Safety protection methods and devices

Abstract

An embodiment of the present invention provides a security protection method and device, wherein the method includes: obtaining a file to be compiled read during the compilation process through a first monitoring point; matching the file to be compiled with legal files included in a whitelist to obtain a first matching result; and determining whether the file to be compiled is safe based on the first matching result. The security protection method and device provided by the present invention only allow the compilation of known legal files on the whitelist and do not allow the compilation of unknown files to be compiled. This is a whitelist protection approach. Even if the file to be compiled has been uploaded, it cannot be compiled, thereby avoiding attacks caused by uploading unknown files to be compiled, thereby achieving network security protection.

Description

Technical Field

[0001] The present invention relates to the field of safety protection technology, and in particular to a safety protection method and device. Background Art

[0002] With the continuous development of information technology, human society is becoming increasingly information-based, and society's reliance on network information is increasing. Consequently, network security is becoming increasingly important. Currently, there are also increasing threats to network security. For example, attackers exploit inherent vulnerabilities in business systems to upload arbitrary files to achieve their attacks.

[0003] Related technologies typically employ a protection approach that involves scanning configuration baselines. For example, OpenRASP scans configuration baselines for common vulnerabilities and then modifies more dangerous configuration items within them to address those vulnerabilities. This prevents arbitrary file uploads and, in turn, protects against attacks caused by arbitrary file uploads. However, this protection approach only protects against vulnerabilities that have occurred in the past. When new vulnerabilities emerge, the corresponding configuration files cannot be modified, allowing attackers to exploit these vulnerabilities and upload arbitrary files to achieve their attack objectives. Summary of the Invention

[0004] In response to the problems in the prior art, embodiments of the present invention provide a security protection method and device.

[0005] Specifically, the embodiments of the present invention provide the following technical solutions:

[0006] In a first aspect, an embodiment of the present invention provides a security protection method, including:

[0007] Obtaining the file to be compiled read during the compilation process through the first monitoring point;

[0008] Matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0009] Determine whether the file to be compiled is safe based on the first matching result.

[0010] Furthermore, matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result includes:

[0011] When it is determined that the legal files included in the whitelist include all the files to be compiled read during the compilation process, determining that the first matching result is a successful match;

[0012] When it is determined that the legal files included in the whitelist do not include all the to-be-compiled files read during the compilation process, the first matching result is determined to be a matching failure.

[0013] Furthermore, the whitelist also includes legal class files that inherit the compilation specification and legal compilation result files corresponding to the files to be compiled; the legal class files are files in the legal files;

[0014] The method further comprises:

[0015] When it is determined based on the first matching result that the file to be compiled is safe, obtaining the file to be loaded in the class loading process through a second monitoring point;

[0016] Matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result;

[0017] Determine whether the file to be loaded is safe based on the second matching result.

[0018] Furthermore, matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result includes:

[0019] Determine the intersection of a set of legal class files in the whitelist and a set of legal compilation result files;

[0020] When it is determined that the intersection contains all the files to be loaded in the class loading process, determining the second matching result as a successful match;

[0021] When it is determined that the intersection does not include all the files to be loaded in the class loading process, the second matching result is determined to be a matching failure.

[0022] Furthermore, before matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result, the method further includes:

[0023] The deployment code is scanned to obtain legal files in the deployment code, and the legal files are recorded in the whitelist.

[0024] Furthermore, the method further comprises:

[0025] Class files that inherit the compilation specification are determined in the legal files, and the class files that inherit the compilation specification are recorded in the white list.

[0026] Furthermore, before matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result, the method further includes:

[0027] Obtain a legal compilation result file corresponding to the file to be compiled through the first monitoring point, and record the legal compilation result file in the whitelist.

[0028] Furthermore, determining whether the file to be loaded is safe based on the second matching result includes:

[0029] When the second matching result is a matching failure, determining that the file to be loaded is unsafe;

[0030] When the second matching result is a successful match, it is determined that the file to be loaded is safe.

