Non-intrusive system safety protection methods and safety protection devices

Abstract

This invention discloses a non-intrusive system security protection method and device. The method includes: determining a set of critical APIs, which includes multiple critical APIs; determining whether a call operation targeting at least one critical API has been obtained; if the call operation has been obtained, reloading the critical API call instruction corresponding to the call operation to a preset virtual environment; generating a dynamic interception instruction; modifying the critical API call instruction based on the dynamic interception instruction to obtain a modified instruction; and running the modified instruction in the preset virtual environment. By accurately identifying malicious programs based on their call patterns to critical APIs and dynamically modifying them non-intrusively through a preset virtual environment, security protection for the application system is achieved without intruding on the original program's execution.

Description

Technical Field

[0001] This invention relates to the field of security protection technology, specifically to a non-intrusive system security protection method, a non-intrusive system security protection device, a processor, a machine-readable storage medium, and a computer program product. Background Technology

[0002] With the continuous development of network technology, network security has become an increasingly serious problem, and network security risks have placed higher demands and more severe challenges on the protection capabilities of application systems.

[0003] Existing application system protection methods are mainly divided into two categories: internal protection methods and external protection methods. For internal protection methods, developers need to have a relatively in-depth understanding of common security attack methods and protection technologies during the design and development of application systems. During the development process, they need to design and write corresponding code with defense detection functions in advance for possible attack methods. Therefore, the protection capabilities of developers are highly demanding. At the same time, developers cannot systematically and comprehensively master security protection knowledge, thus reducing the reliability of system protection.

[0004] External protection methods often involve configuring a large number of external devices and pre-detection mechanisms to intercept and process dangerous requests. However, professional external protection equipment places a huge cost burden on enterprises, and pre-detection mechanisms cannot accurately analyze and determine normal behavior and attack behavior, thereby reducing the protection effect and failing to meet the actual needs of users. Summary of the Invention

[0005] To overcome the aforementioned technical problems in the prior art, this invention provides a non-intrusive system security protection method. By accurately identifying malicious programs based on their call patterns to key APIs, and by dynamically modifying the malicious programs in a pre-set virtual environment in a non-intrusive manner, the method achieves security protection for the application system without intruding on the original program's operation.

[0006] To achieve the above objectives, embodiments of the present invention provide a non-intrusive system security protection method, the method comprising: determining a set of critical APIs, the set of critical APIs including multiple critical APIs; determining whether a call operation for at least one critical API has been obtained; if the call operation has been obtained, reloading the critical API call instruction corresponding to the call operation to a preset virtual environment; generating a dynamic interception instruction, modifying the critical API call instruction in the preset virtual environment based on the dynamic interception instruction to obtain a modified instruction; and running the modified instruction in the preset virtual environment.

[0007] Preferably, determining the key API set includes: obtaining a preset first API set; obtaining current business information, determining a second API set based on the current business information, wherein both the first API set and the second API set are JAVA-based API sets; performing a union operation on the first API set and the second API set to generate the key API set.

[0008] Preferably, the method further includes: after determining that the call operation has been obtained, obtaining the call frequency for the at least one key API; determining whether the call frequency is greater than a preset frequency threshold; and if the call frequency is greater than the preset frequency threshold, reloading the key API call instruction corresponding to the call operation to a preset virtual environment.

[0009] Preferably, the step of reloading the key API call instruction corresponding to the call operation to a preset virtual environment includes: creating a preset virtual environment based on a JAVA agent; calling a preset fitting program in the preset virtual environment; and performing a reloading operation on the key API call instruction based on the preset fitting program to reload the key API call instruction to the preset virtual environment.

[0010] Preferably, generating the dynamic interception instruction includes: determining the set of APIs to be called corresponding to the critical API call instruction; determining the danger level of the set of APIs to be called; generating a corresponding alarm instruction if the danger level is less than a first level; generating a corresponding blocking instruction if the danger level is greater than or equal to the first level; and using the alarm instruction or the blocking instruction as the dynamic interception instruction.

