current behavior includes a listening port behavior;

[0068] The processing unit is specifically used for:

[0069] When the type of the current behavior is a listening port behavior, determining a detection listening method to be called when monitoring the listening port behavior, and obtaining the port that the listening port behavior listens to from the parameters of the detection listening method;

[0070] According to the thread corresponding to the listening port behavior, a call stack of the thread corresponding to the listening port behavior is obtained, and according to the call stack, a class name and a method name corresponding to triggering the listening port behavior are determined, and the class name and the method name corresponding to triggering the listening port behavior are analyzed to determine a designated listening port;

[0071] If the port monitored by the monitoring port behavior is consistent with the designated monitoring port, it is determined that the current behavior is a normal behavior; otherwise, it is determined that the current behavior is not a normal behavior.

[0072] Optionally, the processing unit is specifically used for:

[0073] Identify the class name and method name corresponding to the triggering of the listening port behavior. If it is identified that the listening port behavior belongs to the listening of the HTTP service port, read the configuration file of the current process to obtain the specified listening port, or obtain the system property of the current process to obtain the specified listening port;

[0074] If it is identified that the port listening behavior belongs to the monitoring of the TCP port, the original code for calling the port listening method is obtained, and the port parameter is passed into the original code of the port listening method to obtain the specified port.

[0075] Optionally, the type of the current behavior includes establishing a Socket connection behavior;

[0076] The processing unit is specifically used for:

[0077] When the type of the current behavior is a Socket connection establishment behavior, determining a server IP address and a server port corresponding to a Socket connection establishment method called to monitor the Socket connection establishment behavior;

[0078] According to the thread corresponding to the Socket connection establishment behavior, a call stack of the thread corresponding to the Socket connection establishment behavior is obtained, and according to the call stack of the thread corresponding to the Socket connection establishment behavior, a class name and a method name corresponding to the triggering of the Socket connection establishment behavior are determined;

[0079] Analyze the class name and method name corresponding to the behavior of triggering the establishment of the Socket connection, and identify the operation type of the behavior of establishing the Socket connection;

[0080] The operation type of the Socket connection establishment behavior is analyzed to determine whether the current behavior is normal.

[0081] Optionally, the processing unit is specifically used for:

[0082] If the operation type of the Socket connection establishment behavior is to access a database, then obtain the data source object that manages the database connection, obtain the server IP address and port of the actually connected database, or read the server IP address and port of the database to be accessed from a preset configuration file, and determine whether the server IP address and port of the database are consistent with the server IP address and server port of the Socket connection establishment method. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal;

[0083] If the operation type of the Socket connection establishment behavior is accessing a message queue server, determine from the configuration management database of the network access policy whether there is a network access policy for accessing the server IP address and server port of the Socket connection establishment method from the IP address of the server where the application corresponding to the Socket connection establishment behavior is located; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal;

[0084] If the operation type of establishing the Socket connection behavior is accessing TCP or HTTP services, the configuration file of the application corresponding to the establishing the Socket connection behavior is read, and based on the configuration file, it is determined from the configuration management database whether there is a network access policy corresponding to the establishing the Socket connection behavior; if so, it is determined that the current behavior is normal; otherwise, it is determined that the current behavior is not normal.

[0085] Optionally, the type of the current behavior includes a Socket connection acceptance behavior;

[0086] The processing unit is specifically used for:

[0087] When the type of the current behavior is a Socket connection acceptance behavior, determining a client IP address and a server port corresponding to a Socket connection acceptance method called when monitoring the Socket connection acceptance behavior;

[0088] Obtain the server IP address where the application corresponding to the Socket connection acceptance behavior is located, and determine from the network access policy configuration management database whether there is a network access policy for the client IP address to access the server port corresponding to the server IP address; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal.

[0089] In the above technical solution, by analyzing the accepting Socket connection method called when monitoring the accepting Socket connection behavior, it is possible to identify whether the accepting Socket connection behavior is normal behavior.

[0090] Optionally, the processing unit is further used for:

[0091] Before obtaining the current behavior, obtain the configuration file for malicious behavior detection;

[0092] Obtaining the preset whitelist configuration information from the configuration file and storing it;

[0093] Initializing a dynamic update function of the preset whitelist and determining a preset processing class for processing malicious behavior;

[0094] A new security manager is created, a monitoring function of the security manager is configured according to the configuration file, and the security manager is registered in the Java virtual machine.

[0095] In a third aspect, an embodiment of the present invention further provides a computing device, including:

[0096] A memory for storing program instructions;

[0097] The processor is used to call the program instructions stored in the memory and execute the above-mentioned malicious behavior detection method according to the obtained program.

[0098] In a fourth aspect, an embodiment of the present invention further provides a computer-readable non-volatile storage medium, comprising computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the above-mentioned malicious behavior detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0100] Figure 1 A schematic diagram of a system architecture provided by an embodiment of the present invention;

[0101] Figure 2 A flowchart of a malicious behavior detection method provided by an embodiment of the present invention;

[0102] Figure 3 A schematic diagram of the execution of a registered malicious behavior detection function provided by an embodiment of the present invention;

[0103] Figure 4 A schematic diagram of the execution of a malicious behavior detection function provided by an embodiment of the present invention;

[0104] Figure 5 A schematic diagram of the execution of a default malicious behavior processing function provided by an embodiment of the present invention;

[0105] Figure 6 A schematic diagram of the structure of a malicious behavior detection device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0106] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0107] Figure 1 A system architecture is provided for an embodiment of the present invention. Figure 1 As shown, the system architecture may be a server 100 , which may include a processor 110 , a communication interface 120 , and a memory 130 .

