Java memory horse detection method, device, electronic device and storage medium

Abstract

The present invention provides a Java memory malware detection method, device, electronic device, and storage medium. The method comprises: obtaining a loaded class to be detected from a Java virtual machine; if the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein a sensitive class is any one of the following: a class, a filter, and a listener used by a server to receive requests; if the loaded class to be detected is a sensitive class, detecting whether a corresponding file exists on the server for the loaded class to be detected; if the corresponding file does not exist on the server for the loaded class to be detected, issuing an alarm message indicating that the loaded class to be detected is a Java memory malware. The present invention can effectively detect memory malware running in a Java virtual machine, overcomes the defect of the prior art that is unable to detect Java memory malware, and improves the accuracy of Java memory malware detection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a Java memory horse detection method, device, electronic device and storage medium. Background Art

[0002] Memory malware is a fileless attack technique that effectively evades detection by traditional security software. Fileless attacks can be remotely loaded and executed in system memory, reside in the registry, or abuse commonly used whitelisting tools. Fileless attack techniques grant attackers access to a system, enabling subsequent malicious activity. By manipulating vulnerabilities and exploiting programs, legitimate tools, macros, and scripts, attackers can compromise systems, elevate privileges, or spread malicious code laterally across a network. Furthermore, fileless attacks leave no trace after execution, making them difficult to detect and eliminate.

[0003] Existing memory malware detection methods determine whether a process contains a memory malware by determining whether the executable file corresponding to the process has a storage address within the target storage area. Java memory malware runs within a Java virtual machine process, which can find the storage address of the corresponding executable file within the target storage area. Therefore, existing memory malware detection methods cannot detect Java memory malware. Summary of the Invention

[0004] The present invention provides a Java memory horse detection method, device, electronic device and storage medium, which are used to solve the problem that existing memory horse detection methods cannot detect Java memory horses running on Java virtual machine processes, and improve the detection efficiency of memory horses for specific Java virtual machine processes.

[0005] The present invention provides a Java memory horse detection method, comprising:

[0006] Get the loaded class to be detected from the Java virtual machine;

[0007] In the case that the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0008] In the case that the loaded class to be detected is a sensitive class, detecting whether a corresponding file of the loaded class to be detected exists on the server;

[0009] In the case that the loaded class to be detected does not have a corresponding file on the server, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0010] According to a Java memory horse detection method provided by the present invention, after detecting whether a corresponding file of the loaded class to be detected exists on the server, the method further includes:

[0011] If a corresponding file of the loaded class to be detected exists on the server, detecting whether the file contains sensitive content;

[0012] In the case that the file contains sensitive content, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0013] According to a Java memory horse detection method provided by the present invention, after detecting whether the file contains sensitive content, the method further includes:

[0014] In the case that the file does not contain sensitive content, the loaded class to be detected is set as a trusted class, and the time when it is set as the trusted class is recorded.

[0015] According to a Java memory horse detection method provided by the present invention, after detecting whether the loaded class to be detected is a sensitive class, the method further includes:

[0016] When the loaded class to be detected is a non-sensitive class, the loaded class to be detected is set as a trusted class, and the time length value for which the loaded class to be detected is set as a trusted class is set to a first time length value less than a preset threshold.

[0017] According to a Java memory horse detection method provided by the present invention, after obtaining the loaded class to be detected from the Java virtual machine, the method further includes:

[0018] If the loaded class to be detected is a trusted class, detecting whether a time length value of the loaded class to be detected being set as a trusted class exceeds a preset threshold; wherein the time length value of the loaded class to be detected being set as a trusted class is obtained based on the current time and the time when the loaded class to be detected was set as a trusted class, or is a first time length value set previously;

[0019] In the case where the preset threshold is exceeded, the step of detecting whether a corresponding file of the loaded class to be detected exists on the server is executed again.

[0020] According to a Java memory horse detection method provided by the present invention, obtaining a loaded class to be detected from a Java virtual machine includes:

[0021] Use the Instrument feature to periodically obtain the loaded classes to be tested from the Java virtual machine.

[0022] According to a Java memory horse detection method provided by the present invention, detecting whether a corresponding file of the loaded class to be detected exists on the server includes:

[0023] Obtaining the class loader of the loaded class to be detected;

[0024] According to the class loader, it is traced back whether the loaded class to be detected has a corresponding file on the server.

