Application security defense method, device, storage medium and electronic device

Abstract

The present disclosure relates to the field of application security technology, and specifically to an application security defense method, an application security defense device, a storage medium, and an electronic device. The application security defense method includes: obtaining the operation information of the application; wherein the operation information includes one or more of functional structure information, control flow information, and data flow information; creating a fault tree of the application based on the operation information, and solving the minimum cut set of the fault tree; setting an initial security defense point at the leaf node corresponding to the minimum cut set in the fault tree; simulating an attack on the application to obtain a defense result, and adjusting the initial security defense point according to the defense result to obtain a target security defense point. The application security defense method provided by the present disclosure can help improve the security of the application.

Description

Technical Field

[0001] The present disclosure relates to the field of application security technology, and in particular to an application security defense method, an application security defense device, a storage medium, and an electronic device. Background Art

[0002] With the development of Internet technology, the security of applications is threatened by security vulnerabilities in the code itself, malicious code implantation, illegal attacks or misoperations by users, etc. How to effectively and timely detect and block these security threats is one of the key issues in application security.

[0003] The security protection of traditional applications is mostly based on boundary protection rule matching. If the rule base is too large, the detection rate will be low, and if it is too small, the missed detection rate and bypass rate will be high. The self-protection method of security software based on HOOK technology only sets HOOK hooks in a few fixed locations, which cannot fully cover the security failure points of the application, and there will be problems with incomplete HOOK security coverage.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an application security defense method, an application security defense device, a storage medium and an electronic device, aiming to improve the security of the application.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of an embodiment of the present disclosure, there is provided an application security defense method, comprising: obtaining operation information of an application; wherein the operation information comprises one or more of functional structure information, control flow information and data flow information; creating a fault tree of the application based on the operation information, and solving the minimum cut set of the fault tree; setting an initial security defense point at a leaf node corresponding to the minimum cut set in the fault tree; performing a simulated attack on the application to obtain a defense result, and adjusting the initial security defense point according to the defense result to obtain a target security defense point.

[0008] According to some embodiments of the present disclosure, based on the aforementioned scheme, the fault tree of the application is created based on the operation information, including: taking the application failure as the root node, and converting the functional modules into intermediate nodes with a hierarchical structure according to the functional structure information; determining the logical connection relationship between the root node and the intermediate nodes according to the control flow information; wherein the logical connection relationship includes a logical AND gate or a logical OR gate; determining the underlying fault module that causes the application failure as a leaf node based on the data flow information and the logical connection relationship; and generating the fault tree according to the root node, the intermediate node, the leaf node and the logical connection relationship.

[0009] According to some embodiments of the present disclosure, based on the aforementioned solution, the underlying fault module includes one or more of input exception, file injection, dead loop, null pointer exception, and other vulnerabilities.

[0010] According to some embodiments of the present disclosure, based on the aforementioned scheme, solving the minimum cut set of the fault tree includes: increasing the cut set capacity according to the logical AND gates in the fault tree, and increasing the number of cut sets according to the logical OR gates in the fault tree, to obtain at least one cut set; determining at least one minimum cut set from the at least one cut set.

[0011] According to some embodiments of the present disclosure, based on the aforementioned scheme, determining at least one minimum cut set from the at least one cut set includes: using a descending method to decompose step by step from the top event of the fault tree to determine at least one minimum cut set from the at least one cut set.

[0012] According to some embodiments of the present disclosure, based on the aforementioned scheme, the simulated attack on the application to obtain a defense result includes: setting a defense detection function at all leaf nodes in the fault tree; using honeypot technology to simulate the attack on the application to obtain the number of triggering of the defense detection function at each leaf node as the defense result.

[0013] According to some embodiments of the present disclosure, based on the aforementioned scheme, the initial security defense point is adjusted according to the defense result to obtain the target security defense point, including: when the number of triggering times of the defense detection function at the leaf node is less than a first preset threshold and the initial security defense point is set, canceling the setting of the initial security defense point; and when the number of triggering times of the defense detection function at the leaf node is greater than a second preset threshold and the initial security defense point is not set, adding a new security defense point to obtain the target security defense point.