[0011] Preferably, the step of modifying the key API call instruction based on the dynamic interception instruction to obtain the modified instruction includes: obtaining a preset dynamic addition tool; and using the preset dynamic addition tool to add the dynamic interception instruction to the key API call instruction in advance to generate the modified instruction.

[0012] Accordingly, this invention also provides a non-intrusive system security protection device, the device comprising: an API set determination unit for determining a set of critical APIs, the set of critical APIs including multiple critical APIs; a judgment unit for determining whether a call operation for at least one critical API has been obtained; a reloading unit for reloading the critical API call instruction corresponding to the call operation to a preset virtual environment if the call operation has been obtained; a modification unit for generating a dynamic interception instruction and modifying the critical API call instruction in the preset virtual environment based on the dynamic interception instruction to obtain a modified instruction; and an instruction execution unit for running the modified instruction in the preset virtual environment.

[0013] Preferably, the API set determination unit includes: a first API set acquisition module, used to acquire a preset first API set; a second API set acquisition module, used to acquire current business information and determine a second API set based on the current business information, wherein both the first API set and the second API set are JAVA-based API sets; and an API set determination module, used to perform a union processing on the first API set and the second API set to generate a key API set.

[0014] Preferably, the device further includes a filtering unit, which is configured to: after determining that the call operation has been obtained, obtain the call frequency for the at least one key API; determine whether the call frequency is greater than a preset frequency threshold; and if the call frequency is greater than the preset frequency threshold, reload the key API call instruction corresponding to the call operation to a preset virtual environment.

[0015] Preferably, the reloading unit includes: an environment creation module for creating a preset virtual environment based on a JAVA agent; a program invocation module for invoking a preset fitting program in the preset virtual environment; and a reloading module for reloading the key API call instructions based on the preset fitting program, so as to reload the key API call instructions into the preset virtual environment.

[0016] Preferably, the interception instruction generation unit includes: a first determining module, configured to determine the set of APIs to be called corresponding to the critical API call instruction; a second determining module, configured to determine the danger level of the set of APIs to be called; a first instruction generation module, configured to generate a corresponding alarm instruction when the danger level is less than a first level; a second instruction generation module, configured to generate a corresponding blocking instruction when the danger level is greater than or equal to the first level; and an instruction determining module, configured to use the alarm instruction or the blocking instruction as the dynamic interception instruction.

[0017] Preferably, the modification unit includes: a tool acquisition module for acquiring a preset dynamic addition tool; and a dynamic modification module for adding the dynamic interception instruction to the key API call instruction using the preset dynamic addition tool, thereby generating the modified instruction.

[0018] On the other hand, embodiments of the present invention also provide a processor configured to execute the methods provided in embodiments of the present invention.

[0019] On the other hand, embodiments of the present invention also provide a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the method provided in embodiments of the present invention.

[0020] On the other hand, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the method provided in the embodiments of the present invention.

[0021] The present invention has at least the following technical effects through the technical solution provided by the present invention:

[0022] By analyzing the malicious program's call behavior to key APIs and identifying the corresponding set of key APIs, the malicious program can be identified based on the call behavior targeting this set of key APIs. On the other hand, by dynamically intercepting the malicious program in the JVM, security protection of the application system can be achieved without intruding on the malicious program, thereby improving the security of the application system and meeting the actual needs of users.

[0023] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0024] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0025] Figure 1 This is a flowchart illustrating the specific implementation of the non-intrusive system security protection method provided in this embodiment of the invention.

[0026] Figure 2 This is a flowchart illustrating the specific implementation of determining the key API set in the non-intrusive system security protection method provided in this embodiment of the invention.

[0027] Figure 3 This is a flowchart illustrating the specific implementation of the non-intrusive system security protection method provided in this invention, which involves reloading critical API call instructions to a preset virtual environment.