[0108] The communication interface 120 is used to communicate with the terminal device, send and receive information transmitted by the terminal device, and realize communication.

[0109] The processor 110 is the control center of the server 100, and uses various interfaces and lines to connect various parts of the entire server 100, and executes various functions of the server 100 and processes data by running or executing software programs and / or modules stored in the memory 130, and calling data stored in the memory 130. Optionally, the processor 110 may include one or more processing units.

[0110] The memory 130 can be used to store software programs and modules. The processor 110 executes various functional applications and data processing by running the software programs and modules stored in the memory 130. The memory 130 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function, etc.; the data storage area can store data created according to business processing, etc. In addition, the memory 130 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0111] Based on the above description, Figure 2 The process of a malicious behavior detection method provided by an embodiment of the present invention is shown in detail, and the process can be executed by a malicious behavior detection device.

[0112] like Figure 2 As shown in the figure, the process specifically includes:

[0113] Step 201, obtaining the current behavior monitored by the registered security manager method.

[0114] In the embodiment of the present invention, the current behavior is a monitored behavior that conforms to a preset type, where the behavior refers to an operation in the network. The preset type may include creating a process, listening to a port, accepting a Socket connection, establishing a Socket connection, and the like.

[0115] In order to detect malicious behavior, it is necessary to first register a Java security manager with malicious behavior detection function. Specifically, it is necessary to obtain the configuration file of malicious behavior detection, and then obtain the configuration information of the preset whitelist from the configuration file and store it. Then initialize the dynamic update function of the preset whitelist, and determine the preset processing class for processing malicious behavior. Finally, create a new security manager, configure the monitoring function of the security manager according to the configuration file, and register the security manager with the Java virtual machine.

[0116] The above steps may also be referred to as registering a malicious behavior detection function.

[0117] Step 202: When it is determined that the current behavior is not a behavior permitted by default, the method of the security manager called by the current behavior is analyzed to determine whether the current behavior is a normal behavior.

[0118] After obtaining the current behavior, it is necessary to determine whether the current behavior is the default allowed behavior. For example, for the behavior of accepting a Socket connection, if the connection is made to the local machine, it is allowed by default; for the behavior of establishing a Socket connection, if the connection is made to the local machine, or the port number is not in the normal range (less than 0 or greater than 0xFFFF), it is allowed by default.

[0119] When it is determined that the behavior is not allowed by default, it is necessary to analyze whether the current behavior is normal. Specifically, first monitor the call stack and call parameters of the current behavior according to the type of the current behavior and the method registered in the security manager, analyze the current behavior, and determine whether the current behavior is normal.

[0120] The current behavior type is the preset type mentioned above, which can include creating process behavior, listening port behavior, accepting socket connection behavior and establishing socket connection behavior. Each type will be analyzed below:

[0121] The first, current behavior type is when a process behavior is created.

[0122] It is necessary to determine the process path corresponding to the create process method called when monitoring the create process behavior.

[0123] The original code of the called process creation method is obtained, and the original code of the called process creation method is analyzed to determine the specified process path. When obtaining the original code, it is specifically obtained according to the following method:

[0124] Method 1:

[0125] If the class corresponding to the process creation behavior is a class file generated after the application is compiled, the class file generated after the application is compiled is decompiled to obtain the original code of the called process creation method.

[0126] Method 2:

[0127] If the class corresponding to the creation process behavior is a class file in a compressed package, determine whether there is a source code file in the compressed package. If so, determine that the source code file is the original code of the called creation process method. Otherwise, after decompressing the compressed package, decompile the class file in the compressed package to obtain the original code of the called creation process method.

[0128] Method 3:

[0129] If the class corresponding to the creation process behavior is a class file generated by compiling a server page (JavaServer Pages, JSP) file, the original code of the creation process method to be called is generated using the preset Web middleware.

[0130] The above class file is the class file in Java. By decompiling the class file, the corresponding Java original code can be obtained.

[0131] Identify the definition method of the process path parameter passed in when the Java original code calls the create process method. If the original code defines the process path through the constants in the Java code, obtain the process path specified in the Java original code; if the original code defines the process path through the parameter value in the configuration file, read the corresponding configuration file to obtain the specified process path.

[0132] If the specified process path is consistent with the process path corresponding to when the create process behavior calls the create process method, then the current behavior is determined to be normal behavior, otherwise the current behavior is determined to be not normal behavior.

[0133] Compare the currently created process path with the process path specified by the original code obtained from the application to see if they match. If they match, it means that the current process creation behavior is normal in the application and no processing is required; if they do not match, it means that the current process creation behavior is not normal in the application.

[0134] The second type is when the current behavior type is a listening port behavior.

[0135] Determine the detection listening method called when monitoring the listening port behavior, and obtain the port monitored by the listening port behavior from the parameters of the detection listening method.

[0136] According to the thread corresponding to the listening port behavior, the call stack of the thread corresponding to the listening port behavior is obtained, and the class name and method name corresponding to the triggering listening port behavior are determined according to the call stack.

