Application program intrusion detection method and device, storage medium and electronic device

Abstract

The present disclosure relates to the field of computer technology, and to an intrusion detection method and device for an application, a computer-readable storage medium, and an electronic device, including: extracting behavioral features of a sample program, dividing the behavioral features into behavioral feature sets corresponding to the corresponding behavioral layers, the behavioral features including static behavioral features and dynamic behavioral features; updating the intrusion behavior feature sets of each of the behavioral layers according to the matching results of the behavioral feature sets and the intrusion behavior feature sets corresponding to the corresponding behavioral layers, the intrusion behavior feature sets are obtained according to the intrusion behavior features in the behavioral features; and performing intrusion detection on each of the behavioral layers of the application based on the updated intrusion behavior feature sets. The present disclosure can improve the comprehensiveness of intrusion detection of the application and ensure the safe operation of the application.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and more specifically, to an application intrusion detection method, an application intrusion detection device, a computer-readable storage medium, and an electronic device. Background Art

[0002] During the use of applications, they are subject to security threats from various aspects such as security vulnerabilities, malicious codes, illegal attacks or misoperations by users. The protection of application systems should not rely on external systems, and applications should have the ability to defend themselves.

[0003] However, the application programs in the related technologies cannot fully and effectively perform intrusion detection during operation, and the security of the application programs is difficult to ensure.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an application intrusion detection method and device, a computer-readable storage medium and an electronic device, thereby improving the comprehensiveness of the security defense of the application.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a method for intrusion detection of an application is provided, comprising:

[0008] Extracting behavioral features of the sample program, and dividing the behavioral features into behavioral feature sets corresponding to the corresponding behavioral layers, wherein the behavioral features include static behavioral features and dynamic behavioral features;

[0009] According to the matching result of the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, respectively updating the intrusion behavior feature set of each behavior layer, wherein the intrusion behavior feature set is obtained according to the intrusion behavior features of the sample program with intrusion threat;

[0010] Based on the updated intrusion behavior feature set, intrusion detection is performed on each of the behavior layers of the application program.

[0011] In an exemplary embodiment of the present disclosure, extracting the behavior features of the sample program and dividing the behavior features into behavior feature sets corresponding to the corresponding behavior layers include:

[0012] Extracting behavioral features of the sample program by static analysis to obtain the static behavioral features;

[0013] Extracting behavior features of the sample program using a dynamic analysis method to obtain the dynamic behavior features;

[0014] According to the type of the behavior layer to which they belong, the static behavior features and the dynamic behavior features are divided into behavior feature sets corresponding to different types of behavior layers.

[0015] In an exemplary embodiment of the present disclosure, before respectively updating the intrusion behavior feature set of each behavior layer according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, the method further includes: acquiring the intrusion behavior feature set;

[0016] The obtaining of the intrusion behavior feature set includes:

[0017] Extracting intrusion behavior features of the sample program with intrusion threats;

[0018] The intrusion behavior features are divided into behavior feature sets corresponding to the corresponding behavior layers, so as to obtain intrusion behavior feature sets corresponding to different types of behavior layers.

[0019] In an exemplary embodiment of the present disclosure, updating the intrusion behavior feature set of each behavior layer respectively according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer includes:

[0020] For any type of behavior layer, feature matching is performed between the behavior feature set and the intrusion behavior feature set;

[0021] If the behavior feature set contains a target behavior feature that does not match the intrusion behavior feature set, the intrusion behavior feature set is updated according to the target behavior feature.

[0022] In an exemplary embodiment of the present disclosure, the extracting behavior features of the sample program further includes:

[0023] Performing dynamic and static analysis on the behavior characteristics to determine intrusion detection results of the behavior characteristics;

[0024] If there is a target behavior feature in the behavior feature set that does not match the intrusion behavior feature set, updating the intrusion behavior feature set according to the target behavior feature includes:

[0025] If the intrusion detection type of the target behavior feature is threat behavior, the target behavior feature is added to the intrusion behavior feature set.

[0026] In an exemplary embodiment of the present disclosure, the performing intrusion detection on each behavior layer of the application based on the updated intrusion behavior feature set includes:

[0027] Determine the protection triggering conditions corresponding to each type of behavior layer according to the updated intrusion behavior feature set;

[0028] During the operation of the application program, intrusion detection is performed for each type of behavior layer using the corresponding protection trigger conditions.