[0025] The present invention also provides a Java memory horse detection device, comprising:

[0026] The loaded class acquisition module is used to obtain the loaded class to be detected from the Java virtual machine;

[0027] A sensitive class judgment module, configured to detect whether the loaded class to be detected is a sensitive class if the loaded class to be detected is an untrusted class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0028] A file judgment module is used to detect whether there is a corresponding file of the loaded class to be detected on the server when the loaded class to be detected is a sensitive class;

[0029] The alarm module is used to issue an alarm message that the loaded class to be detected is a Java memory horse when there is no corresponding file on the server for the loaded class to be detected.

[0030] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the Java memory horse detection method when executing the program.

[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements the steps of the Java memory horse detection method when executed by a processor.

[0032] The present invention also provides a computer program product, which includes computer executable instructions, and when the instructions are executed, are used to implement the steps of the Java memory horse detection method.

[0033] The Java memory horse detection method, device, electronic device and storage medium provided by the present invention obtain a loaded class to be detected from a Java virtual machine; when the loaded class to be detected is an untrusted class, detect whether the loaded class to be detected is a sensitive class; when the loaded class to be detected is a sensitive class, detect whether a corresponding file of the loaded class to be detected exists on a server; when the loaded class to be detected does not have a corresponding file on the server, issue an alarm message indicating that the loaded class to be detected is a Java memory horse; the present invention can effectively discover memory horses running in the Java virtual machine by performing memory horse detection on the loaded classes inside the Java virtual machine, overcomes the defect of the prior art that Java memory horses cannot be discovered, and improves the accuracy of Java memory horse detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 1 is a flow chart of the Java memory horse detection method provided by the present invention;

[0036] Figure 2 This is a schematic diagram of the technical solution flow of the Java memory horse detection method provided by the present invention;

[0037] Figure 3 It is a structural diagram of a Java memory horse detection method and device provided by the present invention;

[0038] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0039] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0040] The following combination Figures 1-4 The present invention describes a Java memory horse detection method, device, electronic device and storage medium.

[0041] Figure 1The flowchart of the Java memory horse detection method provided by the present invention is as follows: Figure 1 As shown, the Java memory horse detection method provided by the present invention includes:

[0042] Step 110: Obtain the loaded class to be detected from the Java virtual machine.

[0043] In this embodiment, the Java virtual machine is an abstract computer that is implemented by simulating various computer functions on an actual computer. When a Java program references or uses a class, it first needs to load that class. Class loading is accomplished by the Java virtual machine's class loading subsystem. Therefore, the Java virtual machine can obtain the currently loaded classes. These loaded classes are the classes currently being referenced or used, or the classes that will be referenced or used in the future.

[0044] The number of loaded classes to be tested obtained from the Java virtual machine is not limited and can be one or more. In this embodiment, the loaded classes obtained from the Java virtual machine can be stored in a list, that is, the loaded classes to be tested are stored in a loaded class list format. In subsequent steps, operations on each loaded class are performed one by one by traversing the list.

[0045] Step 120: If the loaded class to be detected is an untrusted class, detect whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests.

[0046] A trusted class refers to a class that has been determined to be free of security risks and can be trusted. Conversely, an untrusted class refers to a class that has not been determined to be trusted. In this embodiment, classes that have been determined to be trusted can be stored in a trusted class cache. If a loaded class to be tested is not included in the trusted class cache, the loaded class is considered to be an untrusted class.

[0047] For loaded classes that have been identified as untrusted, further determination is needed to determine whether they are sensitive classes. This can be determined by the class type.

[0048] Sensitive classes generally include three types: classes used by the server to receive requests, filters, and listeners.

[0049] Specifically, in Java, the sensitive class judgment logic is as follows:

[0050] 1. Implement the following interfaces, including javax.servlet.Filter, javax.servlet.Servlet, and javax.servlet.ServletRequestListener.

[0051] 2. Inherit or inherit the following classes, including javax.servlet.http.HttpServlet and org.springframework.web.servlet.handler.AbstractHandlerMapping.