[0137] Analyze the class name and method name corresponding to the triggering listening port behavior to determine the designated listening port. Specifically, identify the class name and method name corresponding to the triggering listening port behavior. If it is identified that the listening port behavior belongs to Tomcat's listening to the HTTP (HyperText Transfer Protocol) service port, read the configuration file of the current process to obtain the designated listening port, or obtain the system properties of the current process to obtain the designated listening port. If it is identified that the listening port behavior belongs to the listening to the TCP (Transmission Control Protocol) port, obtain the original code for calling the listening port method, pass the port parameter to the original code of the listening port method, and obtain the designated port.

[0138] If the port listened by the listening port behavior is consistent with the specified listening port, it is determined that the current behavior is a normal behavior, otherwise it is determined that the current behavior is not a normal behavior.

[0139] The third type is when the current behavior type is accepting a Socket connection behavior.

[0140] In order to solve the problem that the JDK native security manager cannot obtain the server port when monitoring the acceptance of Socket connection behavior, the embodiment of the present invention expands and enhances the JDK native security manager class, adds parameters in the checkAccept method for passing the Socket server IP; and modifies the JDK class ServerSocket for processing server Sockets. When calling the checkAccept method of the security manager, the enhanced security manager class instance is used to pass the Socket server IP.

[0141] Therefore, the client IP address and server port corresponding to the accepting socket connection method called when monitoring the accepting socket connection behavior can be determined directly from the accepting socket connection method parameters of the security manager.

[0142] Get the server IP address where the application corresponding to the Socket connection acceptance behavior is located, and determine from the network access policy configuration management database whether there is a network access policy for the client IP address to access the server port corresponding to the server IP address. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal.

[0143] Fourth, the current behavior type is when a Socket connection is established.

[0144] It is necessary to determine the server IP address and server port corresponding to the Socket connection establishment method called when monitoring the Socket connection establishment behavior.

[0145] According to the thread corresponding to the Socket connection establishment behavior, the call stack of the thread corresponding to the Socket connection establishment behavior is obtained, and according to the call stack of the thread corresponding to the Socket connection establishment behavior, the class name and method name corresponding to the triggering behavior of establishing the Socket connection are determined, and the class name and method name corresponding to the triggering behavior of establishing the Socket connection are analyzed to identify the operation type of the Socket connection establishment behavior.

[0146] Analyze the operation type of the Socket connection establishment behavior to determine whether the current behavior is normal. Specifically, it can be determined in the following ways:

[0147] Method 1:

[0148] If the operation type of establishing the Socket connection behavior is to access the database, then obtain the data source object that manages the database connection, get the server IP address and port of the actually connected database, or read the server IP address and port of the database to be accessed from the preset configuration file, and determine whether the server IP address and port of the database are consistent with the server IP address and server port of the Socket connection method. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal.

[0149] Method 2:

[0150] If the operation type of establishing the Socket connection behavior is accessing the message queue server, determine from the configuration management database of the network access policy whether there is a network access policy for establishing the Socket connection method using the IP address of the server where the application corresponding to the Socket connection behavior is located to access the server IP address and server port. If so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal.

[0151] Method 3:

[0152] If the operation type of establishing the Socket connection behavior is accessing TCP or HTTP services, the configuration file of the application corresponding to the Socket connection behavior is read, and based on the configuration file, it is determined from the configuration management database whether there is a network access policy corresponding to the Socket connection behavior. If so, it is determined that the current behavior is normal behavior, otherwise it is determined that the current behavior is not normal behavior.

[0153] Step 203: if the current behavior is not a normal behavior, determine whether the current behavior matches a preset whitelist; if not, determine that the current behavior is a malicious behavior, and send the malicious behavior to a preset processing class for processing.

[0154] When it is determined that the current behavior is not normal, it is necessary to match the current behavior with the preset whitelist. If the match is successful, it can be determined that the current behavior is normal. Otherwise, it is determined that the current behavior is malicious, and the malicious behavior can be sent to the preset processing class for processing. The preset processing class includes the default processing class and the custom processing class. When the default processing class processes the malicious behavior, it will record the corresponding alarm information in the specified log file. The custom processing class is customized by the user, and can be customized to perform the following operations: sending messages to the alarm system, recording alarm logs, blocking malicious behavior, etc.

[0155] In order to better explain the embodiments of the present invention, the above malicious behavior detection process will be described below in a specific implementation scenario.

[0156] In the specific implementation process, the malicious behavior detection system provided by the embodiment of the present invention is in the form of a Java component (i.e., a Jar package). For a Java application that needs to use the embodiment of the present invention, it is necessary to load the Java component of the embodiment of the present invention and call the initialization method when the program starts.

[0157] The Java component implemented in the embodiment of the present invention will register the security manager provided by JDK to monitor important Java API calls. When suspected malicious behavior is monitored, the component of the embodiment of the present invention will first automatically analyze whether the current behavior is normal behavior generated by the Java application; if abnormal behavior is found, it will be judged according to the whitelist configured by the user; if it is a behavior allowed in the whitelist, it will not be processed; if it is not allowed, it will be sent to the default malicious behavior processing class or the custom processing class for processing.

[0158] The malicious behavior detection system implemented in the embodiment of the present invention includes the following important functions, namely, a registered malicious behavior detection function, a malicious behavior detection function, a malicious behavior default processing function, a malicious behavior custom processing function, and a whitelist dynamic update function.

[0159] First, you need to register the malicious behavior detection function.

[0160] The Java program that uses the components of the embodiment of the present invention to detect malicious behavior needs to reference the Jar (compressed package) package corresponding to the embodiment of the present invention. When the application performs initialization operations, it is necessary to call the initialization method provided by the corresponding Jar package of the embodiment of the present invention so that the embodiment of the present invention registers the malicious behavior detection function.