[0014] According to a second aspect of an embodiment of the present disclosure, there is provided an application security defense device, comprising: an acquisition module, for acquiring operation information of an application; wherein the operation information comprises one or more of functional structure information, control flow information and data flow information; a fault tree module, for creating a fault tree of the application based on the operation information, and solving the minimum cut set of the fault tree; a defense module, for setting an initial security defense point at a leaf node corresponding to the minimum cut set in the fault tree; an adjustment module, for simulating an attack on the application to obtain a defense result, and adjusting the initial security defense point according to the defense result to obtain a target security defense point.

[0015] According to a third aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the application security defense method in the above embodiment is implemented.

[0016] According to a fourth aspect of an embodiment of the present disclosure, an electronic device is provided, characterized in that it includes: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the application security defense method as in the above-mentioned embodiment.

[0017] The exemplary embodiments of the present disclosure may have some or all of the following beneficial effects:

[0018] In the technical solutions provided by some embodiments of the present disclosure, the running information of the application is first obtained through static analysis of the application, and then the fault tree modeling is performed based on the running information combined with SFTA (software fault tree analysis), and the security defense point, i.e., the defense HOOK hook, is set in the intermediate event of the fault tree, and finally the application is simulated and attacked to obtain the defense result, and the fault point that is vulnerable to attack is verified to finally adjust the setting of the security defense point. Based on the above method, on the one hand, by comprehensively analyzing the running information of the application, it is possible to analyze in the early stage of application development and strengthen the setting of the defense HOOK hook in the design stage, which helps to improve the security of the application and shift the security left; on the other hand, according to SFTA, the fault tree modeling is performed, and the security defense points that need to be set are analyzed through the fault analysis method, which can locate the application fault points more accurately and more comprehensively; on the other hand, the application is simulated and attacked and the analysis results are recorded, so that the defense HOOK hook can be dynamically optimized and adjusted in time to make the defense focus more complete.

[0019] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0021] Figure 1 A schematic diagram of a process flow of an application security defense method in the prior art is schematically shown;

[0022] Figure 2 A schematic diagram schematically illustrates a flow chart of an application security defense method in an exemplary embodiment of the present disclosure;

[0023] Figure 3 A schematic diagram schematically illustrates a fault tree in an exemplary embodiment of the present disclosure;

[0024] Figure 4 A schematic diagram of a process for setting an initial security defense point in an exemplary embodiment of the present disclosure is schematically shown;

[0025] Figure 5 A schematic diagram of a system for optimizing security defense points in an exemplary embodiment of the present disclosure is schematically shown;

[0026] Figure 6 A schematic diagram schematically shows the composition of an application security defense device in an exemplary embodiment of the present disclosure;

[0027] Figure 7 A schematic diagram schematically illustrates a computer-readable storage medium in an exemplary embodiment of the present disclosure;

[0028] Figure 8 The structure diagram of a computer system of an electronic device in an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0029] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be more comprehensive and complete and will fully convey the concept of the example embodiments to those skilled in the art.

[0030] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known methods, devices, implementations or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0031] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0032] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0033] Figure 1 The following is a schematic diagram showing a flow chart of an application security defense method in the prior art. Figure 1 As shown, in the software environment of the application, a self-protection HOOK hook is set in the registry, files and processes of the application. That is, a WAF (Web Application Firewall, website application-level intrusion prevention system) is set for the application.

[0034] The security protection of traditional applications is mostly based on boundary protection rule matching. If the rule base is too large, the detection rate will be low, and if it is too small, the missed detection rate and bypass rate will be high. The self-protection method of security software based on HOOK technology only sets HOOK hooks in a few fixed locations, which cannot fully cover the security failure points of the application, and there will be problems with incomplete HOOK security coverage.

[0035] Therefore, in response to the defects of the prior art, the present invention provides a method for performing fault tree modeling through static analysis of the application combined with SFTA during the application development stage, setting HOOK hooks in the intermediate events of the fault tree, and then verifying the fault points that are vulnerable to attacks through the honeypot principle, so as to adjust the settings of the HOOK hooks and thereby improve the security of the application.

[0036] The implementation details of the technical solution of the embodiment of the present disclosure are elaborated in detail below.

