Rasp-based iast linkage real-time protection method and related device

Abstract

The application provides an IAST linkage real-time protection method based on RASP and a related device, a security detection probe based on a real-time application program self-protection technology is loaded in a web server; security vulnerability information of IAST is acquired, and the security vulnerability information of IAST is imported to a Portal end; the security vulnerability information to be protected is acquired from the Portal end according to the security detection probe; and according to a security protection instruction sent by the Portal end, the security detection probe controls security protection against a security attack corresponding to the security vulnerability information. Through implementation of the application scheme, the security vulnerability information detected by IAST is summarized, the security detection probe acquires the security vulnerability information to be protected, when a security attack is received, security protection against the security attack is performed according to the security detection probe, and the accuracy of security vulnerability protection is improved while real-time protection of an application is performed on a production line.

Description

Technical Field

[0001] This application relates to the field of electronic technology, and in particular to a real-time protection method and related device based on RASP and IAST linkage. Background Technology

[0002] Current web application security protection is mostly based on a single security testing method or technology, such as DAST (Dynamic Application Security Testing), SAST (Static Application Security Testing), and IAST (Interactive Application Security Testing). The drawback of these technologies is that they are only applied in the testing and development phases of web applications and cannot be used for real-time application protection on the production line. Some testing methods, such as SAST, also require the product's source code, which raises privacy concerns regarding the protection of the confidentiality of intellectual property code. Summary of the Invention

[0003] This application provides a RASP-based IAST linkage real-time protection method and related device, which can at least solve the problem that security products cannot be applied for real-time protection on the production line in related technologies.

[0004] The first aspect of this application provides an IAST-linked real-time protection method, including:

[0005] Load a security detection probe based on real-time application self-protection technology into the web server;

[0006] Obtain IAST security vulnerability information and import the IAST security vulnerability information into the Portal terminal;

[0007] The security vulnerability information to be protected is obtained from the Portal based on the security detection probe.

[0008] Based on the security protection instructions sent by the Portal, the security detection probe is controlled to perform security protection against security attacks corresponding to the security vulnerability information.

[0009] The second aspect of this application provides an IAST-linked real-time protection device, including:

[0010] The loading module is used to load security detection probes based on real-time application self-protection technology into the web server;

[0011] The import module is used to obtain IAST security vulnerability information and import the IAST security vulnerability information into the Portal terminal.

[0012] The acquisition module is used to acquire information about security vulnerabilities to be protected from the Portal based on the security detection probe.

[0013] The protection module is used to control the security detection probe to perform security protection on the security vulnerability corresponding to the security vulnerability information according to the security protection command sent by the Portal terminal.

[0014] A third aspect of this application provides an electronic device, characterized in that it includes a memory and a processor, wherein the processor is used to execute a computer program stored in the memory, and the processor executes the computer program in accordance with the steps of the IAST linkage real-time protection method provided in the first aspect of this application.

[0015] The fourth aspect of this application provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the steps of the IAST linkage real-time protection method provided in the first aspect of this application.

[0016] As can be seen from the above, the RASP-based IAST linkage real-time protection method and related devices provided in this application involve loading a security detection probe based on real-time application self-protection technology into the web server; acquiring IAST security vulnerability information and importing it into the Portal; obtaining the security vulnerability information to be protected from the Portal using the security detection probe; and controlling the security detection probe to perform security protection against security attacks corresponding to the security vulnerability information based on the security protection instructions sent by the Portal. Through the implementation of this application, security vulnerability information detected by IAST is aggregated, and security vulnerability information to be protected is obtained through the security detection probe. When a security attack is received, security protection against the attack is performed based on the security detection probe, improving the accuracy of security vulnerability protection while providing real-time application protection on the production line. Attached Figure Description

[0017] Figure 1 This is a basic flowchart of the IAST-linked real-time protection method provided in the first embodiment of this application;

