White Rule-Based Class Loading Protection Method and Device

Abstract

An embodiment of the present invention provides a class loading protection method and device based on white rules. Among them, the method includes: obtaining the stack of the target thread through the first monitoring point, scanning the stack to determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculating the bytecode feature code of the file corresponding to the file path through the file path corresponding to the target thread provided by the first monitoring point, and matching the bytecode feature code with the whitelist to obtain a first matching result, where the whitelist includes the bytecode feature code and the class name of the legally loaded class; obtaining the class name of the class loaded by the target thread through the second monitoring point, and matching the class name with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading the class is continued. This method realizes effective protection against unknown vulnerabilities.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular, to a class loading protection method and device based on white rules. Background Art

[0002] Script attacks based on Java need to run malicious scripts in a Java Virtual Machine (JVM). Class loading is a necessary prerequisite for Java scripts to be executed by the JVM. Most of the security of existing Java-based servers is monitored through blacklists. For example, Baidu's OpenRASP monitors nodes that are vulnerable to attacks in common frameworks, that is, blacklist matching and warning are performed on commonly used attack classes by hackers. This black-rule-based interception method can only protect against previously appeared vulnerabilities. Summary of the Invention

[0003] In view of the problems in the prior art, embodiments of the present invention provide a class loading protection method and device based on white rules.

[0004] Specifically, embodiments of the present invention provide the following technical solutions:

[0005] In a first aspect, an embodiment of the present invention provides a class loading protection method based on white rules, including: obtaining a stack of a target thread through a first monitoring point, scanning the stack to determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculating a bytecode signature of a file corresponding to the file path provided by the first monitoring point for the target thread, matching the bytecode signature with a white list, and obtaining a first matching result, where the white list includes the bytecode signature and class names of legally loaded classes; obtaining the class name of the loaded class of the target thread through a second monitoring point, matching the class name with the white list, and obtaining a second matching result; if the first matching result and / or the second matching result is a failure, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading the class is continued.

[0006] Further, before obtaining the stack of the target thread through the first monitoring point, scanning the stack to determine whether the target thread has an operation of loading a class, it further includes: scanning the deployed middleware and deployed code through a static collection module to obtain class names of legally loaded classes and bytecode signatures corresponding thereto, and recording the class names of the legally loaded classes and the bytecode signatures in the white list.

[0007] Further, the scanning of the deployed middleware and deployed code by the static collection module includes: parsing the bytecode files in the deployed middleware and deployed code through a bytecode parsing framework.

[0008] Further, the first monitoring point includes the checkRead method of the SecurityManager class, and obtaining the stack of the target thread through the first monitoring point, and scanning the stack to determine whether the target thread has an operation of loading a class, including: obtaining the stack of the target thread through the checkRead method of the SecurityManager class, traversing and detecting the stack, if a subclass of ClassLoader is detected, it is determined that the target thread has an operation of loading a class, otherwise, it is determined that the target thread does not have an operation of loading a class.

[0009] Further, the second monitoring point includes the transform method of the Instrumentation class, and obtaining the class name of the class to be loaded by the target thread through the second monitoring point, including: obtaining the class name of the class to be loaded by the target thread through the transform method of the Instrumentation class.

[0010] Further, after generating the alarm information, it further includes: sending the alarm information and / or storing the alarm information, where the alarm information includes the file path, file content, file loading time, class name of the attack class, the class loader that loads the attack class, and the stack information at the time of loading.

[0011] In a second aspect, an embodiment of the present invention further provides a class loading protection device based on white rules, including: a first processing module, configured to obtain the stack of the target thread through the first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class; a second processing module, configured to, if there is an operation of loading a class, calculate the bytecode feature code of the file corresponding to the file path provided by the first monitoring point for the target thread, match the bytecode feature code with the white list to obtain a first matching result, where the white list includes the bytecode feature code and the class names of legal loaded classes; a third processing module, configured to obtain the class name of the loaded class of the target thread through the second monitoring point, match the class name with the white list to obtain a second matching result; if the first matching result and / or the second matching result is a matching failure, the target thread is a thread of an attack script, and an alarm information is generated; otherwise, the class loading operation is continued.

[0012] In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the white-rule-based class loading protection method described in the first aspect are implemented.

[0013] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the white-rule-based class loading protection method described in the first aspect are implemented.

[0014] In a fifth aspect, an embodiment of the present invention further provides a computer program product, on which executable instructions are stored. When the instructions are executed by a processor, the processor is caused to implement the steps of the white-rule-based class loading protection described in the first aspect.