[0037] Figure 2 The following is a schematic diagram showing a flow chart of an application security defense method in an exemplary embodiment of the present disclosure. Figure 2 As shown, the application security defense method includes steps S201 to S204:

[0038] Step S201, obtaining the running information of the application; wherein the running information includes one or more of the functional structure information, the control flow information and the data flow information;

[0039] Step S202, creating a fault tree of the application based on the operation information, and solving a minimum cut set of the fault tree;

[0040] Step S203, setting an initial safety defense point at a leaf node corresponding to the minimum cut set in the fault tree;

[0041] Step S204, simulate an attack on the application to obtain a defense result, and adjust the initial security defense point according to the defense result to obtain a target security defense point.

[0042] In the technical solutions provided by some embodiments of the present disclosure, the running information of the application is first obtained through static analysis of the application, and then the fault tree modeling is performed based on the running information combined with SFTA (software fault tree analysis), and the security defense point, i.e., the defense HOOK hook, is set in the intermediate event of the fault tree, and finally the application is simulated and attacked to obtain the defense result, and the fault point that is vulnerable to attack is verified to finally adjust the setting of the security defense point. Based on the above method, on the one hand, by comprehensively analyzing the running information of the application, it is possible to analyze in the early stage of application development and strengthen the setting of the defense HOOK hook in the design stage, which helps to improve the security of the application and shift the security left; on the other hand, according to SFTA, the fault tree modeling is performed, and the security defense points that need to be set are analyzed through the fault analysis method, which can locate the application fault points more accurately and more comprehensively; on the other hand, the application is simulated and attacked and the analysis results are recorded, so that the defense HOOK hook can be dynamically optimized and adjusted in time to make the defense focus more complete.

[0043] Below, each step of the application security defense method in this example implementation will be described in more detail with reference to the accompanying drawings and embodiments.

[0044] In step S201, the operation information of the application is obtained; wherein the operation information includes one or more of functional structure information, control flow information and data flow information.

[0045] In one embodiment of the present disclosure, static analysis is performed on the application under test to obtain operation information of the application, including one or more of functional structure information, control flow information and data flow information.

[0046] Among them, the functional structure information is the specific information of each functional module included in the application, such as the functional structure diagram; the control flow information is the control logic of each functional module in the application, such as the control flow diagram; the data flow information is the data module determined by each functional module in the application according to the control logic, such as the data flow diagram.

[0047] In step S202, a fault tree of the application is created based on the operation information, and a minimum cut set of the fault tree is solved.

[0048] Specifically, the functional structure information obtained in step S201 provides a hierarchical analysis basis for the application fault tree, the control flow information provides a logical dependency for the application fault tree, and the data flow information provides a fault cause dependency for the application fault tree. Combining the three static analysis results can make the fault point of the application more accurate.

[0049] In one embodiment of the present disclosure, the process of creating a fault tree in step S202 is as follows:

[0050] Step 1: Taking the application failure as the root node, and converting the functional modules into intermediate nodes with a hierarchical structure according to the functional structure information.

[0051] Among them, the application failure is taken as the root node of the tree, and then the weights are configured for the functional modules according to the importance of the functions based on the functional structure information. The more important the functional module, the greater the weight and the closer it is to the root of the tree. The function execution, conditional judgment and other modules of the same level and the same module in the functional structure information are taken as the intermediate nodes of the same layer, and the sub-functional structure modules are taken as the intermediate nodes of the next layer.

[0052] Step 2: Determine the logical connection relationship between the tree root node and the intermediate node according to the control process information; wherein the logical connection relationship includes a logical AND gate or a logical OR gate.

[0053] Among them, based on the control flow information, the logically unrelated branches in the functional module are used as logical OR gates, and the branch logic of the program sequential execution is used as an AND gate, and then the nodes are logically connected.

[0054] Step three: Based on the data flow information and the logical connection relationship, determine the underlying fault module that causes the application to fail as a leaf node.

[0055] Among them, the underlying fault module includes one or more of input exceptions, file injection, dead loop, null pointer exception, and other vulnerabilities.

[0056] Step 4: Generate the fault tree according to the root node, the intermediate nodes, the leaf nodes and the logical connection relationship.