[0018] Figure 2 A detailed flowchart illustrating the IAST-linked real-time protection method provided in the second embodiment of this application;

[0019] Figure 3This is a schematic diagram of the program modules of the IAST-linked real-time protection device provided in the third embodiment of this application;

[0020] Figure 4 This is a schematic diagram of the structure of an electronic device provided in the fourth embodiment of this application. Detailed Implementation

[0021] To make the inventive objectives, features, and advantages of this application more apparent and understandable, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0022] To address the issue that security products in related technologies cannot be applied for real-time protection on production lines, the first embodiment of this application provides an IAST-linked real-time protection method, such as... Figure 1 This is a basic flowchart of the IAST-linked real-time protection method provided in this embodiment. The IAST-linked real-time protection method includes the following steps:

[0023] Step 101: Load a security detection probe based on real-time application self-protection technology into the web server.

[0024] Specifically, in this embodiment, the security detection probe is based on Runtime Application Self-Protection (RASP) technology. RASP is a novel application security protection technology that injects protection into applications like a vaccine, integrating it into the application and enabling real-time detection and blocking of security attacks. This gives the application self-protection capabilities; when the application suffers actual damage, it can automatically defend itself without manual intervention. RASP technology can quickly integrate security defense functions into running applications. It intercepts all calls from the application to the system, ensuring their security and directly verifying data requests within the application. Both web and non-web applications can be protected through RASP. This technology does not affect the application design because RASP's detection and protection functions run on the system where the application is running. Based on RASP technology, the security probe is loaded into the web application system, ensuring that the security probe and the web server reside on the same server. Traditional security vulnerability attack defense technologies typically involve installing firewalls. However, whether the firewall is deployed in a cascaded or parallel manner, it requires the user's source code, which can easily lead to the leakage of application privacy. In contrast, using RASP technology to load security inspection probes does not require the use of the customer's source code, thus protecting the privacy of private applications.

[0025] Step 102: Obtain IAST security vulnerability information and import it into the Portal.

[0026] Specifically, IAST uses software instrumentation to collect security information and discovers problems directly from running code to achieve automated identification and diagnosis of software vulnerabilities in applications and APIs. In this embodiment, security vulnerability information detected by IAST during the testing phase is obtained and directly imported into the RASP system's portal, allowing users to precisely address security vulnerabilities through commands sent from the portal.

[0027] In one optional implementation of this embodiment, the step of obtaining security vulnerability information from IAST includes: determining security vulnerability information based on IAST during the testing phase; wherein, IAST is an interactive application security test; the security vulnerability information includes: security vulnerability identifier and security vulnerability type; and obtaining security vulnerability information through the security vulnerability information summarized by IAST.

[0028] Specifically, IAST testing is performed during the testing phase of the software development cycle and cannot provide real-time application protection on the production line. In this embodiment, by importing security vulnerability information from IAST, which includes security vulnerability identifiers and types, security vulnerability information is obtained through the security vulnerability information summarized by IAST before the security detection probe performs security detection on the RASP system.

[0029] In one optional implementation of this embodiment, the step of importing IAST security vulnerability information to the Portal includes: creating an API interface on the Portal and generating an import window for security vulnerability information based on the API interface; selecting the corresponding security vulnerability information according to preset security protection rules and importing the security vulnerability information to the Portal through the import window.

[0030] Specifically, in this embodiment, an API (Application Program Interface) is a collection of definitions, programs, and protocols that enable communication between computer software. A primary function of an API is to provide a general set of functions. Programmers can reduce their programming workload by calling API functions to develop applications. An API also serves as middleware, providing data sharing across various platforms. By creating an API interface on the Portal side and generating an import window for security vulnerability information based on the API interface, users can directly drag and drop IAST security vulnerability information. That is, users can select corresponding security vulnerability information according to preset security protection rules and drag the security vulnerability information into the import window to complete the import of security vulnerability information to the Portal side, improving information import efficiency.