[0015] The white-rule-based class loading protection method and device provided by the embodiments of the present invention obtain the stack of a target thread through a first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculate the bytecode signature of the file corresponding to the file path provided by the first monitoring point for the target thread, match the bytecode signature with a whitelist, and obtain a first matching result. The whitelist includes the bytecode signature and the class names of legally loaded classes; obtain the class name of the loaded class of the target thread through a second monitoring point, and match the class name with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, then the target thread is a thread of an attack script, and an alarm message is generated; otherwise, continue to execute the operation of loading the class. It can be seen that for scripts that require class loading, through the interception method of matching the class name and the bytecode signature with the whitelist respectively, it is possible to effectively protect against unknown vulnerabilities, alarm the class names and bytecode signatures not in the whitelist, and malicious scripts can be effectively discovered through this protection means. Description of the Drawings

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0017] Figure 1 It is a flowchart of an embodiment of the white-rule-based class loading protection method of the present invention;

[0018] Figure 2 It is a flowchart of an embodiment of the method for constructing a whitelist of the present invention;

[0019] Figure 3 Flowcharts of other embodiments of the class loading protection method based on white rules of the present invention;

[0020] Figure 4 Schematic diagram of the application scenario of the class loading protection method based on white rules of the present invention;

[0021] Figure 5 Schematic structural diagram of an embodiment of the class loading protection device based on white rules of the present invention;

[0022] Figure 6 Schematic structural diagram of an embodiment of the electronic device entity of the present invention. Detailed implementation manners

[0023] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0024] Figure 1 Flowchart of an embodiment of the class loading protection method based on white rules of the present invention. As Figure 1 shown, the class loading protection method based on white rules in the embodiment of the present invention includes:

[0025] S101, obtain the stack of the target thread through the first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class.

[0026] In some embodiments, the script corresponding to the target thread may be a Java script or other scripts that require class loading operations. The Java script needs to run in the JVM, and class loading is a necessary prerequisite for the Java script to be executed by the JVM. When a class is loaded, the first monitoring point is triggered, and the stack of the target thread is obtained through the first monitoring point. Among them, the present invention does not limit the scanning method.

[0027] S102, if there is an operation of loading a class, calculate the bytecode feature code of the file corresponding to the file path provided by the first monitoring point for the target thread, match the bytecode feature code with the whitelist, and obtain a first matching result. The whitelist includes the bytecode feature code and the class name of the legally loaded class.

[0028] In some embodiments, the file path corresponds to the path of the script to be run. Before the file is loaded, the file path needs to be determined first, and the file path corresponding to the target thread can be obtained through the first monitoring point. The file corresponding to the file path can be a file written in the Java language. A significant difference between Java and C languages is that C is not cross-platform. After C is compiled, it becomes the assembly instructions corresponding to the CPU, and the assembly instructions of different operating systems are different, so it cannot be cross-platform. After Java is compiled, it is bytecode, and the bytecode needs to be run through the JVM. The Java virtual machines of different operating systems are customized. Therefore, for different operating systems, the JVM will translate the bytecode in the same format into the assembly instructions of the corresponding operating system for running. So the JVM is not cross-platform either. Although the JVM is not cross-platform, Java code can run cross-platform. The biggest reason for Java to be cross-platform is that it is compiled into bytecode, thus achieving the feature of "compile once, run everywhere". Therefore, the file can be found according to the file path, and the bytecode feature code of the corresponding file can be calculated according to the file content. The algorithm for calculating the bytecode feature code can be md5 or hash, etc. As an example, the first matching result can be "bytecode feature code mismatch" or "bytecode feature code match". The present invention does not limit the calculation method of the bytecode feature code. The present invention does not limit the expression form of the matching result.

[0029] S103, obtain the class name of the loaded class of the target thread through the second monitoring point, match the class name with the whitelist, and obtain the second matching result.

[0030] As an example, the second matching result can be "class name match" or "class name mismatch", etc.

[0031] S104, if the first matching result and / or the second matching result is a match failure, the target thread is the thread of the attack script, and an alarm message is generated; otherwise, continue to execute the operation of loading the class.

[0032] As an example, the first matching result can be "bytecode feature code mismatch", and the second matching result can be "class name match". Then, because the first matching result is a match failure, the target thread is the thread of the attack script, an alarm message is generated, and the operation of loading the class can also be blocked while generating the alarm message.