[0161] When registering the malicious behavior detection function, the embodiments of the present invention perform the following operations:

[0162] 1. Load the behavior detection whitelist.

[0163] Before registering the JVM security manager, you first need to load the behavior detection whitelist, read the whitelist configuration information in the configuration file and save it to memory for subsequent use. The types of whitelist configuration files include creating processes, listening to ports, accepting socket connections, and establishing socket connections.

[0164] 2. Initialize the whitelist dynamic update function.

[0165] Complete the initialization of the whitelist dynamic update function, which is used to start the whitelist dynamic update function.

[0166] 3. Select the malicious behavior processing class to use.

[0167] Determine the malicious behavior processing class specified in the application. If the default processing class is specified to handle malicious behavior, choose to use the default processing class; otherwise, choose to use a custom processing class.

[0168] 4. Register the JVM security manager.

[0169] Create a new security manager to monitor the creation of processes, listening to ports, accepting socket connections, establishing socket connections, etc., and register the newly created security manager with the JVM.

[0170] In the newly created security manager, first determine whether there is an existing security manager. If there is, call the check method of the existing security manager first, and then call the check method of the newly created security manager; if there is no, directly call the malicious behavior detection function. The above processing is to avoid affecting the existing security manager function.

[0171] After registering the security manager with the JVM, when the current Java process exhibits the above monitored behaviors, the newly created security manager will take over the corresponding behaviors and hand them over to the malicious behavior detection function for processing.

[0172] The steps to register the malicious behavior detection function can be as follows: Figure 3 shown.

[0173] When the malicious behavior detection function starts to execute, it means that the current Java process has the above monitored behavior. The security manager created by the embodiment of the present invention will take over the corresponding behavior and hand it over to the malicious behavior detection function for processing.

[0174] Malicious behavior detection function first determines whether the current behavior is allowed by default. For the behavior of accepting Socket connection, if the connection is made by the local machine, it is allowed by default; for the behavior of establishing Socket connection, if the connection is made by the local machine, or the port number is not in the normal range (less than 0 or greater than 0xFFFF), it is allowed by default.

[0175] When it is determined that the current behavior is not the default allowed behavior, it will automatically analyze whether the current behavior is normal behavior. That is, the embodiment of the present invention will automatically analyze whether the currently monitored behavior belongs to the normal behavior of the corresponding Java process, which can reduce manual intervention when making judgments after monitoring suspected malicious behavior, thereby improving the accuracy of malicious behavior detection.

[0176] Different types of behaviors require targeted treatment.

[0177] First, for the creation of process behavior.

[0178] When the process creation behavior is monitored, the checkExec (check process) method of the security manager registered in the embodiment of the present invention will be called to automatically analyze whether the current behavior belongs to the normal behavior of the application through the following steps:

[0179] From the checkExec method parameters of the security manager, get the corresponding process path when the current behavior calls the create process method;

[0180] Get the call stack of the current thread;

[0181] According to the call stack, obtain the complete class name, method name, and line number information corresponding to the operation that triggers the current creation process behavior;

[0182] To obtain the original code that calls the create process method, you need to consider the following situations:

[0183] a. If the class corresponding to the current behavior is a class file generated after the application is compiled, the class file needs to be decompiled to obtain the original Java code.

[0184] b. If the class corresponding to the current behavior is a class file in the Jar package, it is necessary to determine whether there is a corresponding Java source code file in the Jar package. If so, the corresponding Java source code file is used directly; if not, the Jar package needs to be decompressed and the class file needs to be decompiled to obtain the original Java code.

[0185] c. If the class corresponding to the current behavior is a class file generated by compiling the JSP file, you can directly use the corresponding Java original code file automatically generated by the Web middleware.

[0186] Identify the definition method of the process path parameter passed in when the Java original code calls the create process method. If the original code defines the process path through the constants in the Java code, obtain the process path specified in the Java original code; if the original code defines the process path through the parameter value in the configuration file, read the corresponding configuration file to obtain the specified process path;

[0187] Compare the current process path actually created with the process path specified by the current code obtained from the application to see if they match. If they match, it means that the current process creation behavior is normal in the application and no processing is required; if they do not match, it means that the current process creation behavior is not normal in the application and the next step of processing is required.

[0188] Second, regarding the behavior of listening to ports (networks).

[0189] When monitoring the listening port behavior, the checkListen method of the security manager registered by the present invention will be called to automatically analyze whether the current behavior belongs to the normal behavior of the application through the following steps:

[0190] Get the port that the current behavior listens on from the checkListen method parameters of the security manager;

[0191] Get the call stack of the current thread;

[0192] According to the call stack, obtain the complete class name, method name, and line number information corresponding to the action that triggers the current listening port behavior;

[0193] Based on the class name and method name obtained above, identify the behavior type of the current listening port, for example, whether Tomcat is listening to the HTTP service port, or the application custom code is listening to the TCP port. The following situations need to be considered:

[0194] a. If it is identified that the current listening port behavior is Tomcat listening to the HTTP service port, then read the configuration file of the current Tomcat process, or obtain the system properties of the current process to obtain the HTTP service port;

[0195] b. If it is identified that the current listening port behavior is the application custom code listening to the TCP port, the original code for calling the listening port method is obtained, the incoming port parameters are identified, and the listening port is obtained from the Java code or configuration file;

[0196] Compare the current actual listening port with the listening port specified by the current code obtained from the application to see if they match. If they match, it means that the current listening port behavior is normal in the application and no processing is required; if they do not match, it means that the current listening port behavior is not normal in the application and further processing is required.