[0057] Figure 3 A schematic diagram of a fault tree in an exemplary embodiment of the present disclosure is schematically shown. Figure 3 As shown in the figure, T is the root node of the application failure tree, and the first-level G is determined according to the functional structure information. 1 , the second level G 2 , G 3 , the third level G 4 , G 5 and G 6 The intermediate nodes of the tree are determined according to the control flow information, and the logical AND gate or logical OR gate between the root node and the intermediate nodes are determined. Finally, x is determined according to the data flow information. 1 、x 2 、x 3 、x 4 、x 5 、x 6 、x 7 、x 8 、x 9 The leaf nodes of , finally get the fault tree.

[0058] After the fault tree is obtained, it is necessary to solve the minimum cut set of the fault tree. In one embodiment of the present disclosure, the process of solving the minimum cut set in step S202 is as follows:

[0059] Step 1: increasing the cut set capacity according to the logic AND gate in the fault tree, and increasing the number of cut sets according to the logic OR gate in the fault tree, to obtain at least one cut set;

[0060] Step 2: Determine at least one minimum cut set from the at least one cut set.

[0061] Specifically, software fault tree analysis has become an important means of software analysis and has become SFTA (Software Fault Tree Analysis). Software fault tree analysis can be simply regarded as an analysis method in which an undesirable event in the software is first determined, and then the software is analyzed under certain environmental and working conditions to find out the exact way in which the undesirable event occurs, that is, to find out the various causes of the undesirable event. We call this undesirable event the "top event", which is the "root" of the fault tree. Next, we need to continue to find out the various lower-level direct causes of the undesirable event and analyze the logical relationship between them, until the bottom level is an event that can no longer be analyzed, or it is considered that the event does not need to be analyzed.

[0062] A cut set is a possible cause of application failure and is a collection of several leaf nodes. In step one, the cut set is obtained according to the property that the logical AND gate increases the cut set capacity and the logical OR gate increases the number of cut sets. In step two, the Fuseell-Vesely algorithm (downward method) is used to decompose the top event of the fault tree step by step downward to determine at least one minimum cut set from the at least one cut set. The more minimum cut sets there are, the less safe the application is.

[0063] Specifically, if Figure 3 The obstacle tree shown uses the descending method to solve the minimum cut set. The top event is an OR gate. The specific process is as follows:

[0064] 1) Where x 1 , G 1 、x 2 Arranged as inputs, if any of these input events occurs, the top event must occur, so each one is an independent cut set element;

[0065] 2) Due to G 1 The following is the OR gate, G 2 , G 3 Arrange in a row as input and replace G1;

[0066] 3) G 2 The following is the AND gate, G 4 , G 5 Line up and replace G 2 ,Only when all inputs of the AND gate occur, the intermediate event on the AND gate will occur;

[0067] 4) And so on, we finally get a matrix with 9 rows, and thus 9 cut sets: {x 1}、{x 2}、{x 4 , x 6}、{x4 , x 7}、{x 5 , x 6}、{x 5 , x 7}、{x 3}、{x 6}、{x 8};

[0068] 5) Continue to solve the minimum cut set: {x 1}、{x 2}、{x 4 , x 7}、{x 5 , x 7}、{x 3}、{x 6}、{x 8}.

[0069] In step S103, an initial safety defense point is set at a leaf node corresponding to the minimum cut set in the fault tree.

[0070] Specifically, similar to the cut set, the minimum cut set is also a set of several leaf nodes. Assuming that the probability of leaf nodes occurring is very small and the difference is not big, the smaller the set in the minimum cut set, the more likely the leaf node is to cause application failure; the more times the leaf node appears in different cut sets, the more likely it is to cause application failure; therefore, setting a defense hook here is more effective;

[0071] Therefore, according to the minimum cut set in the solved fault tree, the initial safety defense point, that is, the defense HOOK hook, is set at the corresponding leaf node.

[0072] Figure 4 The following is a schematic diagram showing a process flow of setting an initial security defense point in an exemplary embodiment of the present disclosure. Figure 4 As shown, firstly, step S401 is executed to obtain the functional structure diagram, control flow diagram and data flow diagram of the application.