[0033] The class loading protection method based on white rules provided by the embodiments of the present invention obtains the stack of the target thread through the first monitoring point, scans the stack, and determines whether the target thread has an operation of loading a class; if there is an operation of loading a class, the bytecode signature of the file corresponding to the file path is calculated through the file path corresponding to the target thread provided by the first monitoring point, and the bytecode signature is matched with the whitelist to obtain a first matching result. The whitelist includes the bytecode signature and the class name of the loaded class; the class name of the class loaded by the target thread is obtained through the second monitoring point, and the class name is matched with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading the class is continued. It can be seen that for scripts that require class loading, through the interception method of matching the class name and bytecode signature with the whitelist respectively, it is possible to effectively protect against unknown vulnerabilities, alarm for class names and bytecode signatures not in the whitelist, and effectively detect malicious scripts through this protection means, and it can also be used to ensure the security of servers developed based on Java.

[0034] Figure 2 This is a flowchart of an embodiment of the method for constructing a whitelist of the present invention. As Figure 2 shown, the method for constructing a whitelist according to the embodiments of the present invention includes:

[0035] S201, scan the deployed middleware and deployed code through a static collection module to obtain the class names and bytecode signatures of the corresponding legitimate loaded classes.

[0036] In some embodiments, the static collection module can be an existing tool or a tool developed or integrated as needed. The deployed middleware is an independent system software or service program, and distributed application software shares resources between different technologies with the help of this software. The middleware is located above the operating system of the client / server, manages computer resources and network communication. It is software that connects two independent application programs or independent systems. The connected systems can still exchange information with each other through the middleware even if they have different interfaces. A key way to execute the middleware is information transfer. Through the middleware, application programs can work on multiple platforms or OS environments. The deployed code refers to the source code of a certain application. The bytecode signature can be the bytecode file encrypted by the Message-Digest Algorithm 5 (abbreviated as md5) or hash. After scanning the deployed middleware and deployed code, the classes and bytecode files that need to be loaded during the execution of the application are obtained, that is, the class names and bytecode signatures are obtained.

[0037] S202, record the class names and bytecode signatures of the legitimate loaded classes in the whitelist.

[0038] In some embodiments, by way of example, the whitelist can also be directly loaded into memory, or it can be loaded into memory when in use. By way of example, the whitelist can be in the.xml file format, and the content of the whitelist can refer to the code.

[0039] <?xml version="1.0" encoding="utf-8"? <white>

[0040] <classes>

[0041] <class>

[0042] <isSelfClass val="true" / >

[0043] <path

[0044] val="D:\DynamicStaticClass\attach.jar!\com\qianxin\runtime\AttachConfig.class" / >

[0045] / / Class name

[0046] <superClass val="java.lang.Object" / >

[0047] <name val="com.qianxin.runtime.AttachConfig" / >

[0048] / / Bytecode feature code

[0049] <md5 val="1538f21b87ebf1d9ba1982c7d67ca237" / >

[0050] < / class>

[0051] <class>

[0052] <isSelfClass val="true" / >

[0053] <pathval="D:\DynamicStaticClass\attach.jar!\com\qianxin\runtime\Command.class" / >

[0054] / / Class name

[0055] <superClass val="java.lang.Object" / >

[0056] <name val="com.qianxin.runtime.Command" / >

[0057] / / Bytecode feature code

[0058] <md5 val="64739e167ce9b3075379338d0878728d" / >

[0059] < / class>

[0060] < / classes>

[0061] <summary>

[0062] <total val="112920" / >

[0063] <createdAt val="2021-07-21 10:54:44" / >

[0064] < / summary>

[0065] < / white>

[0066] In some alternative implementation manners, the deployment middleware and the deployment code are scanned by a static collection module, including: parsing the bytecode files in the deployment middleware and the deployment code through a bytecode parsing framework. By way of example, a bytecode parsing framework such as Javaassist can be used to parse all the bytecode files in the deployment middleware and the deployment code, and obtain their class names and corresponding bytecode feature codes.

[0067] The method for constructing a whitelist provided by the embodiments of the present invention scans the deployment middleware and the deployment code through a static collection module, obtains the corresponding class names and bytecode feature codes, and records the class names and bytecode feature codes in the whitelist, so that the whitelist can be established before a certain application is used.

[0068] Figure 3 It is a flowchart of some other embodiments of the class loading protection method based on white rules of the present invention. As Figure 3 shown, the class loading protection method based on white rules of the embodiments of the present invention includes:

[0069] S301, obtain the stack of the target thread through the checkRead method of the SecurityManager class, traverse and detect the stack. If a subclass of ClassLoader is detected, it is determined that the target thread has an operation of loading a class; otherwise, it is determined that the target thread does not have an operation of loading a class.