[0031] Furthermore, determining whether the file to be compiled is safe based on the first matching result includes:

[0032] When the first matching result is a matching failure, determining that the file to be compiled is unsafe;

[0033] When the first matching result is a successful match, it is determined that the file to be compiled is safe.

[0034] In a second aspect, an embodiment of the present invention further provides a safety protection device, comprising:

[0035] A first acquiring unit, configured to acquire, through a first monitoring point, a file to be compiled that is read during the compilation process;

[0036] a first matching unit, configured to match the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0037] A first determining unit is configured to determine whether the file to be compiled is safe based on the first matching result.

[0038] In a third aspect, an embodiment of the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the security protection method described in the first aspect are implemented.

[0039] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the security protection method described in the first aspect are implemented.

[0040] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the security protection method described in the first aspect.

[0041] The security protection method and apparatus provided by embodiments of the present invention obtain a file to be compiled during the compilation process through a first monitoring point, match the file to be compiled with legal files included in a whitelist, and finally determine whether the file to be compiled is safe based on the first matching result. As can be seen, the present invention only allows compilation of known legal files on the whitelist and prohibits compilation of unknown files to be compiled. This follows a whitelist-based protection approach. Even if a file to be compiled has been uploaded, it cannot be compiled, thus preventing attacks caused by uploading unknown files to be compiled, thereby achieving network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 This is one of the flow charts of the security protection method provided by an embodiment of the present invention;

[0044] Figure 2 This is the second flow chart of the security protection method provided by the embodiment of the present invention;

[0045] Figure 3 This is the third flow chart of the security protection method provided by the embodiment of the present invention;

[0046] Figure 4 This is the fourth flow chart of the security protection method provided by the embodiment of the present invention;

[0047] Figure 5 This is the fifth flow chart of the security protection method provided by the embodiment of the present invention;

[0048] Figure 6 Schematic diagram of the structure of the safety protection device provided by an embodiment of the present invention;

[0049] Figure 7 It is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0051] Figure 1 This is one of the flow charts of the security protection method provided by the embodiment of the present invention, such as Figure 1 As shown, the security protection method includes the following steps:

[0052] Step 101: Obtain a file to be compiled read during the compilation process through a first monitoring point.

[0053] For example, a first monitoring point can be set in the JAVA Server Pages (JSP) compilation process through technologies such as a security manager (SecurityManager) or a Java agent (javaagent), and when the program runs to the first monitoring point, the file to be compiled read in the compilation process is obtained through the first monitoring point. The file to be compiled is a code file that needs to be compiled, and there can be one or more files to be compiled.

[0054] Step 102: Match the file to be compiled with the legal files included in the whitelist to obtain a first matching result.

[0055] Among them, legal files are all files included in the deployment code of a specific project, for example, all class files in the deployment code, all code files that need to be compiled, video files, image files, and other files related to the project.

[0056] For example, when the file to be compiled that is read during the compilation process is obtained through the first monitoring point, the security of the file to be compiled is analyzed using a whitelist protection approach, that is, the file to be compiled is matched with the legal files in a pre-stored whitelist. The specific matching method is to traverse all legal files in the whitelist to find out whether the set of all legal files contains the file to be compiled, and obtain a first matching result.

[0057] It should be noted that matching the file to be compiled with the legal files included in the whitelist may be matching the name or identifier of the file to be compiled with the name or identifier of the legal files in the whitelist, which is not limited in the present invention.

[0058] Step 103: Determine whether the file to be compiled is safe based on the first matching result.

[0059] Specifically, when the first matching result is a matching failure, it is determined that the file to be compiled is unsafe; when the first matching result is a matching success, it is determined that the file to be compiled is safe.

[0060] For example, when the first matching result is a matching failure, it means that the file to be compiled is an unknown file (for example, a malicious JSP file that can carry out an attack), and thus the file to be compiled can be determined to be an unsafe file; when the first matching result is a matching success, it means that the file to be compiled is a known legal file, and thus the file to be compiled can be determined to be a safe file.