[0052] 3. Use the following annotations, including org.springframework.stereotype.Controller, org.springframework.web.bind.annotation.RestController,

[0053] org.springframework.web.bind.annotation.RequestMapping, org.springframework.web.bind.annotation.GetMapping,

[0054] org.springframework.web.bind.annotation.PostMapping, org.springframework.web.bind.annotation.PatchMapping,

[0055] org.springframework.web.bind.annotation.PutMapping, org.springframework.web.bind.annotation.Mapping.

[0056] If the loaded class meets any of the above conditions, it is considered a sensitive class, otherwise it is a non-sensitive class.

[0057] Step 130: When the loaded class to be detected is a sensitive class, detect whether there is a corresponding file for the loaded class to be detected on the server.

[0058] In this embodiment, the characteristics of memory malware, such as its permanent memory residence and filelessness, are utilized to detect memory malware, thereby avoiding the problem that memory malware can be easily bypassed by monitoring points.

[0059] Memory Trojans are memory-resident and can be loaded and executed remotely in the system's memory, reside in the registry, or abuse commonly used whitelisted tools such as PowerShell, Windows Management Instrumentation (WMI), and PsExec. Furthermore, memory Trojans, also known as fileless Trojans, leave no trace after execution, making them difficult to detect and remove.

[0060] In this embodiment, if it is detected that the loaded class to be detected is a sensitive class, the process continues to detect whether there is a corresponding file on the server for the loaded class to be detected.

[0061] Step 140: When there is no corresponding file for the loaded class to be detected on the server, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0062] As mentioned in the previous steps, the class to be detected is a class that has been loaded into the Java virtual machine, and therefore can be determined to meet the condition of being resident in memory. In this step, if it is detected that the corresponding file of the loaded class to be detected does not exist on the server, then the class to be detected satisfies the memory horse characteristics of being resident in memory and having no file. In addition, the class to be detected has been identified as a sensitive class, so an alarm message can be sent to the outside world that the loaded class to be detected is a Java memory horse. The alarm message can be in various forms, such as text prompts, sound prompts, video prompts, etc., which are not limited in this embodiment.

[0063] Existing memory malware detection methods determine whether a process contains a memory malware by determining whether the executable file corresponding to the process has a storage address within the target storage area. Java memory malware runs on a Java virtual machine process, which can find the storage address of the corresponding executable file within the target storage area. Therefore, existing memory malware detection methods cannot detect Java memory malware.

[0064] The Java memory malware detection method provided by the present invention obtains a loaded class to be detected from a Java virtual machine; if the loaded class to be detected is an untrusted class, detects whether the loaded class to be detected is a sensitive class; if the loaded class to be detected is a sensitive class, detects whether a corresponding file for the loaded class to be detected exists on a server; if the corresponding file for the loaded class to be detected does not exist on the server, issues an alarm indicating that the loaded class to be detected is a Java memory malware. By performing memory malware detection on loaded classes within a Java virtual machine, the present invention can effectively detect memory malware running within the Java virtual machine, overcoming the drawback of existing technologies that are unable to detect Java memory malware and improving the accuracy of Java memory malware detection.

[0065] Based on any of the above embodiments, in this embodiment, after detecting whether a corresponding file of the loaded class to be detected exists on the server, the method further includes:

[0066] If a corresponding file of the loaded class to be detected exists on the server, detecting whether the file contains sensitive content;

[0067] In the case that the file contains sensitive content, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0068] With technological advancements, the characteristics of memory malware are constantly changing. After research, the applicant discovered that some Java memory malware also stores corresponding files on the server. Therefore, in this embodiment, if the loaded class to be detected is a sensitive class, the file contents of the corresponding file on the server for the loaded class are checked. If sensitive content is contained, the loaded class is considered to be a Java memory malware, and an alarm is issued.

[0069] In this embodiment, the sensitive content can be execution instructions, including methods for directly manipulating the operating system and sensitive methods within the business system. Direct operating system methods include writing files, deleting files, and linking to system library files, while sensitive methods within the business system include transferring funds, creating accounts, and changing passwords.