[0031] In one optional implementation of this embodiment, after the step of importing security vulnerability information to the Portal via the import window, the method further includes: creating a security vulnerability information database on the Portal and querying historical import information of security vulnerability information based on the security vulnerability information database; detecting whether security vulnerability information exists in the security vulnerability information database based on the historical import information; and if the security vulnerability information database does not contain security vulnerability information, then performing the step of importing security vulnerability information to the Portal via the import window.

[0032] Specifically, in this embodiment, a security vulnerability information database is created on the Portal side. All imported security vulnerability information is stored in the security vulnerability information database. When security vulnerability information is imported again, the database is checked by querying historical import information to determine whether the same security vulnerability information exists. If not, the security vulnerability information is imported to the Portal side to prevent duplicate import of security vulnerability information and improve the efficiency of importing security vulnerability information on the Portal side.

[0033] Step 103: Obtain information on the security vulnerabilities to be protected from the Portal using the security detection probe.

[0034] Specifically, in this embodiment, firstly, the security detection probe needs to identify the security vulnerability that the user needs to protect against. Then, the security detection probe can obtain the security vulnerability information corresponding to the security vulnerability from the security vulnerability information database on the Portal side, and import the corresponding security weakness information in the security vulnerability information into the security detection probe, thereby providing security protection for the security weakness.

[0035] In one optional implementation of this embodiment, the step of obtaining security vulnerability information to be protected from the Portal based on the security detection probe includes: determining the security vulnerability to be protected based on user business needs; and obtaining the corresponding security vulnerability information from the Portal based on the security detection probe targeting the security vulnerability.

[0036] Specifically, in practical applications, some ordinary users have no special security requirements, while others have relatively strict security requirements, or some users specifically develop products for security vulnerability protection and need to demonstrate these functions to their customers. This necessitates multi-dimensional protection against security vulnerabilities, or the option to simply ignore certain vulnerabilities. Therefore, in this embodiment, the real-time security vulnerabilities to be protected are determined based on the user's business needs. That is, the security vulnerabilities to be protected differ at different times depending on the user's business requirements. Security detection probes target these real-time security vulnerabilities, obtaining corresponding security weakness information at the Portal, thereby achieving precise protection.

[0037] In one optional implementation of this embodiment, after the step of obtaining the security vulnerability information to be protected from the Portal based on the security detection probe, the method further includes: analyzing the security vulnerability information based on the RASP analysis engine; and determining the first severity level of the security vulnerability information based on the analysis results.

[0038] Specifically, in this embodiment, after the security detection probe obtains the corresponding security vulnerability information according to the user's business needs, it will analyze the security vulnerability information according to the RASP analysis engine. This includes, but is not limited to: based on penetration testing, not only can vulnerabilities such as business logic that are not easily identified by machines be discovered, but also potential weaknesses can be discovered by specifically simulating hacker attack strategies. Through analysis, the severity of the security vulnerability to the system is fully understood, and the security vulnerability is classified into severity levels according to the strength of the severity and the characteristics of the security vulnerability. It can be understood that each security vulnerability corresponds to a severity level, and security vulnerabilities with similar impact on the system have the same severity level. Moreover, the RASP analysis engine will perform severity level analysis on all security vulnerability information detected by IAST, thereby determining the severity level of all security vulnerabilities.

[0039] Step 104: Based on the security protection instructions sent by the Portal, control the security detection probe to perform security protection against security attacks corresponding to the security vulnerability information.

[0040] Specifically, in this embodiment, when the system is subjected to a security attack, the security detection probe is controlled to adopt a security protection strategy corresponding to the first severity level according to the security protection command sent by the Portal, so as to protect against the security attack corresponding to the security vulnerability information.

