Method and device for protecting against java malicious command execution

Abstract

The embodiment of the present application provides a kind of Java malicious command execution protection method and device, Java virtual machine executes the command issued by target program, and triggers monitoring point to monitor target program;Monitoring point obtains the execution thread of the command issued by target program, and detects the stack of execution thread, obtains the category of the execution code of command;If the category of execution code does not exist on the preset whitelist, monitoring point issues alarm through dynamic alarm module.In Java virtual machine, a small number of monitoring points are set to monitor target program, reduce Java virtual machine performance loss;By judging the category of execution code is not on the preset whitelist, unknown vulnerabilities can be protected.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and device for protecting against execution of malicious Java commands. Background Art

[0002] Java script attacks can execute arbitrary commands on the operating system, causing great harm.

[0003] Currently, the protection method for Java malicious command execution mainly sets monitoring points for common vulnerabilities, obtains the code that executes the command, matches the code that executes the command with black rules, and issues alarms for the code that hits the black rules.

[0004] Black rule matching can only protect against known vulnerabilities, and the large number of monitoring points affects performance. Summary of the Invention

[0005] In response to the problems in the prior art, embodiments of the present invention provide a method and device for protecting against the execution of malicious Java commands.

[0006] Specifically, the embodiments of the present invention provide the following technical solutions:

[0007] In the first aspect, an embodiment of the present invention provides a method for protecting against the execution of malicious Java commands, comprising: a Java virtual machine executes a command issued by a target program, and triggers a monitoring point to monitor the target program; the monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command; if the category of the execution code does not exist on a preset whitelist, the monitoring point issues an alarm through a dynamic alarm module.

[0008] Furthermore, before executing the command issued by the target program and triggering the monitoring point to monitor the target program, it also includes: a static collection module scanning the deployment code of the target program to determine whether the deployment code is a business code; if the deployment code is the business code, the category of the business code is recorded to obtain the preset whitelist.

[0009] Furthermore, the deployment code includes: source code and middleware code, and the determination of whether the deployment code is a business code includes: parsing the source code and middleware code in the deployment code to obtain the parsed deployment code; and determining whether the deployment code is the business code based on the parsed deployment code.

[0010] Furthermore, judging whether the deployment code is the business code based on the parsed deployment code includes: matching the parsed deployment code with the business code in the business code library; if the match is successful, determining that the parsed deployment code is the business code.

[0011] Furthermore, the monitoring point obtains the execution thread of the command issued by the target program, detects the stack of the execution thread, and obtains the category of the execution code of the command, and further includes: the monitoring point loads the preset whitelist.

[0012] In the second aspect, an embodiment of the present invention also provides a protection device for the execution of Java malicious commands, including: a monitoring module, which is used for the Java virtual machine to execute the command of the target program and trigger the monitoring point to monitor the target program; a detection module, which is used for the monitoring point to obtain the execution thread of the command issued by the target program, and detect the stack of the execution thread to obtain the category of the execution code of the command; and an alarm module, which is used for the monitoring point to issue an alarm through a dynamic alarm module if the category of the execution code does not exist on the preset whitelist.

[0013] Furthermore, the protection device also includes: a judgment module, which is used for the static collection module to scan the deployment code of the target program to determine whether the deployment code is a business code; and a generation module, which is used for recording the category of the business code if the deployment code is the business code to obtain the preset whitelist.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the method for protecting against execution of malicious Java commands as described in the first aspect are implemented.

[0015] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for protecting against execution of malicious Java commands as described in the first aspect.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the method for protecting against the execution of malicious Java commands described in the first aspect.

[0017] The present invention provides a method for protecting against malicious Java command execution. A Java virtual machine executes a command issued by a target program and triggers a monitoring point to monitor the target program. The monitoring point obtains the execution thread of the target program's command and inspects the thread's stack to determine the command's execution code category. If the execution code category is not on a preset whitelist, the monitoring point issues an alarm via a dynamic alarm module. Setting a small number of monitoring points on the Java virtual machine monitors the target program, minimizing Java virtual machine performance loss. By determining if the execution code category is not on the preset whitelist, protection against unknown vulnerabilities can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 This is a flow chart of an embodiment of a method for protecting against malicious Java command execution according to the present invention;