[0070] The Java memory horse detection method provided by the present invention detects whether the content of the corresponding file of the loaded class to be detected on the server contains sensitive content. If the file contains sensitive content, the corresponding class is considered to be a Java memory horse, thereby avoiding missed detection of Java memory horses, further expanding the detection range of Java memory horses, and improving the accuracy of Java memory horse detection.

[0071] Based on any of the above embodiments, in this embodiment, after detecting whether the file contains sensitive content, the method further includes:

[0072] In the case that the file does not contain sensitive content, the loaded class to be detected is set as a trusted class, and the time when it is set as the trusted class is recorded.

[0073] In this embodiment, the loaded class to be detected belongs to a sensitive class, that is, it belongs to one of the classes, filters or listeners used by the server to receive requests, and there is a corresponding file, and no sensitive content is detected in the corresponding file. At this time, the loaded class to be detected can be temporarily identified as a trusted class, such as saving the loaded class in a trusted class cache, and recording the time when it is set as a trusted class.

[0074] In network security practice, it has been observed that some memory-based malware may have corresponding files on the server during an attack, but no longer exist after the attack. This means that the fileless nature of memory-based malware is a phased phenomenon. Therefore, in this embodiment, a loaded class previously designated as sensitive is only temporarily designated as trusted, and the time at which it was designated as trusted is recorded. In other embodiments, the time at which it was designated as trusted can be used to determine whether the trusted class remains trusted.

[0075] The Java memory horse detection method provided by the present invention records the moment when the loaded class whose corresponding file does not contain sensitive content is set as a trusted class, providing data support for subsequent secondary detection. This not only reduces the risk of potential Java memory horse attacks on the system, but also optimizes and streamlines the detection process, further effectively improving the efficiency of detecting Java memory horse.

[0076] Based on any of the above embodiments, in this embodiment, after detecting whether the loaded class to be detected is a sensitive class, the method further includes:

[0077] When the loaded class to be detected is a non-sensitive class, the loaded class to be detected is set as a trusted class, and the time length value for which the loaded class to be detected is set as a trusted class is set to a first time length value less than a preset threshold.

[0078] In this embodiment, the loaded class to be tested is a non-sensitive class, meaning that the loaded class to be tested does not belong to any of the classes, filters, or listeners used by the server to receive requests. In this case, the loaded class to be tested is assumed to not contain Java memory caches. Therefore, the loaded class to be tested can be identified as a trusted class, such as by storing it in a trusted class cache.

[0079] Because this class is not a sensitive class and is therefore considered trustworthy, a first timeout value less than a preset threshold can be set for this class. The first timeout value is a fixed value that does not change over time. For example, the first timeout value can be set to 0, indicating a permanent timeout. In other embodiments, because the first timeout value is less than a preset threshold (typically a value greater than 0), this trustworthy class is always considered trustworthy and will not be retested for sensitive status.

[0080] The Java memory malware detection method provided by the present invention sets the time length value of the loaded class to be detected that is determined to be a non-sensitive class to a first time length value that is less than a preset threshold, so that it is always classified as a trusted class and never times out. This reduces the workload of secondary detection of the trusted class, optimizes the detection process, and greatly promotes the efficiency of detecting Java memory malware.

[0081] Based on any of the above embodiments, in this embodiment, after obtaining the loaded class to be detected from the Java virtual machine, the method further includes:

[0082] If the loaded class to be detected is a trusted class, detecting whether a time length value of the loaded class to be detected being set as a trusted class exceeds a preset threshold; wherein the time length value of the loaded class to be detected being set as a trusted class is obtained based on the current time and the time when the loaded class to be detected was set as a trusted class, or is a first time length value set previously;

[0083] In the case where the preset threshold is exceeded, the step of detecting whether a corresponding file of the loaded class to be detected exists on the server is executed again.

[0084] For some memory horses that have files during the attack but no files after the attack, in this embodiment, such situations can be discovered by setting the class that is judged to be sensitive and has corresponding files but does not contain sensitive content as a trusted class, and checking whether the time length value exceeds the preset threshold.

[0085] There are two types of time length values. One is that the time length value of the loaded class to be detected is set as the trusted class is the first time length value set in advance, which is a fixed value and is smaller than the preset threshold, that is, it never times out. This situation refers to the situation where the loaded class to be detected is judged to be a non-sensitive class and is set as a trusted class; the other is that the time length value of the loaded class to be detected is set as the trusted class: the current moment minus the moment when the loaded class to be detected is set as the trusted class. This situation refers to the situation where a class that is judged to be a sensitive class and has a corresponding file but the file content does not contain sensitive content is set as a trusted class.