[0029] In an exemplary embodiment of the present disclosure, the performing intrusion detection on each behavior layer of the application based on the updated intrusion behavior feature set further includes:

[0030] Determine the protection strategy corresponding to each type of behavior layer according to the updated intrusion behavior feature set;

[0031] If the intrusion behavior characteristics of the target behavior layer meet the corresponding protection trigger conditions, the corresponding target protection strategy will be triggered.

[0032] In an exemplary embodiment of the present disclosure, the method further includes:

[0033] Extracting candidate behavior features of the application at the target behavior layer;

[0034] If the intrusion detection type of the candidate behavior feature is threat behavior, the candidate behavior feature is used to update the intrusion behavior feature set.

[0035] According to one aspect of the present disclosure, there is provided an intrusion detection device for an application program, the device comprising:

[0036] A feature extraction module is used to extract the behavior features of the sample program and divide the behavior features into behavior feature sets corresponding to the corresponding behavior layers, wherein the behavior feature data includes static behavior features and dynamic behavior features;

[0037] A feature set updating module, used to update the intrusion behavior feature set according to the matching result between the behavior feature set of each behavior layer and the corresponding intrusion behavior feature set, wherein the intrusion behavior feature set is obtained according to the intrusion behavior features of the sample program with intrusion threat;

[0038] The detection module is used to perform intrusion detection of the application program on each of the behavior layers based on the updated intrusion behavior feature set.

[0039] According to one aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any one of the above methods is implemented.

[0040] According to one aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned methods by executing the executable instructions.

[0041] The intrusion detection method for an application in an exemplary embodiment of the present disclosure, on the one hand, improves the comprehensiveness of the behavior characteristics of the sample program by simultaneously extracting static behavior characteristics and dynamic behavior characteristics; on the other hand, the intrusion behavior feature sets obtained by the intrusion behavior characteristics in the behavior characteristics are matched with the behavior feature sets corresponding to the corresponding behavior layers, so as to update the intrusion behavior feature sets of the corresponding behavior layers according to the matching results, thereby realizing dynamic updating of the intrusion behavior set of each behavior layer, so as to use the updated intrusion behavior feature sets to perform intrusion detection on each behavior layer, thereby avoiding missing intrusion characteristics and improving the appearance accuracy of intrusion detection of the application at each behavior layer; on the other hand, the intrusion behavior feature set is updated by matching the intrusion behavior feature set with the behavior feature set, and then the updated intrusion behavior feature set is applied to the self-protection of the application, thereby improving the running security of the application.

[0042] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The above and other objects, features and advantages of the exemplary embodiments of the present disclosure will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present disclosure are shown in an exemplary and non-limiting manner, in which:

[0044] Figure 1 An application scenario diagram according to an exemplary embodiment of the present disclosure is shown;

[0045] Figure 2 A flowchart of an intrusion detection method for an application according to an exemplary embodiment of the present disclosure is shown;

[0046] Figure 3 An architectural diagram showing an application scenario of an intrusion detection method for an application program according to an exemplary embodiment of the present disclosure;

[0047] Figure 4 A schematic diagram of a self-protection process of an application based on RASP in an application scenario according to an exemplary embodiment of the present disclosure is shown;

[0048] Figure 5 A schematic diagram of the architecture of an intrusion detection device for an application according to an exemplary embodiment of the present disclosure is shown;

[0049] Figure 6 A block diagram of an electronic device according to an exemplary embodiment of the present disclosure is shown.

[0050] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0051] The exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the present disclosure will be more comprehensive and complete and the concepts of the exemplary embodiments will be fully conveyed to those skilled in the art. The same reference numerals in the figures represent the same or similar structures, and thus their detailed description will be omitted.

[0052] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0053] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0054] In the related technologies in this field, during the use of the application, the application is subject to security threats from security vulnerabilities, malicious code, illegal attacks or misoperation by users, etc. The protection of the application system should not rely on external systems, and the application should have the ability to defend itself.

[0055] In the related technology, in the intrusion detection based on program behavior analysis technology, static behavior analysis of the application is used to perform intrusion detection on the application. However, static analysis is prone to false alarms, while dynamic behavior analysis of the application is prone to false alarms, which affects the overall effectiveness of intrusion detection.