[0070] In some embodiments, the checkRead method of the SecurityManager class can also analyze and detect read errors of the selected file; can analyze and detect read errors of all files collected on the drive / partition; can check the integrity of the file by comparing MD5 algorithm hashes; and can also recover and copy partially unreadable files. The JVM itself contains a Classloader class loader, which is a loader used to load Java classes into the Java virtual machine.

[0071] S302. If there is an operation to load a class, calculate the bytecode signature of the file corresponding to the file path provided by the first monitoring point for the corresponding target thread, and match the bytecode signature with the whitelist to obtain a first matching result. The whitelist includes the bytecode signature and the class names of legal loaded classes.

[0072] In some embodiments, the first monitoring point includes the checkRead method of the SecurityManager class. Therefore, if there is an operation to load a class, the bytecode signature of the file corresponding to the file path provided by the checkRead method of the SecurityManager class for the corresponding target thread can be calculated.

[0073] S303. Obtain the class name of the loaded class of the target thread through the transform method of the Instrumentation class, and match the class name with the whitelist to obtain a second matching result.

[0074] In some embodiments, when the file corresponding to the file path is loaded, the file content will be loaded in the form of a data stream. At this time, the second monitoring point can also calculate the bytecode signature according to the data stream, and match the bytecode signature and the monitored class name with the whitelist to improve the accuracy of malicious script detection. Among them, the second monitoring point can also be the transform method of the Instrumentation class. That is, obtain the class name of the class to be loaded by the target thread and the bytecode signature of the loaded data stream through the transform method of the Instrumentation class, and match the class name and the bytecode signature with the whitelist respectively to obtain a second matching result. As an example, the second matching result can be "the class name and / or the bytecode signature match successfully".

[0075] S304. If the first matching result and / or the second matching result is a match failure, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, continue to execute the operation of loading the class.

[0076] In some alternative implementation manners, after generating the alarm message, it may further include: sending the alarm message and / or storing the alarm message. The alarm message includes at least one of the following: the file path of the attack script, the file content, the file loading time, the class name of the attack class, the class loader for loading the attack class, and the stack information at the time of loading.

[0077] As an example, the file path may be C:\Users\Administrator\Desktop\apache-tomcat-8.5.61\apache-tomcat-8.5.61\webapps\shiro\index.jsp;

[0078] The content of the file can be any content, and the present invention does not limit this;

[0079] The loading time can be Mon Mar 01 21:02:50 CST 2021;

[0080] The loaded class can be index_jsp.class;

[0081] The class loader can be java.lang.AppClassLoader;

[0082] The stack information can be java.lang.Thread.run->org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run->

[0083] java.util.concurrent.ThreadPoolExecutor$Worker.run->

[0084] java.util.concurrent.ThreadPoolExecutor.runWorker->

[0085] org.apache.tomcat.util.net.SocketProcessorBase.run->

[0086] org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun->

[0087] org.apache.coyote.AbstractProtocol$ConnectionHandler.process->

[0088] org.apache.coyote.AbstractProcessorLight.process->

[0089] org.apache.coyote.http11.Http11Processor.service->

[0090] org.apache.catalina.connector.CoyoteAdapter.service->

[0091] org.apache.catalina.connector.CoyoteAdapter.postParseRequest->

[0092] org.apache.catalina.mapper.Mapper.map->

[0093] org.apache.catalina.mapper.Mapper.internalMap->

[0094] org.apache.catalina.mapper.Mapper.internalMapWrapper->

[0095] org.apache.catalina.webresources.StandardRoot.getResource->

[0096] org.apache.catalina.webresources.StandardRoot.getResource->

[0097] org.apache.catalina.webresources.Cache.getResource->

[0098] org.apache.catalina.webresources.CachedResource.validateResource->

[0099] org.apache.catalina.webresources.StandardRoot.getResourceInternal->

[0100] org.apache.catalina.webresources.DirResourceSet.getResource->

[0101] org.apache.catalina.webresources.AbstractFileResourceSet.file->

[0102] java.io.File.getCanonicalPath->java.io.Win32FileSystem.canonicalize->

[0103] java.io.File.exists ->

[0104] The method for class loading protection based on white rules provided by the embodiments of the present invention determines the bytecode signature of the corresponding target thread and the class name of the class to be loaded by the target thread through the checkRead method of the SecurityManager class and the transform method of the Instrumentation class. After determining that the bytecode signature and / or class name are not in the whitelist, the generated alarm information is sent and / or stored, thereby effectively protecting against unknown vulnerabilities.