[0197] Third, regarding the behavior of accepting Socket connections.

[0198] When the behavior of accepting a Socket connection is monitored, the checkAccept method of the security manager registered in the embodiment of the present invention will be called.

[0199] The parameters accepted by the checkAccept method of the native security manager in JDK include the client IP and client port, but not the server port. When monitoring the behavior of accepting Socket connections in the security manager, if the server port is unknown, it is difficult to combine it with the network access policy to determine whether the current behavior of accepting Socket connections is normal for the application.

[0200] In order to solve the problem that the JDK native security manager cannot obtain the server port when monitoring the acceptance of Socket connection behavior, the embodiment of the present invention expands and enhances the JDK native security manager class, adds parameters in the checkAccept method for passing the Socket server IP; and modifies the JDK class ServerSocket for processing server Sockets. When calling the checkAccept method of the security manager, the enhanced security manager class instance is used to pass the Socket server IP.

[0201] Automatically analyze whether the current behavior is normal for the application by following these steps:

[0202] From the checkAccept method parameters of the security manager, get the corresponding client IP and server port when the current behavior calls the accept socket connection method;

[0203] Get the IP address of the server where the current application is located;

[0204] Query the network access policy from the Configuration Management Database (CMDB) that stores the network access policy to determine whether there is a network access policy for the current client IP to access the port corresponding to the current server IP (that is, the server where the current application is located); if so, it means that the current behavior of accepting the Socket connection is normal in the application and no processing is required; if not, it means that the current behavior of accepting the Socket connection is not normal in the application and the next step of processing is required.

[0205] Fourth, the behavior of establishing a Socket connection (network).

[0206] When monitoring the establishment of a Socket connection, the checkConnect method of the security manager registered by the present invention will be called. The following steps are used to automatically analyze whether the current behavior is a normal behavior of the application:

[0207] From the checkConnect method parameters of the security manager, get the corresponding server IP and port when the current behavior calls the method to establish a Socket connection;

[0208] Get the call stack of the current thread;

[0209] According to the call stack, obtain the complete class name, method name, and line number information corresponding to the operation that triggers the current Socket connection establishment behavior. According to the class name and method name, you can identify the specific operation type corresponding to the current Socket connection establishment behavior, such as accessing a database, accessing a message queue server, accessing other TCP, HTTP services, etc. The following situations need to be considered:

[0210] a. If the operation type corresponding to the current Socket connection behavior is to access the database, the data source object that manages the database connection is obtained from the memory of the current Java process, and the IP and port of the database server actually connected are obtained; or the IP and port of the database server to be accessed are read from the configuration file.

[0211] b. If the operation type corresponding to the current Socket connection establishment behavior is accessing a message queue server (such as ActiveMQ, RocketMQ, RabbitMQ, Kafka, etc.), the network access policy is queried from the configuration management database CMDB that stores the network access policy to determine whether there is a network access policy for the current client (that is, the server where the current application is located) IP to access the port corresponding to the current server (that is, the message queue server) IP.

[0212] c. If the operation type corresponding to the current Socket connection establishment behavior is accessing other TCP and HTTP services, the corresponding normal network access policy is obtained by reading the application configuration file and obtaining the network access policy from the CMDB.

[0213] Determine whether there is a corresponding network access policy for the current actual Socket connection establishment behavior. If so, it means that the current Socket connection establishment behavior is a normal behavior in the application and no processing is required. If not, it means that the current Socket connection establishment behavior is not a normal behavior in the application and further processing is required.

[0214] When it is determined in the above steps that the current behavior is not a normal behavior, it can be determined whether the current behavior is in the whitelist.

[0215] The function of automatically analyzing whether the current behavior is normal provided by the embodiment of the present invention can operate normally in most cases without any false alarm.

[0216] In order to provide a more flexible control function and solve the problem of false alarms in a small number of cases, the present invention provides a function of configuring allowed behaviors through a whitelist.

[0217] When the security manager registered by the present invention monitors suspected malicious behavior, the automatic analysis function first identifies whether the current behavior belongs to the normal function of the application. If so, no processing is performed; otherwise, it determines whether the current behavior has been configured in the whitelist configuration file.

[0218] The contents of the whitelist configuration corresponding to each type of behavior and the dimensions of detection can be shown in Table 1.

[0219] Table 1

[0220] Behavior Type Whitelist configuration content and detection dimensions Creating a process The full path to the executable program Listening Port Port being listened Accepting Socket Connections Client IP Establishing a Socket Connection Server IP and port

[0221] If the suspected malicious behavior currently monitored is not allowed by default and is not configured in the whitelist, it is considered malicious behavior.

[0222] Determine the currently specified malicious behavior processing class. If the default processing class is specified to process the malicious behavior, choose to use the default processing class to process the current malicious behavior; otherwise, choose to use the custom processing class to process the current malicious behavior.

[0223] The execution steps of the malicious behavior detection function can be as follows: Figure 4 shown.

[0224] When malicious behavior is detected, malicious behavior processing functions can be implemented, which may include default malicious behavior processing functions and custom malicious behavior processing functions.

[0225] Among them, the default processing function for malicious behavior is:

[0226] The embodiment of the present invention provides a default malicious behavior processing function. When malicious behavior is detected, the number of occurrences of the current malicious behavior recorded in the memory during the running of the current process is first determined to determine whether it has exceeded the maximum value. If it has exceeded, no further processing will be performed; if it has not exceeded, subsequent processing will continue and the number will be increased by 1.