[0041] In one optional implementation of this embodiment, the step of controlling the security detection probe to adopt a security protection strategy corresponding to the first severity level to protect against security attacks corresponding to security vulnerability information according to the security protection command sent by the Portal includes: when the web server is subjected to a security attack, controlling the security detection probe to determine the security vulnerability information corresponding to the security attack according to the security protection command sent by the Portal; determining the second severity level of the security attack according to the first severity level determined by the RASP analysis engine for the security vulnerability information; if the second severity level is lower than the preset security protection level, controlling the security detection probe to intercept the security attack; if the second severity level is higher than or equal to the preset security protection level, controlling the security detection probe to report the security attack to the Portal after intercepting the security attack, and performing real-time security protection based on the characteristics of the security attack.

[0042] Specifically, in this embodiment, when the web server is subjected to a security attack, the security detection probe is controlled according to the security protection instructions sent by the Portal to determine the security vulnerability information corresponding to the security attack. Based on the first severity level determined by the RASP analysis engine for all security vulnerability information, the second severity level of the security attack is determined. It should be noted that if the security vulnerability information corresponds to one security vulnerability, the first severity level can be understood as one severity level; if the security vulnerability information corresponds to multiple security vulnerabilities, the first severity level can be understood as the severity level of multiple security vulnerabilities. Correspondingly, if there is only one security vulnerability in the security attack corresponding to a system security vulnerability, the second severity level can be directly represented as the first severity level of that security vulnerability. If there are multiple security vulnerabilities in the security attack corresponding to a system security vulnerability, the weights of all security vulnerabilities in the security attack are analyzed based on the user's actual business needs and the severity level of the security vulnerabilities, and a weighted average is calculated to obtain the final second severity level. If the security vulnerability information database of the RASP system does not contain the security vulnerability information in the security attack, the similarity comparison is performed between the feature information contained in the security vulnerability information in the security attack and the security vulnerability information in the RASP system, and the second severity level corresponding to the security attack is determined based on the comparison result. After determining the second severity level of the security attack, a corresponding security protection strategy is selected based on the severity level to protect against the attack. If the second severity level is lower than the preset security protection level, the security detection probe is controlled to intercept the security attack. If the second severity level is higher than or equal to the preset security protection level, the security detection probe is controlled to report the security attack to the Portal after intercepting it, and real-time security protection is carried out based on the characteristics of the security attack, thereby achieving the purpose of precise protection against security attacks.

[0043] Based on the embodiments of the above application, a security detection probe based on real-time application self-protection technology is loaded into the web server; security vulnerability information from IAST is obtained and imported into the Portal; the security vulnerability information to be protected is obtained from the Portal according to the security detection probe; and the security detection probe is controlled to perform security protection against security attacks corresponding to the security vulnerability information according to the security protection instructions sent by the Portal. Through the implementation of this application's solution, security vulnerability information detected by IAST is aggregated, and security vulnerability information to be protected is obtained through the security detection probe. When a security attack is received, security protection against the attack is performed based on the security detection probe, improving the accuracy of security vulnerability protection while providing real-time application protection on the production line.

[0044] Figure 2The method described in the second embodiment of this application is a refined IAST-linked real-time protection method, which includes:

[0045] Step 201: Load a security detection probe based on real-time application self-protection technology into the web server.

[0046] Step 202: Obtain the first security vulnerability information based on the security vulnerability information summarized by IAST during the testing phase.

[0047] Specifically, in this embodiment, IAST is an interactive application security test; the security vulnerability information includes: security vulnerability identifier and security vulnerability type.

[0048] Step 203: Import the first security vulnerability information into the Portal, and obtain the second security vulnerability information corresponding to the user's business needs from the Portal based on the security detection probe.

[0049] Step 204: Analyze the security vulnerability information using the RASP analysis engine, and determine the first severity level of the security vulnerability information in the second security vulnerability information based on the analysis results.

[0050] Specifically, in this embodiment, each security vulnerability corresponds to a severity level. If the security vulnerability information corresponds to one security vulnerability, then the first severity level can be understood as one severity level; if the security vulnerability information corresponds to multiple security vulnerabilities, then the first severity level can be understood as the severity level of multiple security vulnerabilities.