[0056] Based on this, in an exemplary embodiment of the present disclosure, a method for detecting intrusion of an application is first provided. Figure 1 FIG. 1 is an application scenario diagram involved in the exemplary embodiment of the present disclosure. Figure 1 As shown, during the operation of the application, it may be subject to security threats such as security vulnerabilities, malicious code, illegal attacks by users or misoperation, which may affect the normal operation of the application. By performing intrusion detection on the application, the application is equipped with the ability of self-protection, and self-protection is achieved during the operation of the application. Among them, the application can be an application installed on an electronic device, and the electronic device can be, for example, a smart phone, a tablet computer, a desktop computer, a wearable electronic device, etc., which is not limited here.

[0057] It is worth noting that in order to enable an application to have the ability of intrusion detection, an injection method can be used to inject it into the application so that the application has this ability; or, a non-injection method can be used to add the above intrusion detection capability to the application, such as the anchor method, and the embodiments of the present disclosure do not make special limitations on this.

[0058] like Figure 2 A flowchart of an intrusion detection method for an application according to an embodiment of the present disclosure is shown. Figure 2 As shown, the intrusion detection method of the application program in the embodiment of the present disclosure may include steps S210 to S230:

[0059] Step S210: extracting behavior features of the sample program, and dividing the behavior features into behavior feature sets corresponding to the corresponding behavior layers, wherein the behavior features include static behavior features and dynamic behavior features;

[0060] Step S220: updating the intrusion behavior feature set of each behavior layer respectively according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, wherein the intrusion behavior feature set is obtained according to the intrusion behavior feature of the sample program with intrusion threat;

[0061] Step S230: Based on the updated intrusion behavior feature set, perform intrusion detection on each behavior layer of the application program.

[0062] According to the intrusion detection method for applications in the embodiments of the present disclosure, the comprehensiveness of the behavior characteristics of the sample program is improved by extracting static behavior characteristics and dynamic behavior characteristics at the same time; the intrusion behavior feature sets obtained from the intrusion behavior characteristics in the behavior characteristics are matched with the behavior feature sets corresponding to the corresponding behavior layers respectively, so as to update the intrusion behavior feature sets of the corresponding behavior layers according to the matching results, thereby realizing dynamic updating of the intrusion behavior set of each behavior layer, so as to perform intrusion detection on each behavior layer using the updated intrusion behavior feature sets, thereby avoiding missing intrusion characteristics and improving the apparent accuracy of application detection; the intrusion behavior feature sets are updated by matching the intrusion behavior feature sets with the behavior feature sets, and then the updated intrusion behavior feature sets are applied to the self-protection of the application, thereby improving the running security of the application.

[0063] Combine the following Figure 2 The intrusion detection method of the application program of the embodiment of the present disclosure is described in detail.

[0064] In step S210, the behavior features of the sample program are extracted, and the behavior features are divided into behavior feature sets corresponding to the corresponding behavior layers.

[0065] In the exemplary embodiments of the present disclosure, the behavior features include static behavior features and dynamic behavior features. An analysis mode that combines static behavior analysis and dynamic behavior analysis of an application program is used to extract behavior features of a sample program by static analysis to obtain static behavior features, and to extract features of a sample program by dynamic analysis to obtain dynamic behavior features. Among them, static analysis methods include but are not limited to disassembly, static file analysis, control flow analysis, and data flow analysis, etc.; dynamic analysis methods include but are not limited to state analysis, system scheduling analysis, and dynamic tracking, etc., which are not specifically limited here.

[0066] The behavior characteristics of the sample program extracted include the intrusion behavior characteristics of the sample program and the non-intrusion behavior characteristics of the sample program.

[0067] In an exemplary embodiment, while extracting the static behavior features and dynamic behavior features of the sample program, each behavior feature may also be subjected to dynamic and static analysis to determine the intrusion detection result of each behavior feature.

[0068] The dynamic and static analysis methods include static analysis and dynamic analysis. By adopting the above dynamic and static analysis methods, the intrusion detection results of the behavior characteristics can be determined at the same time. The intrusion detection results indicate whether the behavior characteristics are threatening behaviors.

[0069] The disclosed embodiments improve the comprehensiveness of behavioral features by combining static behavior analysis and dynamic behavior analysis, thereby increasing the feature width of intrusion detection of application programs.

[0070] In an exemplary embodiment, the behavior features of the extracted sample programs are grouped according to the type of the behavior layer to which the behavior features belong, so as to obtain behavior feature sets corresponding to different behavior layers.

[0071] The behavior layer includes network access layer, file access layer, process startup layer, registry layer, system service layer and other behavior layers, etc. The extracted behavior features are divided into various types of behavior layers to obtain a behavior feature set corresponding to each behavior layer.