[0028] Figure 4 This is a schematic diagram of the structure of the non-intrusive system safety protection device provided in the embodiment of the present invention. Detailed Implementation

[0029] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0030] In this invention, the terms "system" and "network" are used interchangeably. "Multiple" refers to two or more; therefore, in this invention, "multiple" can also be understood as "at least two." "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / ", unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, it should be understood that in the description of this invention, terms such as "first" and "second" are used only for descriptive purposes and should not be construed as indicating or implying relative importance or order.

[0031] Please see Figure 1 This invention provides a non-intrusive system security protection method, the method comprising:

[0032] S10) Determine the set of key APIs, which includes multiple key APIs;

[0033] S20) Determine whether the application has made a call to at least one key API;

[0034] S30) Upon obtaining the call operation, the key API call instruction corresponding to the call operation is reloaded to the preset virtual environment;

[0035] S40) Generate a dynamic interception instruction, and modify the key API call instruction based on the dynamic interception instruction in the preset virtual environment to obtain the modified instruction;

[0036] S50) Run the modified instructions in the preset virtual environment.

[0037] In one possible implementation, to achieve dynamic protection against malicious code, it is necessary to identify a set of critical APIs and use this set to determine the malicious call behavior of the malicious code. This set of critical APIs includes multiple critical APIs, for example, see [link to relevant documentation]. Figure 2 In this embodiment of the invention, determining the key API set includes:

[0038] S11) Obtain the preset first API set;

[0039] S12) Obtain current business information, and determine a second API set based on the current business information. Both the first API set and the second API set are JAVA-based API sets.

[0040] S13) Perform a union operation on the first API set and the second API set to generate a key API set.

[0041] For example, a preset first API set is first obtained. This preset first API set can be determined based on the API set called by publicly available malicious programs. To further improve the accuracy of identification, current business information is obtained. For example, during the development of an application system, technicians can determine the instructions executed by the application system during normal operation and the normal API set that needs to be called, and further mark and determine the API set that is at risk of being attacked. At this time, the above-mentioned API set that is at risk of being attacked can be used as the second API set. In this embodiment of the invention, in order to achieve dynamic protection against malicious programs, based on the cross-platform capability and dynamic loading capability of the JAVA platform, the application system provided by this embodiment of the invention can be developed based on JAVA. The above-mentioned first API set and second API set can both be JAVA-based API sets. At this time, the first API set and the second API set are subjected to union processing to filter out duplicate API sets in the first API set and the second API set, and finally obtain the key API set.

[0042] In this embodiment of the invention, by further determining a more refined set of vulnerable APIs based on the actual situation of the current business, and generating a final set of critical APIs, the accuracy of identifying malicious calls during subsequent API calls by malicious programs is effectively improved, thereby enhancing the protection performance of the application system.

[0043] After identifying the aforementioned set of critical APIs, the application system monitors the API calls made by the program during operation and determines whether any calls to at least one of the critical APIs are detected. For example, if no calls to any of the critical APIs are detected during normal operation, the running program is considered legitimate, and no security response or detection is performed. However, if the application system detects a program calling a critical API, the program may be malicious. Therefore, the critical API call instruction corresponding to the aforementioned call operation is reloaded into a preset virtual environment for execution. At this point, dynamic interception instructions can be generated. For example, corresponding dynamic interception instructions can be generated based on the instruction type, instruction execution rules, instruction execution environment, and other information. Then, the critical API call instruction is modified based on the dynamic interception instructions to obtain the modified instruction. This modified instruction is then executed in the preset virtual environment, thereby achieving security protection for the application system without intruding on the original program or the original API call instruction, thus improving the security and reliability of the application system.

[0044] However, in practical applications, there is a certain gray area in the calling of critical APIs. That is, normal applications may also call certain critical APIs, but their calls are still different from those of malicious programs. Therefore, in order to further improve the accuracy of identifying malicious programs, the API call instructions can be further filtered.