[0061] In addition, when it is determined that the file to be compiled is an unsafe file, warning information may be generated and stored or output, so that the user can be informed of the unsafe file to be compiled.

[0062] The security protection method provided by an embodiment of the present invention obtains a file to be compiled during the compilation process through a first monitoring point, matches the file to be compiled with legal files included in a whitelist, and finally determines whether the file to be compiled is safe based on the first matching result. As can be seen, the present invention only allows compilation of known legal files on the whitelist and prohibits compilation of unknown files to be compiled. This follows a whitelist-based protection approach. Even if a file to be compiled has been uploaded, it cannot be compiled. This prevents attacks caused by uploading unknown files to be compiled, thus achieving network security protection.

[0063] Optionally, Figure 1 Step 102 in the embodiment can be specifically implemented in the following manner:

[0064] When it is determined that the legal files included in the whitelist include all the files to be compiled read during the compilation process, determining that the first matching result is a successful match;

[0065] When it is determined that the legal files included in the whitelist do not include all the to-be-compiled files read during the compilation process, the first matching result is determined to be a matching failure.

[0066] For example, when a file to be compiled is obtained during the compilation process through the first monitoring point, the set of all legal files in the whitelist is traversed to determine whether the set of all legal files contains the file to be compiled. If the file to be compiled is found in the set of all legal files, it means that the file to be compiled is legal, and the first matching result can be determined to be a successful match. If the file to be compiled is not found in the set of all legal files, it means that the file to be compiled is illegal, and the first matching result can be determined to be a failed match.

[0067] The security protection method provided by the embodiment of the present invention determines that the first matching result is a matching failure when it is determined that the set of all legal files in the whitelist does not contain the file to be compiled, thereby avoiding attacks on the network caused by uploading arbitrary files and achieving security protection for the network.

[0068] Optionally, the whitelist further includes legal class files that inherit compilation specifications and legal compilation result files corresponding to the files to be compiled; the legal class files are files in the legal files.

[0069] Among them, the compilation specification is a pre-set JSP compilation rule, and the specific compilation specification type can be set based on actual needs; for example, the compilation specification of the container Tomcat is org.apache.jasper.runtime.HttpJspBase, and the compilation specification of the container WebLogic is weblogic.servlet.jsp.JspBase; the legal class file that inherits the compilation specification refers to the class file that needs to comply with the compilation specification; the legal compilation result file corresponding to the file to be compiled refers to the file obtained after the file to be compiled is legally compiled; for example, the file to be compiled is a code file, and the legal compilation result file refers to the class file obtained after the code file is legally compiled.

[0070] Optionally, Figure 2 This is the second flow chart of the safety protection method provided by the present invention, such as Figure 2 As shown, when the whitelist also includes legal class files that inherit the compilation specification and legal compilation result files corresponding to the files to be compiled, the security protection method further includes the following steps:

[0071] Step 104: When it is determined based on the first matching result that the file to be compiled is safe, the file to be loaded in the class loading process is obtained through a second monitoring point.

[0072] For example, you can also set a second monitoring point in the JSP class loading process through SecurityManager or Java agent and other technologies, and when running to the second monitoring point, obtain the file to be loaded in the class loading process through the second monitoring point. The file to be loaded is the compilation result file, that is, the class file.

[0073] Step 105: Match the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result.

[0074] Specifically, determine the intersection of the set of legal class files in the whitelist and the set of legal compilation result files; when it is determined that the intersection contains all the files to be loaded in the class loading process, determine that the second matching result is a successful match; when it is determined that the intersection does not contain all the files to be loaded in the class loading process, determine that the second matching result is a failed match.