[0020] Figure 2 A flowchart of an embodiment of a method for obtaining a preset whitelist according to the present invention;

[0021] Figure 3 This is a flow chart of an embodiment of a method for determining a service code according to the present invention;

[0022] Figure 4 Flowchart of another embodiment of the method for determining a business code of the present invention

[0023] Figure 5 This is a flow chart of another embodiment of a method for protecting against execution of malicious Java commands of the present invention;

[0024] Figure 6 Flowchart of another embodiment of a method for protecting against malicious Java commands of the present invention

[0025] Figure 7 This is a flow chart of an embodiment of a method for protecting against execution of malicious Java commands according to the present invention;

[0026] Figure 8 This is a flow chart of another embodiment of a method for obtaining a preset whitelist according to the present invention;

[0027] Figure 9 Schematic diagram of an application scenario of the present invention;

[0028] Figure 10This is a schematic diagram of the structure of an embodiment of a protection device for malicious Java command execution according to the present invention;

[0029] Figure 11 It is a schematic diagram of the structure of an electronic device embodiment of the present invention. DETAILED DESCRIPTION

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0031] Figure 1 This is a flow chart of an embodiment of a method for protecting against malicious Java commands of the present invention. Figure 1 As shown, the protection method for executing malicious Java commands according to an embodiment of the present invention includes:

[0032] S101, the Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program.

[0033] In an embodiment of the present invention, a Java Virtual Machine (JVM) is a specification for a computing device. It is a fictitious computer that is implemented by simulating various computer functions on an actual computer. When a target program is running, the program may contain malicious code that may delete system files or restart the system, etc. In order to prevent the running of malicious code from affecting the system, it is necessary to control the permissions of the running malicious code and enable a security manager (SecurityManager). Monitoring points are provided on the JVM, and the embodiment of the present invention does not limit the number of monitoring points. When the JVM executes a command issued by the target program, it triggers the checkExec command of the security manager, and the checkExec command can cause the monitoring point to perform monitoring of the target program. The target program can be a program that issues a command or a vulnerability, etc., and the embodiment of the present invention does not limit this.

[0034] S102: The monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command.

[0035] In an embodiment of the present invention, a thread is the smallest unit that the operating system can perform computational scheduling on. It is contained in a process and is the actual operating unit in the process. A thread refers to a single sequential control flow in a process. Multiple threads can run concurrently in a process, and each thread executes different tasks in parallel. A stack is a data structure in which data items are arranged in order, and data items can only be inserted and deleted at one end, the top of the stack. Since the monitoring point can monitor the target program, the execution thread of the command issued by the target program to the JVM in the monitoring point can be obtained, and the stack of the execution thread can be traversed and detected. The process of traversing and detecting the stack of the execution thread is the process of tracing the category of the execution code of the command. By tracing the source, the category of the execution code of the command can be obtained.

[0036] S103: If the category of the executed code does not exist in the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0037] In an embodiment of the present invention, a dynamic alarm module exists within a monitoring point. The categories recorded in the preset whitelist represent safe code categories, and executing the code will not threaten the security of the operating system where the JVM is located. If the category of the executed code does not exist in the preset whitelist, it means that the executed code is not business code, but third-party library code. The third-party library code can be a framework or container component, etc. This embodiment of the present invention does not limit this. Under normal circumstances, the third-party library code will not execute commands on the operating system. In this case, an alarm needs to be issued to remind users or developers that the code poses a threat to the operating system where the JVM is located.

[0038] The present invention provides a method for protecting against malicious Java command execution. A Java virtual machine executes a command issued by a target program and triggers a monitoring point to monitor the target program. The monitoring point obtains the execution thread of the target program's command and inspects the thread's stack to determine the command's execution code category. If the execution code category is not on a preset whitelist, the monitoring point issues an alarm via a dynamic alarm module. Setting a small number of monitoring points on the Java virtual machine monitors the target program, minimizing Java virtual machine performance loss. By determining if the execution code category is not on the preset whitelist, protection against unknown vulnerabilities can be provided.

[0039] Figure 2 This is a flow chart of an embodiment of a method for obtaining a preset whitelist according to the present invention. Figure 2 As shown, the method for obtaining a preset whitelist according to an embodiment of the present invention includes:

[0040] S201, the static collection module scans the deployment code of the target program to determine whether the deployment code is a business code.