[0045] For example, in an embodiment of the present invention, the method further includes: after determining that the call operation has been obtained, obtaining the call frequency for the at least one key API; determining whether the call frequency is greater than a preset frequency threshold; and if the call frequency is greater than the preset frequency threshold, reloading the key API call instruction corresponding to the call operation to a preset virtual environment.

[0046] In this embodiment of the invention, by analyzing the frequency of malicious programs calling key APIs and the frequency of normal applications calling key APIs, programs with a high frequency of calling key APIs can be identified as malicious programs in practical applications. This can further improve the accuracy of identifying malicious programs, while effectively reducing false detections of normal applications, reducing malfunctions of application systems, reducing the impact on users' normal business operations, and improving user experience.

[0047] Once it is determined that the currently applied program is malicious, its critical API call instructions can be reloaded into a preset virtual environment to facilitate dynamic modification.

[0048] Please see Figure 3 In this embodiment of the invention, reloading the key API call instruction corresponding to the call operation to a preset virtual environment includes:

[0049] S31) Create a preset virtual environment based on a JAVA agent;

[0050] S32) Invoke the preset fitting program in the preset virtual environment;

[0051] S33) Based on the preset bonding program, the key API call instruction is reloaded to the preset virtual environment.

[0052] To achieve dynamic modification of malicious programs, a preset virtual environment is first created, such as a JVM (Java Virtual Machine). A Java Agent is written in this JVM. Then, a preset attach function is called in this JVM, such as the attach function. The preset attach function reloads the critical API call instructions to the JVM, for example, to the JVM process with a specified process number.

[0053] At this point, a dynamic interception instruction can be further generated. For example, in this embodiment of the invention, generating a dynamic interception instruction includes: determining the set of APIs to be called corresponding to the critical API call instruction; determining the danger level of the set of APIs to be called; generating a corresponding alarm instruction if the danger level is less than a first level; generating a corresponding blocking instruction if the danger level is greater than or equal to the first level; and using the alarm instruction or the blocking instruction as the dynamic interception instruction.

[0054] For example, in one possible implementation, multiple critical APIs in the aforementioned critical API set can be classified into risk levels. For critical APIs with low risk, only an alarm can be triggered after it is determined that they have been called by a malicious program, so as to reduce the impact on users' business operations. However, for critical APIs with high risk, corresponding interception must be carried out after it is determined that they have been called by a malicious program. Therefore, corresponding dynamic interception instructions can be generated based on the above risk levels. Specifically, firstly, the set of APIs called corresponding to the critical API call instruction is determined, and then its risk level is determined. For example, the risk level of the entire set of APIs called can be determined based on the API with the highest risk level in the set of APIs called. Then, its risk level is compared with the first level, for example, the first level is the primary risk level. Based on the comparison result, an alarm instruction to trigger an alarm or a blocking instruction to intercept is generated, thus determining the dynamic interception instruction. At this time, the critical API call instruction can be modified in the preset virtual environment.

[0055] In this embodiment of the invention, modifying the key API call instruction based on the dynamic interception instruction to obtain the modified instruction includes: obtaining a preset dynamic addition tool; and using the preset dynamic addition tool to add the dynamic interception instruction to the key API call instruction in advance to generate the modified instruction.

[0056] In one possible implementation, after generating the dynamic interception instruction, a preset dynamic addition tool is obtained, such as a Java Instrument API function. The Java Instrument API function can be called in the JVM to dynamically modify the aforementioned key API call instruction, for example, by adding the aforementioned dynamic interception instruction to its pre-processor, thereby generating the modified instruction. At this time, running the modified instruction in the JVM can achieve security protection for the application system without intruding on the original program, effectively improving the security of the application system.

[0057] The non-intrusive system security protection device provided in the embodiments of the present invention will now be described in conjunction with the accompanying drawings.