[0086] For the case where a class that is determined to be a sensitive class and has a corresponding file but the file content does not contain sensitive content is set as a trusted class, the time length value of this class is variable, and the time length value continues to increase as the current time increases. When the preset threshold is exceeded, this class will be re-checked to see whether there is a corresponding file on the server. If there is no corresponding file, an alarm will be issued that the loaded class to be detected is a Java memory horse; if there is a corresponding file, the corresponding file will be further checked to see if it contains sensitive content. If it contains sensitive content, an alarm will be issued that the loaded class to be detected is a Java memory horse. Otherwise, the loaded class to be detected will be set as a trusted class again, and the time when it is set as a trusted class will be recorded.

[0087] Specifically, for a class that is determined to be a sensitive class and has a corresponding file, but the file content does not contain sensitive content and is set as a trusted class, assuming that the last time the class to be detected was set as a trusted class, the recorded time was 00:00:00, the current time is 00:00:05, and the preset threshold is 6 seconds, then the time length value of the loaded class to be detected at this time is 5 seconds, which does not exceed the preset threshold, and the program ends. Assuming that the current time is 00:00:07, the time length value of the loaded class to be detected at this time is 7 seconds, which exceeds the preset threshold of 6 seconds, and the above step 130 of detecting whether the loaded class to be detected has a corresponding file on the server and the subsequent procedures are re-executed.

[0088] The Java memory bug detection method provided by the present invention detects whether the time length value of the loaded class to be detected exceeds the preset threshold by setting a preset threshold, thereby reducing the detection frequency of the loaded class to be detected that is determined to be a sensitive class and set as a trusted class, and makes the trusted class of the non-sensitive class no longer subject to secondary detection, thereby reducing the workload of the entire detection process and effectively improving the efficiency of detecting Java memory bugs.

[0089] Based on any of the above embodiments, in this embodiment, the method of obtaining the loaded class to be detected from the Java virtual machine further includes:

[0090] Use the Instrument feature to periodically obtain the loaded classes to be tested from the Java virtual machine.

[0091] Instrument is the abbreviation of the java.lang.instrument package. The biggest function of the java.lang.instrument package is that it can attach (modify) bytecode to existing classes to implement enhanced logic.

[0092] In this embodiment, the Instrument feature is used to periodically retrieve the loaded classes to be tested from the Java virtual machine at a pre-set interval. This periodic retrieval ensures that dynamically changing loaded classes are always tested, ensuring that every newly loaded class is tested, thereby minimizing the risk of Java memory corruption within the Java virtual machine process.

[0093] The Java memory horse detection method provided by the present invention utilizes the Instrument feature to periodically obtain loaded classes to be detected from the Java virtual machine, thereby ensuring that all loaded classes can be detected for Java memory horses for the Java virtual machine process, further improving the efficiency of detecting Java memory horses.

[0094] Based on any of the above embodiments, in this embodiment, the method for detecting whether a corresponding file of the loaded class to be detected exists on the server further includes:

[0095] Obtaining the class loader of the loaded class to be detected;

[0096] According to the class loader, it is traced back whether the loaded class to be detected has a corresponding file on the server.

[0097] The class loader is responsible for loading all classes, generating a java.lang.Class instance object for all classes loaded into memory. In the Java virtual machine, a class is uniquely identified by its fully qualified class name and its class loader.

[0098] In this embodiment, the loaded class to be detected uses its fully qualified class name and its class loader as its unique identifier. By obtaining the class loader of the loaded class to be detected, the unique identifier of the loaded class to be detected can be obtained based on the class loader, and then based on the unique identifier, it can be traced back to see whether there is a corresponding file on the server for the loaded class to be detected.

[0099] The Java memory bug detection method provided by the present invention obtains the class loader of the loaded class to be detected, and then traces back whether the loaded class to be detected has a corresponding file on the server. Based on the unique identifier of the loaded class obtained by the class loader, it accurately identifies whether the loaded class has a corresponding file, thereby effectively improving the efficiency of detecting Java memory bugs.