[0072] Exemplarily, the behavioral feature set of the network access layer includes email monitoring features, web page monitoring features, port monitoring features, etc.; the behavioral feature set of the file access layer includes file type monitoring features, file call monitoring features, etc.; the behavioral feature set of the process startup layer includes process monitoring features, etc., which are not listed one by one.

[0073] By dividing the behavioral features into the behavioral feature sets corresponding to the corresponding behavioral layers, the behavioral features can be organized in layers, clearly reflecting the behavioral features of each behavioral layer of the application. This allows targeted analysis of each behavioral layer during intrusion analysis and detection, thereby improving the accuracy and completeness of the overall behavioral analysis of the application.

[0074] In step S220, the intrusion behavior feature sets of each behavior layer are updated respectively according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer.

[0075] In an exemplary embodiment of the present disclosure, the intrusion behavior feature set is obtained based on the intrusion behavior features of a sample program that has an intrusion threat, that is, the intrusion behavior features are extracted from the sample program that has an intrusion threat to obtain the intrusion behavior feature set.

[0076] Similar to the processing method of the behavior feature set of the sample program, the embodiment of the present disclosure also needs to group the extracted intrusion behavior features according to the type of the behavior layer to which they belong. Therefore, before updating the intrusion behavior feature set of each behavior layer respectively according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer to which it belongs, the intrusion behavior feature set can be obtained first, which can include the following steps:

[0077] Extract intrusion behavior features of sample programs that pose intrusion threats;

[0078] The intrusion behavior features are divided into behavior feature sets corresponding to the behavior layers to which they belong, and intrusion behavior feature sets corresponding to different types of behavior layers are obtained.

[0079] In an exemplary embodiment, various sample programs that pose intrusion threats can be obtained, and intrusion behavior feature samples of the sample programs that pose intrusion threats can be obtained, and the intrusion behavior feature samples can be divided into intrusion behavior feature sample sets corresponding to different behavior layers. The intrusion behavior feature sample sets of each layer are then used to train a feature extraction model to obtain feature extraction models corresponding to each behavior layer.

[0080] Furthermore, for sample programs with intrusion threats, a pre-trained feature extraction model for each behavior layer may be used to extract intrusion behavior features for the sample programs with intrusion threats, thereby obtaining an intrusion behavior feature set for each behavior layer.

[0081] Based on the behavior characteristics of sample programs with intrusion threats, intrusion behavior feature sets of each behavior layer are extracted, so as to use the intrusion behavior feature sets of each behavior layer to perform targeted intrusion detection on each behavior layer of the application program.

[0082] In an exemplary embodiment, for each behavior layer, according to the matching result of the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, the intrusion behavior feature set of the behavior layer is updated, so as to realize the hierarchical update of the intrusion behavior feature set, and each layer does not interfere with each other, thereby ensuring the comprehensive accuracy of the intrusion behavior features of each layer. According to the matching result of the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, respectively updating the intrusion behavior feature set of each behavior layer may include:

[0083] For any type of behavior layer, feature matching is performed between the behavior feature set and the intrusion behavior feature set;

[0084] If there is a target behavior feature in the behavior feature set that does not match the intrusion behavior feature set, the intrusion behavior feature set is updated according to the target behavior feature.

[0085] Exemplarily, if the behavior feature set of the network access layer is {a, b, c, d, e} and the intrusion behavior feature set of the network access layer is {a, b, d}, then the target behavior features are determined to be c and e, and the intrusion behavior feature set can be updated according to the target behavior features c and e.

[0086] In an exemplary embodiment, although the target behavior feature does not exist in the intrusion behavior feature set, the target behavior feature may be an intrusion behavior feature, but may also be a non-intrusion behavior feature. Since the intrusion detection result of the behavior feature can be determined by dynamic and static analysis of the behavior feature, the intrusion detection results of the target behavior features c and e can be obtained, and it is determined whether to add the target behavior features c and e to the intrusion behavior feature set according to the intrusion detection results.

[0087] Among them, if the intrusion detection type of the target behavior feature is threat behavior, the target behavior feature is added to the intrusion behavior feature set. That is to say, only the target behavior feature determined as the threat behavior feature is added to the intrusion behavior feature set, ensuring that the intrusion behavior feature set can accurately reflect the threat characteristics of the sample program, avoiding the introduction of non-intrusion behavior features, and improving the accuracy of application intrusion detection based on the intrusion behavior feature set.