[0058] Please see Figure 4Based on the same inventive concept, embodiments of the present invention provide a non-intrusive system security protection device, the device comprising: an API set determination unit for determining a set of critical APIs, the set of critical APIs including multiple critical APIs; a judgment unit for determining whether a call operation for at least one critical API has been obtained; a reloading unit for reloading the critical API call instruction corresponding to the call operation to a preset virtual environment if the call operation has been obtained; a modification unit for generating a dynamic interception instruction, which is used in the preset virtual environment to modify the critical API call instruction based on the dynamic interception instruction to obtain a modified instruction; and an instruction execution unit for running the modified instruction in the preset virtual environment.

[0059] In this embodiment of the invention, the API set determination unit includes: a first API set acquisition module, used to acquire a preset first API set; a second API set acquisition module, used to acquire current business information and determine a second API set based on the current business information, wherein both the first API set and the second API set are JAVA-based API sets; and an API set determination module, used to perform a union processing on the first API set and the second API set to generate a key API set.

[0060] In this embodiment of the invention, the device further includes a filtering unit, which is configured to: after determining that the call operation has been obtained, obtain the call frequency for the at least one key API; determine whether the call frequency is greater than a preset frequency threshold; and if the call frequency is greater than the preset frequency threshold, reload the key API call instruction corresponding to the call operation to a preset virtual environment.

[0061] In this embodiment of the invention, the reloading unit includes: an environment creation module for creating a preset virtual environment based on JAVAagent; a program invocation module for invoking a preset fitting program in the preset virtual environment; and a reloading module for reloading the key API call instruction based on the preset fitting program to reload the key API call instruction into the preset virtual environment.

[0062] In this embodiment of the invention, the interception instruction generation unit includes: a first determining module, configured to determine the set of APIs to be called corresponding to the critical API call instruction; a second determining module, configured to determine the danger level of the set of APIs to be called; a first instruction generation module, configured to generate a corresponding alarm instruction when the danger level is less than a first level; a second instruction generation module, configured to generate a corresponding blocking instruction when the danger level is greater than or equal to the first level; and an instruction determining module, configured to use the alarm instruction or the blocking instruction as the dynamic interception instruction.

[0063] In this embodiment of the invention, the modification unit includes: a tool acquisition module for acquiring a preset dynamic addition tool; and a dynamic modification module for adding the dynamic interception instruction to the key API call instruction using the preset dynamic addition tool, thereby generating the modified instruction.

[0064] Furthermore, embodiments of the present invention also provide a processor configured to execute the methods described in embodiments of the present invention.

[0065] Furthermore, embodiments of the present invention also provide a machine-readable storage medium storing instructions that, when executed by a processor, configure the processor to perform the methods described in the embodiments of the present invention.

[0066] Furthermore, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the methods described in the embodiments of the present invention.

[0067] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0068] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0069] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0072] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0073] Computer-readable media include both permanent and non-permanent, removable and non-removable media, which can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0074] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0075] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A non-intrusive system security protection method, characterized in that, The method includes: Identify a set of key APIs, which includes multiple key APIs; Determine whether a call operation targeting at least one key API has been detected; If the call operation is confirmed, the key API call instruction corresponding to the call operation is reloaded into the preset virtual environment; Generate dynamic interception instructions, and modify the key API call instructions based on the dynamic interception instructions in the preset virtual environment to obtain the modified instructions; The modified instructions are executed in the preset virtual environment; The generation of dynamic interception instructions includes: Determine the set of APIs to be invoked corresponding to the key API invocation instruction; The process involves classifying the risks of multiple critical APIs in the critical API set and determining the risk level of the called API set, including: determining the overall risk level of the called API set based on the API with the highest risk level in the called API set, and then comparing its risk level with the first level. If the danger level is less than the first level, a corresponding alarm command is generated; If the danger level is greater than or equal to the first level, a corresponding blocking command is generated; The alarm command or the blocking command is used as the dynamic blocking command.