[0105] As an example, Figure 4 In an application scenario shown, a static collection module is used to scan the middleware and source code to obtain a whitelist. The whitelist is loaded into the dynamic alarm module, and the dynamic alarm module matches the obtained class name and bytecode signature with the whitelist. If the match fails, the alarm information is written, and the alarm information can also be sent to the client or saved locally.

[0106] Figure 5 This is a schematic structural diagram of an embodiment of the class loading protection device based on white rules of the present invention. As Figure 5 shown, the class loading protection device based on white rules includes:

[0107] The first processing module 501 is used to obtain the stack of the target thread through the first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class;

[0108] The second processing module 502 is used to, if there is an operation of loading a class, calculate the bytecode signature of the file corresponding to the file path provided by the first monitoring point for the target thread, match the bytecode signature with the whitelist, and obtain a first matching result. The whitelist includes the bytecode signature and the class name of the legally loaded class;

[0109] The third processing module 503 is used to obtain the class name of the class loaded by the target thread through the second monitoring point, match the class name with the whitelist, and obtain a second matching result; if the first matching result and / or the second matching result is a match failure, the target thread is a thread of an attack script, and alarm information is generated; otherwise, the class loading operation continues.

[0110] Optionally, the device further includes:

[0111] The fourth processing module is used to scan the deployed middleware and deployed code through the static collection module to obtain the class name and bytecode signature of the corresponding legally loaded class, and record the class name and bytecode signature of the legally loaded class in the whitelist.

[0112] Optionally, the fourth processing module includes:

[0113] A parsing unit for parsing bytecode files in the deployment middleware and deployment code through a bytecode parsing framework.

[0114] Optionally, the first monitoring point includes the checkRead method of the SecurityManager class, and the first processing module 501 includes:

[0115] A detection unit for obtaining the stack of the target thread through the checkRead method of the SecurityManager class, traversing and detecting the stack. If a subclass of ClassLoader is detected, it is determined that the target thread has an operation of loading a class; otherwise, it is determined that the target thread does not have an operation of loading a class.

[0116] Optionally, the second monitoring point includes the transform method of the Instrumentation class, and the third processing module 503 includes:

[0117] A class name obtaining unit for obtaining the class name of the class to be loaded by the target thread through the transform method of the Instrumentation class.

[0118] Optionally, the device further includes:

[0119] An alarm information sending module for sending alarm information and / or storing alarm information. The alarm information includes at least one of the following: the file path of the attack script, the file content, the file loading time, the class name of the attack class, the class loader for loading the attack class, and the stack information at the time of loading.

[0120] For example:

[0121] Figure 6 An example of the entity structure diagram of an electronic device is shown as Figure 6As shown, the electronic device may include: a processor 601, a communications interface 602, a memory 603, and a communication bus 604. Among them, the processor 601, the communications interface 602, and the memory 603 complete communication with each other through the communication bus 604. The processor 601 may call the logical instructions in the memory 603 to execute the following method: obtain the stack of the target thread through the first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculate the bytecode signature of the file corresponding to the file path provided by the first monitoring point for the corresponding target thread, match the bytecode signature with the whitelist to obtain a first matching result, and the whitelist includes the bytecode signature and the class names of legally loaded classes; obtain the class name of the class loaded by the target thread through the second monitoring point, match the class name with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a match failure, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, continue to execute the operation of loading the class.

[0122] In addition, when the logical instructions in the above-mentioned memory 603 can be implemented in the form of software functional units and sold or used as an independent product, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0123] On the other hand, an embodiment of the present invention further provides a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer is capable of executing the white-rule-based class loading protection method provided in the above embodiments. For example, it includes: obtaining the stack of a target thread through a first monitoring point, scanning the stack to determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculating the bytecode signature of the file corresponding to the file path through the file path corresponding to the target thread provided by the first monitoring point, matching the bytecode signature with a whitelist to obtain a first matching result, the whitelist including the bytecode signature and the class names of legally loaded classes; obtaining the class name of the class loaded by the target thread through a second monitoring point, matching the class name with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading the class is continued.