[0100] The technical solution of the present invention is further described in detail below. Figure 2 This is a technical solution flow chart of the Java memory horse detection method provided by the present invention, combined with Figure 2 The complete technical solution is as follows:

[0101] 1. Using the Instrument feature, periodically obtain the loaded classes to be detected from the Java virtual machine, where the loaded classes are obtained in the form of a loaded class list.

[0102] 2. Traverse the list of loaded classes.

[0103] 3. Check whether the loaded class to be tested is included in the trusted class cache.

[0104] 4-1. If the loaded class to be detected is not included in the trusted class cache, further detection is performed to see if it has timed out. If it has timed out, further detection is performed to see if the corresponding file exists. If it has not timed out, the program ends.

[0105] 4-2. If the loaded class to be detected is included in the trusted class cache, it is further detected whether it is a sensitive class, where a sensitive class is any of the following: a class, a filter, and a listener used by the server to receive requests.

[0106] 5-1. If the loaded class to be detected is not a sensitive class, add it to the trusted class cache and set it to never time out, and the program ends.

[0107] 5-2. When the loaded class to be detected is a sensitive class, the class loader of the class is further obtained, its loaded file is traced back, and the corresponding file is detected to see whether it exists.

[0108] 6-1. When the corresponding file of the loaded class to be detected does not exist, an alarm message is issued indicating that the loaded class to be detected is a Java memory error, and the program ends.

[0109] 6-2. If the corresponding file of the loaded class to be detected exists, the content of the corresponding file is further checked to see if it contains sensitive content.

[0110] 7-1. When the content of the file corresponding to the loaded class to be detected contains sensitive content, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse, and the program ends.

[0111] 7-2. When the content of the corresponding file of the loaded class to be detected does not contain sensitive content, the loaded class to be detected is added to the trusted class cache, the current time is recorded, and the program ends.

[0112] The following describes a Java memory horse detection device provided by the present invention. The Java memory horse detection device described below and the Java memory horse detection method described above can be referenced to each other.

[0113] Figure 3 The structure diagram of the Java memory horse detection device provided by the present invention is as follows: Figure 3 As shown, the Java memory horse detection device provided by the present invention includes:

[0114] A loaded class acquisition module 310 is used to obtain a loaded class to be detected from a Java virtual machine;

[0115] The sensitive class determination module 320 is configured to detect whether the loaded class to be detected is a sensitive class if the loaded class to be detected is an untrusted class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0116] The file determination module 330 is configured to detect whether a corresponding file of the loaded class to be detected exists on the server when the loaded class to be detected is a sensitive class;

[0117] The alarm module 340 is used to issue an alarm message indicating that the loaded class to be detected is a Java memory horse when there is no corresponding file for the loaded class to be detected on the server.

[0118] The Java memory malware detection device provided by the present invention uses a loaded class acquisition module 310 to obtain a loaded class to be detected from a Java virtual machine. A sensitive class determination module 320 then detects whether the loaded class to be detected is a sensitive class. A file determination module 330 further detects whether a corresponding file exists on a server for the loaded class to be detected. Finally, an alarm module 340 issues an alarm indicating that the loaded class to be detected is a Java memory malware. By performing memory malware detection on loaded classes within a Java virtual machine, the present invention can effectively detect memory malware running within the Java virtual machine, overcoming the drawback of existing technologies that are unable to detect Java memory malware and improving the accuracy of Java memory malware detection.

[0119] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0120] A sensitive content detection module is used to detect whether the file contains sensitive content when a corresponding file of the loaded class to be detected exists on the server;

[0121] The alarm module is used to issue an alarm message that the loaded class to be detected is a Java memory horse when the file contains sensitive content.

[0122] The Java memory horse detection device provided by the present invention detects whether the content of the corresponding file of the loaded class to be detected on the server contains sensitive content through a sensitive content detection module. If the file contains sensitive content, the corresponding class is considered to be a Java memory horse, thereby avoiding missed detection of Java memory horses, further expanding the detection range of Java memory horses, and improving the accuracy of Java memory horse detection.

[0123] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0124] The recording time module is used to set the loaded class to be detected as a trusted class when the file does not contain sensitive content, and record the time when it is set as a trusted class.