[0041] In the embodiments of the present invention, deployment code is the target program's runtime code, presented in bytecode format. This code may include source code and middleware code. The static collection module is independent of the JVM and can be a program, but this is not a limitation in the embodiments of the present invention. Service code is the code that executes commands on the system.

[0042] S202: If the deployment code is a business code, the category of the business code is recorded to obtain a preset whitelist.

[0043] In an embodiment of the present invention, the deployment code is a business code, the categories of the business codes are recorded, and a set of the recorded business code categories constitutes a preset whitelist.

[0044] In the method for obtaining a preset whitelist provided in the embodiment of the present invention, the preset whitelist is obtained by recording the categories of the service codes. Determining the preset whitelist according to the categories can make the service codes included in the whitelist more comprehensive.

[0045] Figure 3 FIG. 1 is a flow chart of an embodiment of a method for determining a service code according to the present invention. Figure 3 As shown, the method for determining a service code according to an embodiment of the present invention includes:

[0046] S301: Parse the deployment code to obtain the parsed deployment code. S302: Determine whether the deployment code is a business code based on the parsed deployment code.

[0047] In the embodiment of the present invention, the deployment code exists in the form of bytecode, and whether the deployment code is a business code can be determined by parsing the bytecode.

[0048] It should be noted that the deployment code may include: source code and middleware code. By parsing the source code and middleware code in the deployment code, the code involved in the operation of the target program can be fully obtained, and then it can be determined whether the code that executes the corresponding command belongs to the business code or the third-party library code, thereby effectively preventing the use of third-party library vulnerabilities to execute malicious Java commands.

[0049] The method for determining a business code provided by an embodiment of the present invention can quickly determine whether a deployment code is a business code by parsing the deployment code.

[0050] Figure 4 FIG. 1 is a flow chart of another embodiment of a method for determining a service code according to the present invention. Figure 4 As shown, the method for determining a service code according to an embodiment of the present invention includes:

[0051] S401: Match the parsed deployment code with the business code in the business code library.

[0052] S402: If the match is successful, it is determined that the parsed deployment code is a business code.

[0053] In an embodiment of the present invention, a business code library is pre-established and includes business codes and business code categories. The category of the deployment code is matched with the category of the business code in the business code library. If the categories are consistent, the match is considered successful and the deployment code is considered to be a business code.

[0054] The method for determining a business code provided by an embodiment of the present invention can accurately and quickly determine that a deployment code is a business code by matching the deployment code with a business code library.

[0055] In some optional embodiments, after the monitoring point obtains the execution thread of the command issued by the target program and detects the execution thread stack to obtain the category of the command execution code, the monitoring point may also load a preset whitelist. In this embodiment of the present invention, loading the preset whitelist is the process of loading the preset whitelist into memory.

[0056] Figure 5 This is a flow chart of another embodiment of a method for protecting against malicious Java commands of the present invention. Figure 5 As shown, the protection method for executing malicious Java commands according to an embodiment of the present invention includes:

[0057] S501: The static collection module scans the deployment code of the target program to determine whether the deployment code is a business code.

[0058] S502: If the deployment code is a business code, the category of the business code is recorded to obtain a preset whitelist.

[0059] S503: The Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program.

[0060] S504: The monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the type of the execution code of the command.

[0061] S505: If the category of the executed code does not exist in the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0062] In the embodiment of the present invention, the above steps are described in detail. Figure 1 and Figure 2 The description of the steps in will not be repeated here.

[0063] The method for protecting against malicious Java command execution provided by the present invention collects business code categories to obtain a preset whitelist, and then determines whether the deployed code is business code based on the preset whitelist. By determining that the executed code category is not on the preset whitelist, unknown vulnerabilities can be protected.

[0064] Figure 6 Another embodiment of the protection method for executing malicious Java commands of the present invention is a flow chart. Figure 5 As shown, the protection method for executing malicious Java commands according to an embodiment of the present invention includes:

[0065] S601, the Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program.

[0066] S602: The monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the type of the execution code of the command.

[0067] S603, the monitoring point loads a preset whitelist.

[0068] S604: If the category of the executed code does not exist in the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0069] In the embodiment of the present invention, the above steps are described in detail. Figure 1 The description of the steps in will not be repeated here.