[0227] The default malicious behavior processing function will record the corresponding alarm information in the specified log file (the alarm system needs to send the corresponding alarm information), and will not block the malicious behavior. In order to facilitate the location of the code class and package corresponding to the malicious program, the call stack of the current thread will also be recorded. The call stack contains the complete class name, method name, and line number information corresponding to the method executed by the malicious behavior. The above information can be used to analyze the principle of the malicious program used by the attacker.

[0228] The execution steps of the default malicious behavior processing function are as follows: Figure 5 shown.

[0229] Malicious behavior custom processing function:

[0230] The malicious behavior custom processing function needs to be implemented by the user, in which the required operations can be performed, such as sending messages to the alarm system, recording alarm logs, blocking malicious behaviors, etc. Blocking malicious behaviors has certain risks, and it is necessary to carefully evaluate whether to use it.

[0231] The malicious behavior custom processing class is specified when loading the Java component implemented in the embodiment of the present invention.

[0232] The embodiment of the present invention also has a whitelist dynamic update function.

[0233] For the above-mentioned whitelist configuration file, the Java component implemented in the embodiment of the present invention will read it regularly. When it is found that the content of the whitelist configuration file has changed, the content in the whitelist configuration file will be read into the memory again, and the whitelist configuration can be reloaded without restarting the application.

[0234] In an embodiment of the present invention, the current behavior is obtained, and the current behavior is a monitored behavior that meets the preset type. When it is determined that the current behavior is not a default allowed behavior, the method of the security manager called by the current behavior is analyzed to determine whether the current behavior is a normal behavior. If the current behavior is not a normal behavior, it is determined whether the current behavior matches the preset whitelist. If not, the current behavior is determined to be a malicious behavior, and the malicious behavior is sent to a preset processing class for processing. By analyzing the method of the security manager called by the current behavior, malicious behavior at the call level can be discovered, and combined with the preset whitelist, the false alarm rate can be reduced and manual intervention can be reduced.

[0235] Based on the same technical concept, Figure 6 The structure of a malicious behavior detection device provided by an embodiment of the present invention is exemplarily shown, and the device can execute a malicious behavior detection process.

[0236] like Figure 6 As shown, the device specifically includes:

[0237] An acquisition unit 601 is used to acquire a current behavior monitored by a registered security manager method, where the current behavior is a monitored behavior that meets a preset type;

[0238] Processing unit 602 is used to analyze the current behavior monitored by the registered security manager method to determine whether the current behavior is normal behavior when it is determined that the current behavior is not the default allowed behavior; if the current behavior is not normal behavior, determine whether the current behavior matches a preset whitelist; if not, determine that the current behavior is malicious behavior, and send the malicious behavior to a preset processing class for processing.

[0239] Optionally, the processing unit 602 is specifically configured to:

[0240] According to the type of the current behavior, the call stack and the call parameters when the method registered by the security manager monitors the current behavior, the current behavior is analyzed to determine whether the current behavior is normal behavior.

[0241] Optionally, the type of the current behavior includes creating a process behavior;

[0242] The processing unit 602 is specifically used for:

[0243] When the type of the current behavior is a create process behavior, determining a process path corresponding to a create process method called when monitoring the create process behavior;

[0244] Obtaining the original code of the called process creation method, analyzing the original code of the called process creation method, and determining the specified process path;

[0245] If the specified process path is consistent with the process path corresponding to the call to create a process method, then the current behavior is determined to be a normal behavior; otherwise, the current behavior is determined to be not a normal behavior.

[0246] Optionally, the processing unit 602 is specifically configured to:

[0247] If the class corresponding to the create process behavior is a class file generated after the application is compiled, decompile the class file generated after the application is compiled to obtain the original code of the called create process method;

[0248] If the class corresponding to the creation process behavior is a class file in a compressed package, determining whether there is a source code file in the compressed package, and if so, determining that the source code file is the original code of the called creation process method, otherwise after decompressing the compressed package, decompiling the class file in the compressed package to obtain the original code of the called creation process method;

[0249] If the class corresponding to the creation process behavior is a class file generated by compiling a server page file, the original code of the called creation process method is generated using a preset Web middleware.

[0250] Optionally, the type of the current behavior includes a listening port behavior;

[0251] The processing unit 602 is specifically used for:

[0252] When the type of the current behavior is a listening port behavior, determining a detection listening method to be called when monitoring the listening port behavior, and obtaining the port that the listening port behavior listens to from the parameters of the detection listening method;

[0253] According to the thread corresponding to the listening port behavior, a call stack of the thread corresponding to the listening port behavior is obtained, and according to the call stack, a class name and a method name corresponding to triggering the listening port behavior are determined, and the class name and the method name corresponding to triggering the listening port behavior are analyzed to determine a designated listening port;

[0254] If the port monitored by the monitoring port behavior is consistent with the designated monitoring port, it is determined that the current behavior is a normal behavior; otherwise, it is determined that the current behavior is not a normal behavior.

[0255] Optionally, the processing unit 602 is specifically configured to:

[0256] Identify the class name and method name corresponding to the triggering of the listening port behavior. If it is identified that the listening port behavior belongs to the listening of the HTTP service port, read the configuration file of the current process to obtain the specified listening port, or obtain the system property of the current process to obtain the specified listening port;

[0257] If it is identified that the port listening behavior belongs to the monitoring of the TCP port, the original code for calling the port listening method is obtained, and the port parameter is passed into the original code of the port listening method to obtain the specified port.