[0088] It is worth noting that the feature matching and updating between each behavior layer are performed independently and do not interfere with each other, which improves the accuracy and completeness of the intrusion behavior feature set of each behavior layer.

[0089] In step S230, intrusion detection is performed on each behavior layer of the application based on the updated intrusion behavior feature set.

[0090] In an exemplary embodiment of the present disclosure, intrusion detection may be performed on each behavior layer of the application program according to the updated intrusion behavior feature set of each behavior layer.

[0091] Among them, the protection trigger conditions corresponding to each type of behavior layer can be determined according to the updated intrusion behavior feature set, that is, the corresponding protection trigger conditions are determined at each level. During the operation of the application, for each type of behavior layer, the corresponding protection trigger conditions are used to perform intrusion detection.

[0092] When the behavior characteristics of each behavior layer meet the protection triggering conditions, a protection response is performed. The protection strategy corresponding to each type of behavior layer can be determined based on the updated intrusion behavior feature set. If the intrusion behavior characteristics of the target behavior layer meet the corresponding protection triggering conditions, the corresponding target protection strategy is triggered.

[0093] For example, if the number of intrusion behavior features in the network access layer is greater than a preset number threshold (protection trigger condition), the corresponding target protection strategy is triggered. The number threshold can be dynamically adjusted according to the specific business type, such as 1, 2, 3, etc., and there is no special limitation on this.

[0094] Among them, different behavior layers correspond to different target protection strategies. For example, the target protection strategies of the network access layer and the file access layer are different, which are determined according to the actual intrusion detection strategy.

[0095] It is worth noting that different applications may correspond to different business types, so the target protection strategy of the same behavior layer of different applications may also be different. For example, the target protection strategy of the file access layer of an instant messaging application may be different from that of the file access layer of a music application.

[0096] The target protection strategy can be targeted at different protection methods of the application, and can also be determined according to the threat level of the intrusion behavior characteristics of the target behavior layer. For example, issuing an alarm and allowing continued access to the application, issuing an alarm and blocking continued access to the application, and so on.

[0097] Based on the updated intrusion behavior feature set, the disclosed embodiment can design a more comprehensive self-protection strategy for the application, implement intrusion detection on each behavior layer of the application, ensure the comprehensiveness of the intrusion detection of the application, and protect the security of the application.

[0098] In an exemplary embodiment, candidate behavior features of the application at the target behavior layer may also be extracted. If the intrusion detection type of the candidate behavior features is threat behavior, the candidate behavior features are used to update the intrusion behavior feature set.

[0099] Among them, after determining that there is an intrusion threat in the target behavior layer based on the updated intrusion behavior feature set, the behavior features in the target behavior layer (candidate behavior features) can also be extracted, and when the dynamic and static behavior features are extracted based on the dynamic and static analysis method, the intrusion detection results of the candidate behavior features are determined at the same time. Therefore, if the intrusion detection type of the candidate behavior feature is a threat behavior, the candidate behavior feature can be added to the intrusion behavior feature set.

[0100] The disclosed embodiment performs intrusion detection on an application through an updated intrusion behavior feature set, and then updates the intrusion behavior feature set again based on candidate behavior features obtained from the intrusion detection results, thereby forming a mutual verification between the intrusion detection and the updated intrusion behavior feature set, thereby improving the accuracy of application intrusion detection, and also improving the integrity of the intrusion behavior feature set, thereby improving the overall effectiveness of application intrusion detection.

[0101] Figure 3 The architecture diagram of the application scenario of the intrusion detection method of the application program is shown as follows: Figure 3 As shown, after obtaining the updated intrusion behavior feature set, an application self-detection and protection strategy is designed based on the intrusion behavior feature set, such as applying the intrusion behavior feature set to RASP (Running Time Application Self-Protection).

[0102] like Figure 3 The intrusion detection device 300 for application programs includes a feature extraction module 310, a feature layered analysis module 320, and a feature identification module 330. The updated intrusion behavior feature set obtained by the feature identification module 330 is applied to the RASP to perform intrusion detection on the running application programs.

[0103] Accordingly, Figure 4 The flowchart of the self-protection of the RASP-based application program in the application scenario is shown. Based on the updated intrusion behavior feature set, corresponding protection trigger conditions are set at each behavior layer of the application program.

[0104] Combine the following Figure 3 and Figure 4 , the intrusion detection method of the application program of the embodiment of the present disclosure is described.

[0105] 1) The behavior features of the sample program are extracted through the feature extraction module 310.