[0070] The method for protecting against malicious Java command execution provided by the embodiment of the present invention loads a preset whitelist and determines whether the deployed code is business code based on the preset whitelist. By determining that the category of the executed code is not on the preset whitelist, unknown vulnerabilities can be protected.

[0071] Figure 7 This is a flow chart of another embodiment of a method for protecting against malicious Java commands of the present invention. Figure 7 As shown, the protection method for executing malicious Java commands according to an embodiment of the present invention includes:

[0072] S701: The static collection module scans the deployment code of the target program to determine whether the deployment code is a business code.

[0073] S702: If the deployment code is a business code, the category of the business code is recorded to obtain a preset whitelist.

[0074] S703: The Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program.

[0075] S704: The monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command.

[0076] S705, the monitoring point loads the preset whitelist.

[0077] S706: If the category of the executed code does not exist in the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0078] In the embodiment of the present invention, the above steps are described in detail. Figure 1 and Figure 2 The description of the steps in will not be repeated here.

[0079] The present invention provides a method for protecting against malicious Java command execution by pre-establishing a preset whitelist, loading the preset whitelist, and determining whether the deployed code is business code based on the preset whitelist. By determining whether the executed code category is not on the preset whitelist, unknown vulnerabilities can be protected.

[0080] Figure 8 Another embodiment of the method for obtaining a preset whitelist of the present invention is a flow chart. Figure 8 As shown, the method for obtaining a preset whitelist according to an embodiment of the present invention includes:

[0081] S801, matching the parsed deployment code with the business code in the business code library.

[0082] S802: If the match is successful, determine that the parsed deployment code is a business code.

[0083] S803, record the category of the business code and obtain a preset white list.

[0084] In the embodiment of the present invention, the above steps are described in detail. Figure 2 and Figure 4 The description of the steps in will not be repeated here.

[0085] In the method for obtaining a preset whitelist provided in an embodiment of the present invention, a deployment code is matched with a business code in a business code library to determine that the deployment code is a business code, and the category of the business code is recorded to obtain a preset whitelist. Determining the preset whitelist based on category can include more comprehensive business codes.

[0086] Figure 9 This is a schematic diagram of the application scenario of the present invention. Figure 9 As shown, the application scenario of the embodiment of the present invention includes the following steps:

[0087] Step 1: The static collection module scans the middleware and source code of the target program to obtain the deployment code of the target program. Step 2: By matching the deployment code with the business code in the business code library, it is determined whether the deployment code is the business code. If the match is successful, it is determined that the deployment code is the business code and it is written into the whitelist. Step 3: The JVM receives and executes the command of the target program. In the process of executing the instructions of the target program, the JVM triggers the checkExec command of the security manager. The checkExec command can be used to enable the monitoring point to perform monitoring of the target program. Step 4: Load the whitelist. Step 5: Obtain the execution code of the command of the target program in the monitoring point, and determine whether the category of the execution code exists in the whitelist. If not, the dynamic alarm module will issue an alarm.

[0088] Figure 10 Schematic diagram of the structure of the embodiment of the protection device for executing malicious Java commands of the present invention. Figure 10 As shown, the protection device for executing malicious Java commands includes:

[0089] Monitoring module 1001, used for the Java virtual machine to execute the target program's commands and trigger the monitoring point to monitor the target program;

[0090] The detection module 1002 is used to monitor the execution thread of the command issued by the target program and detect the stack of the execution thread to obtain the type of the execution code of the command;

[0091] The alarm module 1003 is used to generate an alarm at the monitoring point through the dynamic alarm module if the category of the executed code does not exist in the preset white list.

[0092] Optionally, the protection device for executing malicious Java commands further includes:

[0093] The judgment module is used for the static collection module to scan the deployment code of the target program and determine whether the deployment code is business code;

[0094] The generation module is used to record the category of the business code if the deployment code is a business code, and obtain a preset whitelist.

[0095] Optionally, the judgment module includes:

[0096] A parsing unit, used to parse the deployment code to obtain the parsed deployment code;

[0097] The judgment unit is used to judge whether the deployment code is a business code based on the parsed deployment code.

[0098] Optionally, the judging unit includes:

[0099] The matching subunit is used to match the parsed deployment code with the business code in the business code library;

[0100] The determination subunit is used to determine that the parsed deployment code is a business code if the match is successful.