[0258] Optionally, the type of the current behavior includes establishing a Socket connection behavior;

[0259] The processing unit 602 is specifically used for:

[0260] When the type of the current behavior is a Socket connection establishment behavior, determining a server IP address and a server port corresponding to a Socket connection establishment method called to monitor the Socket connection establishment behavior;

[0261] According to the thread corresponding to the Socket connection establishment behavior, a call stack of the thread corresponding to the Socket connection establishment behavior is obtained, and according to the call stack of the thread corresponding to the Socket connection establishment behavior, a class name and a method name corresponding to the triggering of the Socket connection establishment behavior are determined;

[0262] Analyze the class name and method name corresponding to the behavior of triggering the establishment of the Socket connection, and identify the operation type of the behavior of establishing the Socket connection;

[0263] The operation type of the Socket connection establishment behavior is analyzed to determine whether the current behavior is normal.

[0264] Optionally, the processing unit 602 is specifically configured to:

[0265] If the operation type of the Socket connection establishment behavior is to access a database, then obtain the data source object that manages the database connection, obtain the server IP address and port of the actually connected database, or read the server IP address and port of the database to be accessed from a preset configuration file, and determine whether the server IP address and port of the database are consistent with the server IP address and server port of the Socket connection establishment method. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal;

[0266] If the operation type of the Socket connection establishment behavior is accessing a message queue server, determine from the configuration management database of the network access policy whether there is a network access policy for accessing the server IP address and server port of the Socket connection establishment method from the IP address of the server where the application corresponding to the Socket connection establishment behavior is located; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal;

[0267] If the operation type of establishing the Socket connection behavior is accessing TCP or HTTP services, the configuration file of the application corresponding to the establishing the Socket connection behavior is read, and based on the configuration file, it is determined from the configuration management database whether there is a network access policy corresponding to the establishing the Socket connection behavior; if so, it is determined that the current behavior is normal; otherwise, it is determined that the current behavior is not normal.

[0268] Optionally, the type of the current behavior includes a Socket connection acceptance behavior;

[0269] The processing unit 602 is specifically used for:

[0270] When the type of the current behavior is a Socket connection acceptance behavior, determining a client IP address and a server port corresponding to a Socket connection acceptance method called when monitoring the Socket connection acceptance behavior;

[0271] Obtain the server IP address where the application corresponding to the Socket connection acceptance behavior is located, and determine from the network access policy configuration management database whether there is a network access policy for the client IP address to access the server port corresponding to the server IP address; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal.

[0272] In the above technical solution, by analyzing the accepting Socket connection method called when monitoring the accepting Socket connection behavior, it is possible to identify whether the accepting Socket connection behavior is normal behavior.

[0273] Optionally, the processing unit 602 is further configured to:

[0274] Before obtaining the current behavior, obtain the configuration file for malicious behavior detection;

[0275] Obtaining the preset whitelist configuration information from the configuration file and storing it;

[0276] Initializing a dynamic update function of the preset whitelist and determining a preset processing class for processing malicious behavior;

[0277] A new security manager is created, a monitoring function of the security manager is configured according to the configuration file, and the security manager is registered in the Java virtual machine.

[0278] Based on the same technical concept, an embodiment of the present invention further provides a computing device, including:

[0279] A memory for storing program instructions;

[0280] The processor is used to call the program instructions stored in the memory and execute the above malicious behavior detection method according to the obtained program.

[0281] Based on the same technical concept, an embodiment of the present invention also provides a computer-readable non-volatile storage medium, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the above-mentioned malicious behavior detection method.

[0282] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0283] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0284] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0285] Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0286] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A malicious behavior detection method, characterized in that: include: Get the current behavior monitored by the registered security manager method, where the current behavior is a monitored behavior that conforms to a preset type; The types of the current behavior include creating a process behavior, listening to a port behavior, accepting a Socket connection behavior, and establishing a Socket connection behavior; When it is determined that the current behavior is not a behavior permitted by default, analyzing the current behavior according to the type of the current behavior, the call stack and the call parameters when the method registered by the security manager monitors the current behavior, and determining whether the current behavior is a normal behavior; If the current behavior is not a normal behavior, determine whether the current behavior matches a preset whitelist; if not, determine that the current behavior is a malicious behavior, and send the malicious behavior to a preset processing class for processing; Among them, registering a security manager includes: Obtaining a configuration file for malicious behavior detection, obtaining and storing configuration information of a preset whitelist from the configuration file; Initializing a dynamic update function of the preset whitelist and determining a preset processing class for processing malicious behavior; Create the security manager, configure the monitoring function of the security manager according to the configuration file, and register the security manager with the Java virtual machine.

2. The method according to claim 1, characterized in that The type of the current behavior includes a create process behavior; The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes: When the type of the current behavior is a create process behavior, determining a process path corresponding to a create process method called when monitoring the create process behavior; Obtaining the original code of the called process creation method, analyzing the original code of the called process creation method, and determining the specified process path; If the specified process path is consistent with the process path corresponding to the called process creation method, then the current behavior is determined to be a normal behavior; otherwise, the current behavior is determined to be not a normal behavior.