[0106] Behavioral characteristics include static behavioral characteristics obtained through static analysis and dynamic behavioral characteristics obtained through dynamic analysis.

[0107] 2) The extracted behavior features are divided into behavior feature sets corresponding to the corresponding behavior layers through the feature hierarchical analysis module 320 .

[0108] By analyzing and sorting the behavior features, the behavior features are divided into behavior feature sets corresponding to different behavior layers, including network access layer, file access layer, startup layer, system service layer, etc.

[0109] 3) The behavior feature set is matched with the intrusion behavior feature set corresponding to the behavior layer through the feature identification module 330.

[0110] For any type of behavior layer, the behavior feature set is feature matched with the intrusion behavior feature set by the feature identification module 330. If there is a target behavior feature in the behavior feature set that does not match the intrusion behavior feature set, the intrusion behavior feature set is updated according to the target behavior feature, so as to apply the updated intrusion behavior feature set to RASP, such as designing a RASP application system based on the intrusion behavior feature set to increase the strength and breadth of the application program's self-detection and protection. The intrusion behavior feature set is obtained based on the intrusion behavior features extracted from the sample program with intrusion threats.

[0111] Among them, RASP can perform self-protection of applications based on the updated intrusion behavior feature set, including:

[0112] At each behavior layer of the application, set the corresponding protection trigger conditions and protection strategies according to the updated intrusion behavior feature set. Figure 4 During the operation of the application, when the user accesses or is attacked, if the intrusion behavior characteristics of the target behavior layer meet the corresponding protection trigger conditions, the corresponding target protection strategy will be triggered, so that the application can achieve self-protection during runtime.

[0113] In addition, if the application performs normal access, the target protection policy will not be triggered and the normal operation of the application will not be affected.

[0114] It should be noted that this exemplary embodiment uses the application of the intrusion behavior feature set to RASP as an example for explanation, and the intrusion behavior feature set can also be applied to and provide a reference for the design of other protection systems.

[0115] The intrusion detection method for an application in an exemplary embodiment of the present disclosure improves the comprehensiveness of the behavior characteristics of a sample program by simultaneously extracting static behavior characteristics and dynamic behavior characteristics; on the other hand, the intrusion behavior feature sets obtained from the intrusion behavior characteristics in the behavior characteristics are matched with the behavior feature sets corresponding to the corresponding behavior layers, so as to update the intrusion behavior feature sets of the corresponding behavior layers according to the matching results, thereby realizing dynamic updating of the intrusion behavior set of each behavior layer, so as to perform intrusion detection on each behavior layer using the updated intrusion behavior feature sets, thereby avoiding missing intrusion characteristics and improving the apparent accuracy of application detection; in addition, the intrusion behavior feature sets are updated by matching the intrusion behavior feature sets with the behavior feature sets, and then the updated intrusion behavior feature sets are applied to RASP to perform self-protection of the application, thereby improving the comprehensiveness and effectiveness of the self-protection of the runtime application.

[0116] In addition, based on the updated intrusion behavior feature set, it will help to set protection trigger conditions and protection strategies for different behavioral levels of applications, provide a reference for designing more comprehensive application self-detection and protection strategies, and have practical significance for further promoting the application of applications.

[0117] In addition, according to an exemplary embodiment of the present disclosure, an intrusion detection device for an application is also provided, such as Figure 5 As shown, the device 500 includes:

[0118] A feature extraction module 510 is used to extract the behavior features of the sample program and classify the behavior features into a behavior feature set corresponding to the behavior layer to which they belong, wherein the behavior feature data includes static behavior features and dynamic behavior features;

[0119] A feature set updating module 520, configured to update the intrusion behavior feature set according to the matching result between the behavior feature set of each behavior layer and the corresponding intrusion behavior feature set, wherein the intrusion behavior feature set is obtained according to the intrusion behavior features of the sample program with intrusion threat;

[0120] The detection module 530 is used to perform intrusion detection of the application program on each of the behavior layers based on the updated intrusion behavior feature set.

[0121] In an exemplary embodiment of the present disclosure, the feature extraction module 510 may include:

[0122] A first analysis unit, configured to extract behavior features from the sample program by static analysis to obtain the static behavior features;

[0123] A second analysis unit is used to extract behavior features of the sample program by dynamic analysis to obtain the dynamic behavior features;

[0124] The feature stratification unit is used to classify the static behavior features and the dynamic behavior features into behavior feature sets corresponding to different types of behavior layers according to the types of the behavior layers to which they belong.