[0073] Then, step S402 is executed to perform fault tree modeling using the functional structure diagram, control flow diagram, and data flow diagram. The application failure is taken as the root node of the tree, and the modules such as the function execution of the functional module and the condition of the functional module in the same module at the same level of the functional structure diagram are taken as the intermediate nodes of the same layer, and the sub-functional structure module is taken as the intermediate node of the next layer. After that, according to the hierarchical relationship of the functional structure diagram, the unrelated branches in the logic of the program control flow diagram corresponding to the functional structure module are taken as the logical OR gate, and the branch logic of the program sequential execution is taken as the AND gate; finally, according to the hierarchical relationship of the functional structure diagram, all the lowest-level faults that cause the application failure, such as input exceptions, file injection, dead loops, null pointer exceptions, and other vulnerabilities in the data flow diagram, are taken as leaf nodes to obtain the fault tree of the application.

[0074] Finally, step S403 is executed to solve the minimum cut set of the fault tree, and then the HOOK detection function is set at all leaf nodes, and the initial security defense point, that is, the defense HOOK hook, is set at the leaf node corresponding to the minimum cut set.

[0075] Based on the above method, application fault tree modeling based on a combination of multiple static analyses of the application can accurately locate the fault modules of the application in the early stage of application development and set corresponding defense HOOK hooks.

[0076] In step S104, a simulated attack is performed on the application to obtain a defense result, and the initial security defense point is adjusted according to the defense result to obtain a target security defense point.

[0077] Specifically, in order to verify and adjust the initial security defense point, a simulated attack can be performed on the application. In step S104, the simulated attack on the application to obtain a defense result includes: setting a defense detection function at all leaf nodes in the fault tree; using honeypot technology to simulate the attack on the application to obtain the number of triggering of the defense detection function at each leaf node as the defense result.

[0078] First, a defense detection function, namely the HOOK detection function, is set at all leaf nodes in the fault tree. Then, the honeypot technology is used to simulate the attack to obtain the triggering times of the defense detection function at each leaf node.

[0079] Among them, a honeypot is a computer system running on the Internet. It is specially designed to attract and lure those who try to illegally break into other people's computer systems (such as computer hackers). The honeypot system is a decoy system containing vulnerabilities. It simulates one or more vulnerable hosts to provide attackers with an easy target to attack. Since the honeypot does not provide truly valuable services to the outside world, all attempts to use the honeypot are considered suspicious. Another use of the honeypot is to delay the attacker's attack on the real target and make the attacker waste time on the honeypot.

[0080] The application simulates running and attacks all fault points such as input anomalies, file injection, dead loops, null pointers, and other vulnerabilities based on the minimum cut set. During the attack, it ensures that every leaf node is simulated and attacked to obtain the defense result.

[0081] After obtaining the defense result, the initial security defense point is adjusted according to the defense result. In step S104, the initial security defense point is adjusted according to the defense result to obtain the target security defense point, including: when the number of triggering times of the defense detection function at the leaf node is less than the first preset threshold and the initial security defense point is set, canceling the setting of the initial security defense point; and when the number of triggering times of the defense detection function at the leaf node is greater than the second preset threshold and the initial security defense point is not set, adding a security defense point to obtain the target security defense point.

[0082] By recording and analyzing the number of times the HOOK detection function is triggered, the insecure points of the application can be analyzed more accurately. By optimizing and adjusting the defensive HOOK hooks at the insecure points analyzed in the statistics, the combined security protection of multiple HOOK points can improve the security of the application.

[0083] Specifically, for the minimum cut set nodes of the HOOK detection function with few trigger times, adjustments can be made to reduce the number of defense HOOK hooks. For the leaf nodes that are not in the minimum cut set but have a large number of triggers, additional defense HOOK hook points can be added. Then, based on the analysis results, the setting points of the HOOK hooks can be optimized and adjusted. The defense HOOK hook points can be dynamically optimized and adjusted in a timely manner to make the defense focus more accurate and complete.

[0084] Figure 5 A schematic diagram of a system for optimizing security defense points in an exemplary embodiment of the present disclosure is shown schematically. Figure 5 As shown in the figure, the optimization of security defense points is mainly divided into four modules:

[0085] 1. A security defense point setting module 501, which is used to perform application fault tree modeling according to the functional structure information, control flow information and data flow information of the application program, and then solve the minimum cut set to set the defense HOOK hook;

[0086] 2. Simulation attack module 502, which is used to simulate attacks using the principle of honeypot technology;

[0087] 3. Record analysis module 503, which is used to analyze the triggering times of the HOOK detection function of all leaf nodes of the fault tree;

[0088] 4. Result analysis module 504, which is used to adjust the setting of the defense hook according to the triggering times of the HOOK detection function obtained by the record analysis module.