[0101] Optionally, the protection device for executing malicious Java commands further includes:

[0102] Loading module, used for monitoring point to load preset whitelist.

[0103] Figure 11 An example of a physical structure diagram of an electronic device is shown below. Figure 11 As shown, the electronic device may include: a processor (processor) 1101, a communication interface (Communications Interface) 1102, a memory (memory) 1103, and a communication bus 1104, wherein the processor 1101, the communication interface 1102, and the memory 1103 communicate with each other via the communication bus 1104. The processor 1101 can call the logic instructions in the memory 1103 to execute the following method: the Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program; the monitoring point obtains the execution thread of the command issued by the target program and detects the stack of the execution thread to obtain the category of the execution code of the command; if the category of the execution code does not exist in the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0104] In addition, the logic instructions in the above-mentioned memory 1103 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0105] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the Java malicious command execution protection method provided by the above embodiments, for example, including: the Java virtual machine executes the command issued by the target program, and triggers the monitoring point to monitor the target program; the monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command; if the category of the execution code does not exist on the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0106] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it implements the protection method for executing Java malicious command execution provided in the above-mentioned embodiments, for example, including: a Java virtual machine executes the command issued by the target program, and triggers a monitoring point to monitor the target program; the monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command; if the category of the execution code does not exist on the preset whitelist, the monitoring point issues an alarm through the dynamic alarm module.

[0107] The device embodiments described above are merely illustrative. Modules described as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, i.e., they may be located in one place or distributed across multiple network modules. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0108] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus the necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or certain parts of the embodiment.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for protecting against execution of malicious Java commands, characterized in that: include: The Java virtual machine executes the command issued by the target program and triggers the monitoring point to monitor the target program; The monitoring point obtains the execution thread of the command issued by the target program, and detects the stack of the execution thread to obtain the category of the execution code of the command; If the category of the executed code does not exist in the preset whitelist, the monitoring point issues an alarm through a dynamic alarm module; wherein the dynamic alarm module is set in the monitoring point; Before executing the command issued by the target program and triggering the monitoring point to monitor the target program, the method further includes: The static collection module scans the deployment code of the target program to determine whether the deployment code is a business code; If the deployment code is the business code, the category of the business code is recorded to obtain the preset whitelist; The deployment code includes: source code and middleware code, and the determination of whether the deployment code is a business code includes: Parsing the source code and the middleware code in the deployment code respectively to obtain parsed deployment code; According to the parsed deployment code, it is determined whether the deployment code is the business code.

2. The method for protecting against execution of malicious Java commands according to claim 1, wherein: The determining, based on the parsed deployment code, whether the deployment code is the business code includes: Matching the parsed deployment code with the business code in the business code library; If the match is successful, it is determined that the parsed deployment code is the business code.

3. The method for protecting against execution of malicious Java commands according to claim 1, wherein: The monitoring point obtains the execution thread of the command issued by the target program, detects the stack of the execution thread, and obtains the type of the execution code of the command, further comprising: The monitoring point loads the preset whitelist.

4. A protection device for executing malicious Java commands, characterized in that: include: A monitoring module is used for the Java virtual machine to execute the target program's command and trigger the monitoring point to monitor the target program; a detection module, configured to obtain, at the monitoring point, an execution thread of a command issued by the target program, and detect a stack of the execution thread to obtain a category of an execution code of the command; an alarm module, configured to generate an alarm at the monitoring point through a dynamic alarm module if the category of the executed code does not exist on a preset whitelist; wherein the dynamic alarm module is disposed within the monitoring point; Also includes: A judgment module, configured to enable a static collection module to scan the deployment code of the target program and determine whether the deployment code is a business code; A generation module, configured to, if the deployment code is the business code, record the category of the business code and obtain the preset whitelist; The deployment code includes: source code and middleware code, and the judgment module is specifically used to: Parsing the source code and the middleware code in the deployment code respectively to obtain parsed deployment code; According to the parsed deployment code, it is determined whether the deployment code is the business code.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the method for protecting against execution of malicious Java commands as described in any one of claims 1 to 3 are implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for protecting against execution of malicious Java commands as described in any one of claims 1 to 3 are implemented.

7. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the steps of the method for protecting against execution of malicious Java commands as described in any one of claims 1 to 3.

Images