[0125] In an exemplary embodiment of the present disclosure, the intrusion detection device 500 for an application further includes: an intrusion behavior feature set acquisition module, configured to acquire the intrusion behavior feature set;

[0126] The intrusion behavior feature set acquisition module is configured as follows:

[0127] Extract intrusion behavior features of sample programs that pose intrusion threats;

[0128] The intrusion behavior features are divided into behavior feature sets corresponding to the corresponding behavior layers, so as to obtain intrusion behavior feature sets corresponding to different types of behavior layers.

[0129] In an exemplary embodiment of the present disclosure, the feature set updating module 520 is configured to:

[0130] For any type of behavior layer, feature matching is performed between the behavior feature set and the intrusion behavior feature set;

[0131] If the behavior feature set contains a target behavior feature that does not match the intrusion behavior feature set, the intrusion behavior feature set is updated according to the target behavior feature.

[0132] In an exemplary embodiment of the present disclosure, the feature extraction module 510 is further configured to:

[0133] Performing dynamic and static analysis on the behavior characteristics to determine intrusion detection results of the behavior characteristics;

[0134] If there is a target behavior feature in the behavior feature set that does not match the intrusion behavior feature set, updating the intrusion behavior feature set according to the target behavior feature includes:

[0135] If the intrusion detection type of the target behavior feature is threat behavior, the target behavior feature is added to the intrusion behavior feature set.

[0136] In an exemplary embodiment of the present disclosure, the detection module 530 further includes:

[0137] A first determining unit, configured to determine protection triggering conditions corresponding to each type of behavior layer according to the updated intrusion behavior feature set;

[0138] The detection unit is used to perform intrusion detection on each type of behavior layer during the operation of the application program by using the corresponding protection trigger conditions.

[0139] In an exemplary embodiment of the present disclosure, the detection module 530 further includes:

[0140] A second determining unit, configured to determine a protection strategy corresponding to each type of behavior layer according to the updated intrusion behavior feature set;

[0141] The protection unit is used to trigger the corresponding target protection strategy if the intrusion behavior characteristics of the target behavior layer meet the corresponding protection trigger conditions.

[0142] In an exemplary embodiment of the present disclosure, the intrusion detection device 500 for an application further includes:

[0143] A verification module, used for extracting candidate behavior features of the application at the target behavior layer;

[0144] If the intrusion detection type of the candidate behavior feature is threat behavior, the candidate behavior feature is used to update the intrusion behavior feature set.

[0145] Since the specific details of each functional module (unit) of the intrusion detection device for an application program of the exemplary embodiment of the present disclosure have been described in detail in the inventive embodiment of the intrusion detection method for an application program described above, they will not be repeated herein.

[0146] It should be noted that although several modules or units of the intrusion detection device of the application are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be concretized in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be concretized.

[0147] In addition, in the exemplary embodiment of the present disclosure, a computer storage medium capable of implementing the above method is also provided. A program product capable of implementing the above method of this specification is stored thereon. In some possible embodiments, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of this specification.

[0148] The embodiment of the present disclosure also provides a program product for implementing the above method, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0149] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0150] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0151] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0152] Program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0153] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided. It will be appreciated by those skilled in the art that various aspects of the present disclosure may be implemented as a system, method, or program product. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which may be collectively referred to herein as a "circuit", "module", or "system".

[0154] Refer to the following Figure 6 hereinafter describes an electronic device 600 according to such an embodiment of the present disclosure. Figure 6 The electronic device 600 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0155] like Figure 6 As shown, the electronic device 600 is in the form of a general computing device. The components of the electronic device 600 may include but are not limited to: at least one processing unit 610, at least one storage unit 620, a bus 630 connecting different system components (including the storage unit 620 and the processing unit 610), and a display unit 640.

[0156] The storage unit stores program codes, which can be executed by the processing unit 610, so that the processing unit 610 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0157] The storage unit 620 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 621 and / or a cache memory unit 622 , and may further include a read-only memory unit (ROM) 623 .