[0125] The Java memory horse detection device provided by the present invention records the moment when the loaded class whose corresponding file does not contain sensitive content is set as a trusted class by the time module, providing data support for subsequent secondary detection. This not only reduces the risk of potential Java memory horse attacks on the system, but also optimizes and streamlines the detection process, further effectively improving the efficiency of detecting Java memory horse.

[0126] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0127] A non-sensitive class handling module is used to set the loaded class to be detected as a trusted class when the loaded class to be detected is a non-sensitive class, and to set the time length value during which the loaded class to be detected is set as a trusted class to a first time length value greater than a preset threshold.

[0128] The Java memory bug detection device provided by the present invention sets the time length value of the loaded class to be detected, which is determined to be a non-sensitive class, to a first time length value less than a preset threshold through the non-sensitive class disposal module, so that it is always classified as a trusted class and never times out, reducing the workload of secondary detection of the trusted class, optimizing the detection process, and greatly promoting the efficiency of detecting Java memory bugs.

[0129] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0130] A timeout detection module is used to detect whether the time length value of the loaded class to be detected being set as a trusted class exceeds a preset threshold value when the loaded class to be detected is a trusted class; wherein the time length value of the loaded class to be detected being set as a trusted class is obtained based on the current time and the time when the loaded class to be detected is set as a trusted class, or is a first time length value set in advance; when the preset threshold value is exceeded, the step of detecting whether there is a corresponding file for the loaded class to be detected on the server is re-executed.

[0131] In the Java memory bug detection device provided by the present invention, the timeout detection module detects whether the time length value of the loaded class to be detected exceeds the preset threshold by setting a preset threshold, thereby reducing the detection frequency of the loaded class to be detected that is determined to be a sensitive class and set as a trusted class, and makes the trusted class of the non-sensitive class no longer subject to secondary detection, reducing the workload of the entire detection process, and effectively improving the efficiency of detecting Java memory bugs.

[0132] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0133] The loaded class acquisition unit is used to periodically acquire the loaded class to be detected from the Java virtual machine using the Instrument feature.

[0134] The Java memory horse detection device provided by the present invention uses the Instrument feature through the loaded class acquisition unit to periodically obtain the loaded classes to be detected from the Java virtual machine, thereby ensuring that all loaded classes can be detected for Java memory horses for the Java virtual machine process, further improving the efficiency of detecting Java memory horses.

[0135] Based on any of the above embodiments, in this embodiment, according to a Java memory horse detection device provided by the present invention, the device further includes:

[0136] The file detection unit is used to obtain the class loader of the loaded class to be detected; and based on the class loader, backtrack whether the loaded class to be detected has a corresponding file on the server.

[0137] The Java memory bug detection device provided by the present invention obtains the class loader of the loaded class to be detected through a file detection unit, and then traces back whether the loaded class to be detected has a corresponding file on the server. Based on the unique identifier of the loaded class obtained by the class loader, it accurately identifies whether the loaded class has a corresponding file, thereby effectively improving the efficiency of detecting Java memory bugs.

[0138] On the other hand, the present invention also provides an electronic device, Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4 As shown, the electronic device may include a processor 410, a communication bus 440, a memory 430, a communication interface 420, and a computer program stored in the memory 430 and executable on the processor 410. The processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call logic instructions in the memory 430 to execute a Java memory horse detection method, which includes:

[0139] Get the loaded class to be detected from the Java virtual machine;

[0140] In the case that the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0141] In the case that the loaded class to be detected is a sensitive class, detecting whether a corresponding file of the loaded class to be detected exists on the server;

[0142] In the case that the loaded class to be detected does not have a corresponding file on the server, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0143] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, a Java memory horse detection method can be implemented. The method includes:

[0144] Get the loaded class to be detected from the Java virtual machine;

[0145] In the case that the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0146] In the case that the loaded class to be detected is a sensitive class, detecting whether a corresponding file of the loaded class to be detected exists on the server;

[0147] In the case that the loaded class to be detected does not have a corresponding file on the server, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0148] Finally, the present invention also provides a computer program product, comprising a computer program stored on a non-transitory computer-readable storage medium, wherein the computer program comprises program instructions. When the program instructions are executed by a computer, the computer is capable of implementing a Java memory horse detection method, the method comprising:

[0149] Get the loaded class to be detected from the Java virtual machine;

[0150] In the case that the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests;

[0151] In the case that the loaded class to be detected is a sensitive class, detecting whether a corresponding file of the loaded class to be detected exists on the server;

[0152] In the case that the loaded class to be detected does not have a corresponding file on the server, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

[0153] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0154] Through the above description of the embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a necessary general-purpose hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A Java memory horse detection method, characterized in that: include: Get the loaded class to be detected from the Java virtual machine; In the case that the loaded class to be detected is an untrusted class, detecting whether the loaded class to be detected is a sensitive class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests; In the case that the loaded class to be detected is a sensitive class, detecting whether a corresponding file of the loaded class to be detected exists on the server; In the case that the loaded class to be detected does not have a corresponding file on the server, issuing an alarm message indicating that the loaded class to be detected is a Java memory error; After detecting whether a corresponding file of the loaded class to be detected exists on the server, the method further includes: If a corresponding file of the loaded class to be detected exists on the server, detecting whether the file contains sensitive content; In the case that the file does not contain sensitive content, the loaded class to be detected is set as a trusted class, and the time when it is set as the trusted class is recorded.

2. The Java memory horse detection method according to claim 1, wherein: After detecting whether a corresponding file of the loaded class to be detected exists on the server, the method further includes: If a corresponding file of the loaded class to be detected exists on the server, detecting whether the file contains sensitive content; In the case that the file contains sensitive content, an alarm message is issued indicating that the loaded class to be detected is a Java memory horse.

3. The Java memory horse detection method according to claim 1, characterized in that: After detecting whether the loaded class to be detected is a sensitive class, the method further includes: When the loaded class to be detected is a non-sensitive class, the loaded class to be detected is set as a trusted class, and the time length value for which the loaded class to be detected is set as a trusted class is set to a first time length value less than a preset threshold.

4. The Java memory horse detection method according to claim 3, characterized in that: After obtaining the loaded class to be detected from the Java virtual machine, the method further includes: If the loaded class to be detected is a trusted class, detecting whether a time length value of the loaded class to be detected being set as a trusted class exceeds a preset threshold; wherein the time length value of the loaded class to be detected being set as a trusted class is obtained based on the current time and the time when the loaded class to be detected was set as a trusted class, or is a first time length value set previously; In the case where the preset threshold is exceeded, the step of detecting whether a corresponding file of the loaded class to be detected exists on the server is executed again.

5. The Java memory bug detection method according to any one of claims 1 to 4, characterized in that: The step of obtaining the loaded class to be detected from the Java virtual machine includes: Use the Instrument feature to periodically obtain the loaded classes to be tested from the Java virtual machine.

6. The Java memory bug detection method according to any one of claims 1 to 4, characterized in that: The detecting whether a corresponding file exists on the server for the loaded class to be detected includes: Obtaining the class loader of the loaded class to be detected; According to the class loader, it is traced back whether the loaded class to be detected has a corresponding file on the server.

7. A Java memory horse detection device, characterized in that: include: The loaded class acquisition module is used to obtain the loaded class to be detected from the Java virtual machine; A sensitive class judgment module, configured to detect whether the loaded class to be detected is a sensitive class if the loaded class to be detected is an untrusted class; wherein the sensitive class is any one of the following: a class, a filter, and a listener used by the server to receive requests; A file judgment module is used to detect whether there is a corresponding file of the loaded class to be detected on the server when the loaded class to be detected is a sensitive class; an alarm module, configured to issue an alarm message indicating that the loaded class to be detected is a Java memory error when no corresponding file exists on the server for the loaded class to be detected; A sensitive content detection module is used to detect whether the file contains sensitive content when a corresponding file of the loaded class to be detected exists on the server; The recording time module is used to set the loaded class to be detected as a trusted class when the file does not contain sensitive content, and record the time when it is set as a trusted class.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the Java memory horse detection method according to any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the Java memory horse detection method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising computer-executable instructions, characterized in that: When executed, the instructions are used to implement the steps of the Java memory horse detection method according to any one of claims 1 to 6.

Images