[0089] Based on the above method, on the one hand, the present disclosure can analyze in the early stage of application development by comprehensively analyzing the application function structure diagram, control flow diagram, and data flow diagram, thereby strengthening the setting of defense HOOK hooks in the design stage, which helps to improve the security of the application and shift security to the left; on the other hand, the defense HOOK hooks set in the present disclosure are based on SFTA to perform fault tree modeling, and the HOOK points that need to be set are analyzed through the fault analysis method, which can more accurately and comprehensively locate the application fault points; on the other hand, it is proposed to use the principle of honeypot technology to simulate attacks and record the analysis results, which can dynamically optimize and adjust the setting of defense HOOK hook points in a timely manner, making the defense focus more complete. In the application development stage, it helps to improve the security of the design and development of applications, and can effectively detect and defend against application security failures.

[0090] Figure 6 The following is a schematic diagram showing the composition of an application security defense device in an exemplary embodiment of the present disclosure. Figure 6 As shown, the application security defense device 600 may include an acquisition module 601, a fault tree module 602, a defense module 603, and an adjustment module 604. Among them:

[0091] The acquisition module 601 is used to acquire the operation information of the application program; wherein the operation information includes one or more of the functional structure information, the control flow information and the data flow information;

[0092] A fault tree module 602 is used to create a fault tree of the application based on the operation information and solve the minimum cut set of the fault tree;

[0093] A defense module 603 is used to set an initial safety defense point at a leaf node corresponding to the minimum cut set in the fault tree;

[0094] The adjustment module 604 is used to simulate an attack on the application to obtain a defense result, and adjust the initial security defense point according to the defense result to obtain a target security defense point.

[0095] According to an exemplary embodiment of the present disclosure, the fault tree module 602 includes a creation unit, which is used to take the application failure as the root node and convert the functional module into an intermediate node with a hierarchical structure according to the functional structure information; determine the logical connection relationship between the root node and the intermediate node according to the control flow information; wherein the logical connection relationship includes a logical AND gate or a logical OR gate; based on the data flow information and the logical connection relationship, determine the underlying fault module that causes the application failure as a leaf node; generate the fault tree according to the root node, the intermediate node, the leaf node and the logical connection relationship.

[0096] According to an exemplary embodiment of the present disclosure, the underlying fault module includes one or more of input exception, file injection, dead loop, null pointer exception, and other vulnerabilities.

[0097] According to an exemplary embodiment of the present disclosure, the fault tree module 602 includes a solution unit, which is used to increase the cut set capacity according to the logical AND gate in the fault tree, and increase the number of cut sets according to the logical OR gate in the fault tree to obtain at least one cut set; determine at least one minimum cut set from the at least one cut set.

[0098] According to an exemplary embodiment of the present disclosure, the solving unit is used to adopt a descending method to decompose the fault tree step by step from the top event to determine at least one minimum cut set from the at least one cut set.

[0099] According to an exemplary embodiment of the present disclosure, the adjustment module 604 includes a simulated attack unit, which is used to set a defense detection function at all leaf nodes in the fault tree; and use honeypot technology to simulate an attack on the application to obtain the number of triggering of the defense detection function at each leaf node as the defense result.

[0100] According to an exemplary embodiment of the present disclosure, the adjustment module 604 includes an adjustment unit, which is used to cancel the setting of the initial security defense point when the number of triggering times of the defense detection function at the leaf node is less than a first preset threshold and the initial security defense point is set; and to add a new security defense point to obtain the target security defense point when the number of triggering times of the defense detection function at the leaf node is greater than a second preset threshold and the initial security defense point is not set.

[0101] The specific details of each module in the above-mentioned fault tree module device 600 have been described in detail in the corresponding fault tree module method, so they will not be repeated here.