[0075] For example, when the file to be loaded in the loading process is obtained through the second monitoring point, the security of the file to be loaded needs to be analyzed, that is, the file to be loaded is matched with the legal class files and legal compilation result files in the pre-stored white list. The specific matching method is to traverse all legal class files and all legal compilation result files in the white list, and determine the intersection of the set of all legal class files and the set of all legal compilation result files. For example, the set of all legal class files includes file 1, file 2 and file 3, and the set of all legal compilation result files includes file 2 and file 3, then the files included in the intersection are file 2 and file 3; when determining the intersection, find out whether the file to be loaded is included in the intersection. If the file to be loaded is included in the intersection, the second matching result is determined to be a successful match; if the file to be loaded is not included in the intersection, the second matching result is determined to be a failed match.

[0076] It should be noted that matching the file to be loaded with the legal class files and legal compilation result files included in the whitelist can be achieved by matching the name or identifier of the file to be loaded with the name or identifier of the legal class files in the whitelist, and the name or identifier of the legal compilation result files. The present invention is not limited to this.

[0077] Step 106: Determine whether the file to be loaded is safe based on the second matching result.

[0078] Specifically, when the second matching result is a matching failure, it is determined that the file to be loaded is unsafe; when the second matching result is a matching success, it is determined that the file to be loaded is safe.

[0079] For example, when the second matching result is a matching failure, it means that the file to be loaded is an unknown file (for example, a malicious file that can carry out an attack), so it can be determined that the file to be loaded is an unsafe file; when the second matching result is a matching success, it means that the file to be loaded is a known legal file, so it can be determined that the file to be loaded is a safe file.

[0080] In addition, when it is determined that the file to be loaded is an unsafe file, warning information may be generated and stored or output, so that the user can be informed of the unsafe file to be loaded.

[0081] The security protection method provided by an embodiment of the present invention, when determining the safety of a file to be compiled, further obtains the file to be loaded during the class loading process through a second monitoring point, matches the file to be loaded with legal class files and legal compilation result files in a whitelist, and finally determines whether the file to be loaded is safe based on the second matching result. This ensures the security of the files to be compiled and loaded, thereby preventing attacks on the network caused by the upload of unknown files to be compiled and loaded, and achieving further security protection for the network.

[0082] Figure 3 This is the third flow chart of the security protection method provided by the embodiment of the present invention, such as Figure 3 As shown, the security protection method also includes the following steps:

[0083] Step 107: Scan the deployment code to obtain legal files in the deployment code, and record the legal files in the whitelist.

[0084] The deployment code may be the deployment code of a specific project; and the legal files in the whitelist may be all legal files involved in the deployment code.

[0085] For example, the deployment code is scanned and analyzed to obtain all types of files in the deployment code, and all types of files are recorded as legal files in a whitelist. Specifically, the names or identifiers of all types of files can be recorded in the whitelist.

[0086] It should be noted that step 107 may be performed before step 102 or before step 101, and the present invention does not limit this.

[0087] Figure 4 This is a fourth flow chart of the security protection method provided by an embodiment of the present invention, such as Figure 4 As shown, after executing step 107, the security protection method further includes the following steps:

[0088] Step 108: Determine the class files that inherit the compilation specification in the legal files, and record the class files that inherit the compilation specification in the whitelist.

[0089] For example, when all types of files in the deployment code are analyzed and obtained, class files that inherit the compilation specification are selected from all types of files, and the names or identifiers of the class files that inherit the compilation specification are recorded in a whitelist.

[0090] Figure 5 This is a fifth flow chart of the security protection method provided by the embodiment of the present invention, such as Figure 5 As shown, the security protection method also includes the following steps:

[0091] Step 109: Acquire a legal compilation result file corresponding to the to-be-compiled file through the first monitoring point, and record the legal compilation result file in the whitelist.

[0092] For example, when the program reaches the first monitoring point, legal compilation result files corresponding to the files to be compiled may be obtained, and the names or identifiers of all legal compilation result files may be recorded in a whitelist.

[0093] It should be noted that the above step 109 can be performed before any step before step 105, and the present invention does not limit this.

[0094] The security protection method provided by the embodiment of the present invention records all legal files in the deployed code, all class files that inherit the compilation specifications, and all legal compilation result files in a whitelist in advance in the scenario of attacks caused by arbitrary file uploads, so as to facilitate the whitelist-based security protection idea to avoid attacks on the network caused by uploading unknown files to be compiled or unknown files to be loaded.