2. The method according to claim 1, characterized in that, The determination of the key API set includes: Get the preset first API set; Obtain current business information, and determine a second API set based on the current business information. Both the first API set and the second API set are JAVA-based API sets. Perform a union operation on the first API set and the second API set to generate a key API set.

3. The method according to claim 1, characterized in that, The method further includes: After confirming that the call operation has been obtained, the call frequency for the at least one key API is obtained; Determine whether the call frequency is greater than a preset frequency threshold; If the call frequency is greater than the preset frequency threshold, the key API call instruction corresponding to the call operation will be reloaded into the preset virtual environment.

4. The method according to claim 1, characterized in that, The step of reloading the key API call instructions corresponding to the call operation to the preset virtual environment includes: Create a pre-defined virtual environment based on a JAVA agent; Invoke the preset bonding program in the preset virtual environment; The key API call instructions are reloaded based on the preset bonding procedure to reload the key API call instructions into the preset virtual environment.

5. The method according to claim 1, characterized in that, The modification of the key API call instruction based on the dynamic interception instruction to obtain the modified instruction includes: Get preset dynamic addition tools; The preset dynamic addition tool is used to add the dynamic interception instruction to the key API call instruction in advance, thereby generating the modified instruction.

6. A non-intrusive system safety protection device, characterized in that, The device includes: API set determination unit, used to determine key API set, the key API set including multiple key APIs; The judgment unit is used to determine whether a call operation for at least one key API has been obtained; The reloading unit is used to reload the key API call instructions corresponding to the call operation to a preset virtual environment when it is determined that the call operation has been obtained; The modification unit is used to generate dynamic interception instructions, and modify the key API call instructions based on the dynamic interception instructions in the preset virtual environment to obtain the modified instructions; An instruction execution unit is used to run the modified instructions in the preset virtual environment; The interception command generation unit includes: The first determining module is used to determine the set of APIs to be called corresponding to the key API call instruction; The second determining module is used to classify the danger of multiple key APIs in the key API set and determine the danger level of the called API set, including: determining the danger level of the entire called API set based on the API with the highest danger level in the called API set, and then comparing its danger level with the first level; The first instruction generation module is used to generate a corresponding alarm instruction when the danger level is less than the first level. The second instruction generation module is used to generate a corresponding blocking instruction when the danger level is greater than or equal to the first level. The instruction determination module is used to use the alarm instruction or the blocking instruction as the dynamic blocking instruction.

7. The apparatus according to claim 6, characterized in that, The API set determination unit includes: The first API set acquisition module is used to acquire a preset first API set; The second API set acquisition module is used to acquire current business information and determine the second API set based on the current business information. Both the first API set and the second API set are JAVA-based API sets. The API set determination module is used to perform a union process on the first API set and the second API set to generate a key API set.

8. The apparatus according to claim 6, characterized in that, The device further includes a filtering unit, the filtering unit being used for: After confirming that the call operation has been obtained, the call frequency for the at least one key API is obtained; Determine whether the call frequency is greater than a preset frequency threshold; If the call frequency is greater than the preset frequency threshold, the key API call instruction corresponding to the call operation will be reloaded into the preset virtual environment.

9. The apparatus according to claim 6, characterized in that, The reloading unit includes: The environment creation module is used to create a preset virtual environment based on a JAVA agent; The program calling module is used to call the preset bonding program in the preset virtual environment; The reloading module is used to reload the key API call instructions based on the preset fitting program, so as to reload the key API call instructions into the preset virtual environment.

10. The apparatus according to claim 6, characterized in that, The modification unit includes: The tool acquisition module is used to acquire preset dynamically added tools; The dynamic modification module is used to add the dynamic interception instruction to the key API call instruction through the preset dynamic addition tool, thereby generating the modified instruction.

11. A processor, characterized in that, It is configured to perform the method of any one of claims 1-5.

12. A machine-readable storage medium storing instructions thereon, characterized in that, When executed by a processor, this instruction causes the processor to be configured to perform the method of any one of claims 1-5.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1-5.

Images