3. The method according to claim 2, characterized in that The obtaining of the original code of the called creation process method comprises: If the class corresponding to the create process behavior is a class file generated after the application is compiled, decompile the class file generated after the application is compiled to obtain the original code of the called create process method; If the class corresponding to the creation process behavior is a class file in a compressed package, determining whether there is a source code file in the compressed package, and if so, determining that the source code file is the original code of the called creation process method, otherwise after decompressing the compressed package, decompiling the class file in the compressed package to obtain the original code of the called creation process method; If the class corresponding to the creation process behavior is a class file generated by compiling a server page file, the original code of the called creation process method is generated using a preset Web middleware.

4. The method according to claim 1, characterized in that The type of the current behavior includes a listening port behavior; The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes: When the type of the current behavior is a listening port behavior, determining a detection listening method to be called when monitoring the listening port behavior, and obtaining the port that the listening port behavior listens to from the parameters of the detection listening method; According to the thread corresponding to the listening port behavior, a call stack of the thread corresponding to the listening port behavior is obtained, and according to the call stack, a class name and a method name corresponding to triggering the listening port behavior are determined, and the class name and the method name corresponding to triggering the listening port behavior are analyzed to determine a designated listening port; If the port monitored by the monitoring port behavior is consistent with the designated monitoring port, it is determined that the current behavior is a normal behavior; otherwise, it is determined that the current behavior is not a normal behavior.

5. The method according to claim 4, characterized in that The analyzing the class name and method name corresponding to the behavior of triggering the listening port to determine the designated listening port includes: Identify the class name and method name corresponding to the triggering of the listening port behavior. If it is identified that the listening port behavior belongs to the listening of the HTTP service port, read the configuration file of the current process to obtain the specified listening port, or obtain the system property of the current process to obtain the specified listening port; If it is identified that the port listening behavior belongs to the monitoring of the TCP port, the original code for calling the port listening method is obtained, and the port parameter is passed into the original code of the port listening method to obtain the specified port.

6. The method according to claim 1, characterized in that The type of the current behavior includes establishing a socket connection behavior; The step of analyzing the current behavior according to the type of the current behavior and the call stack and call parameters when the method registered by the security manager monitors the current behavior to determine whether the current behavior is a normal behavior includes: When the type of the current behavior is a Socket connection establishment behavior, determining a server IP address and a server port corresponding to a Socket connection establishment method called when monitoring the Socket connection establishment behavior; According to the thread corresponding to the Socket connection establishment behavior, a call stack of the thread corresponding to the Socket connection establishment behavior is obtained, and according to the call stack of the thread corresponding to the Socket connection establishment behavior, a class name and a method name corresponding to the triggering of the Socket connection establishment behavior are determined; Analyze the class name and method name corresponding to the behavior of triggering the establishment of the Socket connection, and identify the operation type of the behavior of establishing the Socket connection; The operation type of the Socket connection establishment behavior is analyzed to determine whether the current behavior is normal.

7. The method according to claim 6, characterized in that The analyzing the operation type of the Socket connection establishment behavior to determine whether the current behavior is a normal behavior includes: If the operation type of the Socket connection establishment behavior is to access a database, then obtain the data source object that manages the database connection, obtain the server IP address and port of the actually connected database, or read the server IP address and port of the database to be accessed from a preset configuration file, and determine whether the server IP address and port of the database are consistent with the server IP address and server port of the Socket connection establishment method. If so, determine that the current behavior is normal, otherwise determine that the current behavior is not normal; If the operation type of the Socket connection establishment behavior is accessing a message queue server, determine from the configuration management database of the network access policy whether there is a network access policy for accessing the server IP address and server port of the Socket connection establishment method from the IP address of the server where the application corresponding to the Socket connection establishment behavior is located; if so, determine that the current behavior is normal; otherwise, determine that the current behavior is not normal; If the operation type of establishing the Socket connection behavior is accessing TCP or HTTP services, the configuration file of the application corresponding to the establishing the Socket connection behavior is read, and based on the configuration file, it is determined from the configuration management database whether there is a network access policy corresponding to the establishing the Socket connection behavior; if so, it is determined that the current behavior is normal; otherwise, it is determined that the current behavior is not normal.

8. A malicious behavior detection device, characterized in that: include: An acquisition unit, used to acquire a current behavior monitored by a registered security manager method, wherein the current behavior is a monitored behavior that conforms to a preset type; the types of the current behavior include a process creation behavior, a port listening behavior, a socket connection acceptance behavior, and a socket connection establishment behavior; a processing unit, configured to, when determining that the current behavior is not a behavior permitted by default, analyze the current behavior according to the type of the current behavior, the call stack and the call parameters when the method registered by the security manager monitors the current behavior, and determine whether the current behavior is a normal behavior; If the current behavior is not a normal behavior, determine whether the current behavior matches a preset whitelist; if not, determine that the current behavior is a malicious behavior, and send the malicious behavior to a preset processing class for processing; The acquisition unit is specifically used to acquire a configuration file for malicious behavior detection, acquire configuration information of a preset whitelist from the configuration file and store it; initialize a dynamic update function of the preset whitelist, and determine a preset processing class for processing malicious behavior; Create the security manager, configure the monitoring function of the security manager according to the configuration file, and register the security manager with the Java virtual machine.

9. A computing device, characterized in that include: A memory for storing program instructions; A processor, configured to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 7 according to the obtained program.

10. A computer-readable non-volatile storage medium, characterized in that: The method comprises computer-readable instructions, and when a computer reads and executes the computer-readable instructions, the computer is caused to execute the method according to any one of claims 1 to 7.

Images