[0095] Figure 6 FIG. 1 is a schematic diagram of the structure of the safety protection device provided by an embodiment of the present invention. Figure 6 As shown, the security protection device includes a first acquisition unit 601, a first matching unit 602 and a first determination unit 603; wherein:

[0096] A first acquiring unit 601 is configured to acquire a file to be compiled read during a compilation process through a first monitoring point;

[0097] A first matching unit 602 is configured to match the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0098] The first determining unit 603 is configured to determine whether the file to be compiled is safe based on the first matching result.

[0099] The security protection device provided by an embodiment of the present invention obtains the to-be-compiled file read during the compilation process through a first monitoring point, matches the to-be-compiled file with the legal files included in a whitelist, and finally determines whether the to-be-compiled file is safe based on the first matching result. As can be seen, the present invention only allows the compilation of known legal files on the whitelist and prohibits the compilation of unknown to-be-compiled files. This follows a whitelist-based protection approach. Even if the to-be-compiled file has been uploaded, it cannot be compiled, thereby preventing attacks caused by the upload of unknown to-be-compiled files and achieving network security protection.

[0100] Based on any of the foregoing embodiments, the first matching unit 602 is specifically configured to:

[0101] When it is determined that the legal files included in the whitelist include all the files to be compiled read during the compilation process, determining that the first matching result is a successful match;

[0102] When it is determined that the legal files included in the whitelist do not include all the to-be-compiled files read during the compilation process, the first matching result is determined to be a matching failure.

[0103] Based on any of the above embodiments, the whitelist also includes legal class files that inherit the compilation specification and legal compilation result files corresponding to the file to be compiled; the legal class files are files in the legal files; the device also includes:

[0104] a second acquiring unit, configured to acquire the file to be loaded in the class loading process through a second monitoring point when it is determined that the file to be compiled is safe based on the first matching result;

[0105] A second matching unit is used to match the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result;

[0106] The second determining unit is configured to determine whether the file to be loaded is safe based on the second matching result.

[0107] Based on any of the foregoing embodiments, the second matching unit is specifically configured to:

[0108] Determine the intersection of a set of legal class files in the whitelist and a set of legal compilation result files;

[0109] When it is determined that the intersection contains all the files to be loaded in the class loading process, determining the second matching result as a successful match;

[0110] When it is determined that the intersection does not include all the files to be loaded in the class loading process, the second matching result is determined to be a matching failure.

[0111] Based on any of the above embodiments, the device further includes:

[0112] The scanning unit is used to scan the deployment code, obtain legal files in the deployment code, and record the legal files in the whitelist.

[0113] Based on any of the above embodiments, the device further includes:

[0114] The third determining unit is configured to determine the class files that inherit the compilation specification in the legal file, and record the class files that inherit the compilation specification in the whitelist.

[0115] Based on any of the above embodiments, the device further includes:

[0116] The third obtaining unit is configured to obtain a legal compilation result file corresponding to the file to be compiled through the first monitoring point, and record the legal compilation result file in the whitelist.

[0117] Based on any of the foregoing embodiments, the second determining unit is specifically configured to:

[0118] When the second matching result is a matching failure, determining that the file to be loaded is unsafe;

[0119] When the second matching result is a successful match, it is determined that the file to be loaded is safe.

[0120] Based on any of the foregoing embodiments, the first determining unit 603 is specifically configured to:

[0121] When the first matching result is a matching failure, determining that the file to be compiled is unsafe;

[0122] When the first matching result is a successful match, it is determined that the file to be compiled is safe.

[0123] Figure 7 FIG is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other via the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the following method: obtaining a file to be compiled read during the compilation process through a first monitoring point;

[0124] Matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0125] Determine whether the file to be compiled is safe based on the first matching result.