[0158] The storage unit 620 may also include a program / utility 624 having a set (at least one) of program modules 625, such program modules 625 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0159] Bus 630 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0160] The electronic device 600 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 600, and / or communicate with any device that enables the electronic device 600 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 650. Furthermore, the electronic device 600 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 660. As shown, the network adapter 660 communicates with other modules of the electronic device 600 via a bus 630. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0161] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0162] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0163] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

Claims

1. A method for intrusion detection of an application, characterized in that: include: Extracting behavioral features of the sample program, and dividing the behavioral features into behavioral feature sets corresponding to the corresponding behavioral layers, wherein the behavioral features include static behavioral features and dynamic behavioral features; The behavior layer includes various behavior layers of the application program, each behavior layer includes a network access layer, a file access layer, a process startup layer, a registry layer, a system service layer and other behavior layers; According to the matching result of the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, respectively updating the intrusion behavior feature set of each behavior layer, wherein the intrusion behavior feature set is obtained according to the intrusion behavior features of the sample program with intrusion threat; Based on the updated intrusion behavior feature set, the protection trigger conditions corresponding to each type of behavior layer are determined, and the protection strategy corresponding to each type of behavior layer is determined to perform intrusion detection on each behavior layer of the application; wherein, if there is an intrusion behavior feature of the target behavior layer that meets the corresponding protection trigger condition, the corresponding target protection strategy is triggered, and the candidate behavior feature of the application at the target behavior layer is extracted, and if the intrusion detection type of the candidate behavior feature is a threatening behavior, the candidate behavior feature is used to update the updated intrusion behavior feature set.

2. The method according to claim 1, characterized in that The extracting behavior features of the sample program and classifying the behavior features into behavior feature sets corresponding to the corresponding behavior layers include: Extracting behavioral features of the sample program by static analysis to obtain the static behavioral features; Extracting behavior features of the sample program using a dynamic analysis method to obtain the dynamic behavior features; According to the type of the behavior layer to which they belong, the static behavior features and the dynamic behavior features are divided into behavior feature sets corresponding to different types of behavior layers.

3. The method according to claim 1, characterized in that Before respectively updating the intrusion behavior feature sets of each behavior layer according to the matching results between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer, the method further includes: acquiring the intrusion behavior feature set; The obtaining of the intrusion behavior feature set includes: Extracting intrusion behavior features of the sample program with intrusion threats; The intrusion behavior features are divided into behavior feature sets corresponding to the corresponding behavior layers, so as to obtain intrusion behavior feature sets corresponding to different types of behavior layers.

4. The method according to claim 1, characterized in that: The updating of the intrusion behavior feature sets of each behavior layer respectively according to the matching result between the behavior feature set and the intrusion behavior feature set corresponding to the behavior layer includes: For any type of behavior layer, feature matching is performed between the behavior feature set and the intrusion behavior feature set; If the behavior feature set contains a target behavior feature that does not match the intrusion behavior feature set, the intrusion behavior feature set is updated according to the target behavior feature.

5. The method according to claim 4, characterized in that The extracting behavior characteristics of the sample program also includes: Performing dynamic and static analysis on the behavior characteristics to determine intrusion detection results of the behavior characteristics; If there is a target behavior feature in the behavior feature set that does not match the intrusion behavior feature set, updating the intrusion behavior feature set according to the target behavior feature includes: If the intrusion detection type of the target behavior feature is threat behavior, the target behavior feature is added to the intrusion behavior feature set.

6. An intrusion detection device for an application, characterized in that: include: A feature extraction module is used to extract the behavior features of the sample program and divide the behavior features into behavior feature sets corresponding to the corresponding behavior layers, wherein the behavior feature data includes static behavior features and dynamic behavior features; the behavior layers include various behavior layers of the application program, and each behavior layer includes a network access layer, a file access layer, a process startup layer, a registry layer, a system service layer, and other behavior layers; A feature set updating module, used to update the intrusion behavior feature set according to the matching result between the behavior feature set of each behavior layer and the corresponding intrusion behavior feature set, wherein the intrusion behavior feature set is obtained according to the intrusion behavior features of the sample program with intrusion threat; A detection module is used to determine the protection trigger conditions corresponding to each type of behavior layer based on an updated intrusion behavior feature set, and determine the protection strategy corresponding to each type of behavior layer, so as to perform intrusion detection of the application program on each of the behavior layers; wherein, if there is an intrusion behavior feature of the target behavior layer that meets the corresponding protection trigger condition, the corresponding target protection strategy is triggered, and the candidate behavior feature of the application program at the target behavior layer is extracted; if the intrusion detection type of the candidate behavior feature is a threatening behavior, the candidate behavior feature is used to update the updated intrusion behavior feature set.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the intrusion detection method for the application program described in any one of claims 1 to 5 is implemented.

Images