[0102] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0103] In an exemplary embodiment of the present disclosure, a storage medium capable of implementing the above method is also provided. Figure 7 A schematic diagram schematically illustrates a computer-readable storage medium in an exemplary embodiment of the present disclosure, such as Figure 7 As shown, a program product 700 for implementing the above method according to an embodiment of the present disclosure is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a mobile phone. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0104] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided. Figure 8 The structure diagram of a computer system of an electronic device in an exemplary embodiment of the present disclosure is schematically shown.

[0105] It should be noted that Figure 8 The computer system 800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0106] like Figure 8As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 802 or the program loaded from the storage part 808 to the random access memory (RAM) 803. In the RAM 803, various programs and data required for system operation are also stored. The CPU 801, ROM 802 and RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0107] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed so that a computer program read therefrom is installed into the storage section 808 as needed.

[0108] In particular, according to an embodiment of the present disclosure, the process described below with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 809, and / or installed from a removable medium 811. When the computer program is executed by a central processing unit (CPU) 801, various functions defined in the system of the present disclosure are executed.

[0109] It should be noted that the computer-readable medium shown in the embodiment of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0110] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0111] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, and the units described may also be arranged in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0112] As another aspect, the present disclosure further provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0113] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0114] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0115] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure.

[0116] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. An application security defense method, characterized in that: include: Acquire the running information of the application; wherein the running information includes one or more of functional structure information, control flow information and data flow information; Creating a fault tree of the application based on the operation information, and solving a minimum cut set of the fault tree; Setting an initial safety defense point at a leaf node corresponding to the minimum cut set in the fault tree; A simulated attack is performed on the application to obtain a defense result, and when the number of triggering times of the defense detection function at the leaf node is less than a first preset threshold and the initial security defense point is set, the initial security defense point is canceled; and when the number of triggering times of the defense detection function at the leaf node is greater than a second preset threshold and the initial security defense point is not set, a new security defense point is added to obtain a target security defense point.

2. The application security defense method according to claim 1, characterized in that: The creating a fault tree of the application based on the operation information includes: Taking the application failure as a tree root node, and converting the functional modules into intermediate nodes with a hierarchical structure according to the functional structure information; Determine the logical connection relationship between the tree root node and the intermediate node according to the control flow information; wherein the logical connection relationship includes a logical AND gate or a logical OR gate; Determine the underlying fault module causing the application failure as a leaf node based on the data flow information and the logical connection relationship; The fault tree is generated according to the root node, the intermediate nodes, the leaf nodes and the logical connection relationship.

3. The application security defense method according to claim 2, characterized in that: The underlying fault module includes one or more of input exception, file injection, dead loop, and null pointer exception.

4. The application security defense method according to claim 2, characterized in that: The method of solving the minimum cut set of the fault tree comprises: Increasing the cut set capacity according to the logic AND gate in the fault tree, and increasing the number of cut sets according to the logic OR gate in the fault tree, to obtain at least one cut set; At least one minimum cut set is determined from the at least one cut set.

5. The application security defense method according to claim 4, characterized in that: The determining at least one minimum cut set from the at least one cut set comprises: A descending method is adopted to decompose the fault tree step by step from the top event of the fault tree, so as to determine at least one minimum cut set from the at least one cut set.

6. The application security defense method according to claim 1, characterized in that: The simulating attack on the application to obtain a defense result includes: Setting a defense detection function at all leaf nodes in the fault tree; The honeypot technology is used to simulate the attack on the application to obtain the triggering times of the defense detection function at each leaf node as the defense result.

7. An application security defense device, characterized in that: include: An acquisition module, used to acquire the operation information of the application; wherein the operation information includes one or more of functional structure information, control flow information and data flow information; A fault tree module, used for creating a fault tree of the application based on the operation information, and solving a minimum cut set of the fault tree; A defense module, used for setting an initial safety defense point at a leaf node corresponding to the minimum cut set in the fault tree; An adjustment module is used to simulate an attack on the application to obtain a defense result, and when the number of triggering times of the defense detection function at the leaf node is less than a first preset threshold and the initial security defense point is set, cancel the setting of the initial security defense point; and when the number of triggering times of the defense detection function at the leaf node is greater than a second preset threshold and the initial security defense point is not set, add a new security defense point to obtain a target security defense point.

8. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the application security defense method as described in any one of claims 1 to 6.

9. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the application security defense method as described in any one of claims 1 to 6.

Images