[0124] In another aspect, the present invention further provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the white-rule-based class loading protection method provided in the above embodiments. For example, it includes: obtaining the stack of a target thread through a first monitoring point, scanning the stack to determine whether the target thread has an operation of loading a class; if there is an operation of loading a class, calculating the bytecode signature of the file corresponding to the file path through the file path corresponding to the target thread provided by the first monitoring point, matching the bytecode signature with a whitelist to obtain a first matching result, the whitelist including the bytecode signature and the class names of legally loaded classes; obtaining the class name of the class loaded by the target thread through a second monitoring point, matching the class name with the whitelist to obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading the class is continued.

[0125] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. A person of ordinary skill in the art can understand and implement it without creative labor.

[0126] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of each embodiment of the present invention.

Claims

1. A class loading protection method based on white rules, characterized in that, The method includes: Obtaining the stack of the target thread through a first monitoring point, scanning the stack, and determining whether the target thread has an operation of loading a class; the first monitoring point is triggered when a class is loaded; If there is an operation of loading a class, calculating the bytecode signature of the file corresponding to the file path provided by the first monitoring point for the target thread, and matching the bytecode signature with a whitelist to obtain a first matching result, where the whitelist includes the bytecode signature and the class names of legally loaded classes; Obtaining the class name of the loaded class of the target thread through a second monitoring point, and matching the class name with the whitelist to obtain a second matching result; If the first matching result and / or the second matching result is a match failure, the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the operation of loading a class continues to be executed; The first monitoring point includes the checkRead method of the SecurityManager class, and The obtaining the stack of the target thread through the first monitoring point, scanning the stack, and determining whether the target thread has an operation of loading a class includes: Obtaining the stack of the target thread through the checkRead method of the SecurityManager class, and performing a traversal detection on the stack.

2. The class loading protection method based on white rules according to claim 1, characterized in that Before the obtaining the stack of the target thread through the first monitoring point, scanning the stack, and determining whether the target thread has an operation of loading a class, it further includes: Scanning the deployed middleware and deployed code through a static collection module to obtain the class names and bytecode signatures of the corresponding legally loaded classes, and recording the class names of the legally loaded classes and the bytecode signatures in the whitelist.

3. The class loading protection method based on the white rule according to claim 2, wherein The scanning the deployed middleware and deployed code through the static collection module includes: Parsing the bytecode files in the deployed middleware and deployed code through a bytecode parsing framework.

4. The class loading protection method based on white rules according to claim 1, characterized in that, The obtaining the stack of the target thread through the first monitoring point, scanning the stack, and determining whether the target thread has an operation of loading a class includes: If a subclass of ClassLoader is detected, it is determined that the target thread has an operation of loading a class; otherwise, it is determined that the target thread does not have an operation of loading a class.

5. The class loading protection method based on white rules according to claim 1, characterized in that, The second monitoring point includes the transform method of the Instrumentation class, and The obtaining the class name of the loaded class of the target thread through the second monitoring point includes: Obtaining the class name of the loaded class of the target thread through the transform method of the Instrumentation class.

6. The class loading protection method based on white rules according to claim 1, wherein, After the generating the alarm message, it further includes: Sending the alarm message and / or storing the alarm message, where the alarm message includes at least one of the following: the file path of the attack script, the file content, the file loading time, the class name of the attack class, the class loader that loads the attack class, and the stack information at the time of loading.

7. A class loading protection device based on white rules, characterized in that, The device includes: The first processing module is used to obtain the stack of the target thread through the first monitoring point, scan the stack, and determine whether the target thread has an operation of loading a class; the first monitoring point is triggered when a class is loaded; The second processing module is used to, if there is an operation of loading a class, calculate the bytecode feature code of the file corresponding to the file path provided by the first monitoring point for the target thread, match the bytecode feature code with the whitelist, and obtain a first matching result, where the whitelist includes the bytecode feature code and the class names of legally loaded classes; The third processing module is used to obtain the class name of the loaded class of the target thread through the second monitoring point, match the class name with the whitelist, and obtain a second matching result; if the first matching result and / or the second matching result is a failure to match, then the target thread is a thread of an attack script, and an alarm message is generated; otherwise, the class loading operation is continued; The first monitoring point includes the checkRead method of the SecurityManager class, and The first processing module is specifically used to obtain the stack of the target thread through the checkRead method of the SecurityManager class and perform a traversal detection on the stack.

8. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, the steps of the white-rule-based class loading protection method according to any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of the white-rule-based class loading protection method according to any one of claims 1 to 6 are implemented.

10. A computer program product having executable instructions stored thereon, characterized in that, When the instruction is executed by the processor, the processor is caused to implement the steps of the white-rule-based class loading protection method according to any one of claims 1 to 6.

Images