[0126] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0127] On the other hand, the present invention further provides a computer program product, the computer program product including a computer program, the computer program being storable on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can execute the security protection method provided by the above methods, the method including: obtaining, through a first monitoring point, a file to be compiled read during a compilation process;

[0128] Matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0129] Determine whether the file to be compiled is safe based on the first matching result.

[0130] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the security protection method provided by the above methods is implemented, the method comprising: obtaining, through a first monitoring point, a file to be compiled read during a compilation process;

[0131] Matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result;

[0132] Determine whether the file to be compiled is safe based on the first matching result.

[0133] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0134] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A safety protection method, characterized in that: include: Obtaining the file to be compiled read during the compilation process through the first monitoring point; Matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result; Determining whether the file to be compiled is safe based on the first matching result; The whitelist also includes legal class files that inherit the compilation specification and legal compilation result files corresponding to the files to be compiled; The legal category files are files in the legal files; The method further comprises: When it is determined that the file to be compiled is safe based on the first matching result, obtaining the file to be loaded in the class loading process through a second monitoring point, where the file to be loaded is a compilation result file corresponding to the file to be compiled; Matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result; Determine whether the file to be loaded is safe based on the second matching result.

2. The safety protection method according to claim 1, characterized in that: The step of matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result includes: When it is determined that the legal files included in the whitelist include all the files to be compiled read during the compilation process, determining that the first matching result is a successful match; When it is determined that the legal files included in the whitelist do not include all the to-be-compiled files read during the compilation process, the first matching result is determined to be a matching failure.

3. The safety protection method according to claim 1, characterized in that: The step of matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result includes: Determine the intersection of a set of legal class files in the whitelist and a set of legal compilation result files; When it is determined that the intersection contains all the files to be loaded in the class loading process, determining the second matching result as a successful match; When it is determined that the intersection does not include all the files to be loaded in the class loading process, the second matching result is determined to be a matching failure.

4. The safety protection method according to any one of claims 1 to 3, characterized in that: Before matching the file to be compiled with the legal files included in the whitelist to obtain a first matching result, the method further includes: The deployment code is scanned to obtain legal files in the deployment code, and the legal files are recorded in the whitelist.

5. The safety protection method according to claim 4, characterized in that: The method further comprises: Class files that inherit the compilation specification are determined in the legal files, and the class files that inherit the compilation specification are recorded in the whitelist.

6. The safety protection method according to claim 1, characterized in that: Before matching the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result, the method further includes: Obtain a legal compilation result file corresponding to the file to be compiled through the first monitoring point, and record the legal compilation result file in the whitelist.

7. The safety protection method according to claim 1, characterized in that: The determining whether the file to be loaded is safe based on the second matching result includes: When the second matching result is a matching failure, determining that the file to be loaded is unsafe; When the second matching result is a successful match, it is determined that the file to be loaded is safe.

8. The safety protection method according to claim 1, characterized in that: The determining whether the file to be compiled is safe based on the first matching result includes: When the first matching result is a matching failure, determining that the file to be compiled is unsafe; When the first matching result is a successful match, it is determined that the file to be compiled is safe.

9. A safety protection device, characterized in that: include: A first acquiring unit, configured to acquire, through a first monitoring point, a file to be compiled that is read during the compilation process; a first matching unit, configured to match the file to be compiled with the legal files included in the whitelist to obtain a first matching result; a first determining unit, configured to determine whether the file to be compiled is safe based on the first matching result; The device further comprises: a second acquiring unit, configured to acquire, through a second monitoring point, a file to be loaded during the class loading process, when it is determined that the file to be compiled is safe based on the first matching result, the file to be loaded being a compilation result file corresponding to the file to be compiled; A second matching unit is used to match the file to be loaded with the legal class files and legal compilation result files in the whitelist to obtain a second matching result; The second determining unit is configured to determine whether the file to be loaded is safe based on the second matching result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the security protection method according to any one of claims 1 to 8 is implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the security protection method according to any one of claims 1 to 8 is implemented.

12. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by the processor, the processor implements the security protection method as described in any one of claims 1 to 8.

Images