[0051] Step 205: When the web server is under security attack, according to the security protection instructions sent by the Portal, control the security detection probe to determine the security vulnerability information corresponding to the security attack.

[0052] Step 206: Based on the first severity level determined by the RASP analysis engine for the security vulnerability information, determine the second severity level of the security attack.

[0053] Specifically, in this embodiment, if there is only one security vulnerability information corresponding to a system security vulnerability in the security attack, the second severity level can be directly represented as the first severity level of that security vulnerability information; if there are only multiple security vulnerability information corresponding to a system security vulnerability in the security attack, the weights of all security vulnerability information in the security attack are analyzed according to the user's actual business needs and the severity level of the security vulnerability, and a weighted average is calculated for all security vulnerability information to obtain the final second severity level; if the security vulnerability information in the security attack does not exist in the security vulnerability information database of the RASP system, the similarity comparison is performed between the feature information contained in the security vulnerability information in the security attack and the security vulnerability information in the RASP system, and the second severity level corresponding to the security attack is determined based on the comparison result.

[0054] Step 207: If the second severity level is lower than the preset security protection level, control the security detection probe to intercept the security attack.

[0055] Step 208: If the second severity level is higher than or equal to the preset security protection level, the security detection probe will report the security attack to the Portal after intercepting the security attack, and perform real-time security protection based on the characteristics of the security attack.

[0056] According to the IAST-linked real-time protection method provided in this application, a security detection probe based on real-time application self-protection technology is loaded into the web server; based on the security vulnerability information summarized by IAST during the testing phase, first security vulnerability information is obtained; the first security vulnerability information is imported into the Portal, and the security detection probe obtains second security vulnerability information corresponding to user business needs at the Portal; the security vulnerability information is analyzed by the RASP analysis engine, and the first severity level of the security vulnerability information in the second security vulnerability information is determined based on the analysis results; when the web server is attacked, the security detection probe is controlled to determine the security vulnerability information corresponding to the security attack according to the security protection command sent by the Portal; the second severity level of the security attack is determined based on the first severity level of the security vulnerability information determined by the RASP analysis engine; if the second severity level is lower than the preset security protection level, the security detection probe is controlled to intercept the security attack; if the second severity level is higher than or equal to the preset security protection level, the security detection probe is controlled to report the security attack to the Portal after intercepting the security attack, and real-time security protection is performed based on the characteristics of the security attack. By implementing the solution proposed in this application, security vulnerability information detected by IAST is aggregated, and security vulnerability information to be protected is obtained through security detection probes. When a security attack is received, security protection is provided based on the security detection probes, thereby improving the accuracy of security vulnerability protection while providing real-time protection for applications on the production line.

[0057] Figure 3 This application provides a third embodiment of an IAST-linked real-time protection device, which can be used to implement the IAST-linked real-time protection method in the foregoing embodiments. For example... Figure 3 As shown, the IAST-linked real-time protection device mainly includes:

[0058] Loading module 301 is used to load security detection probes based on real-time application self-protection technology into the web server;

[0059] Import module 302 is used to obtain IAST security vulnerability information and import the IAST security vulnerability information into the Portal.

[0060] The acquisition module 303 is used to acquire information about security vulnerabilities to be protected from the Portal based on the security detection probe.

[0061] The protection module 304 is used to control the security detection probe to perform security protection on the security vulnerabilities corresponding to the security vulnerability information according to the security protection instructions sent by the Portal.

[0062] In one optional implementation of this embodiment, the acquisition module is specifically used to: determine security vulnerability information based on the IAST of the testing phase; wherein, IAST is an interactive application security test; the security vulnerability information includes: security vulnerability identifier and security vulnerability type; and obtain security vulnerability information through the security vulnerability information summarized by IAST.

[0063] Furthermore, in an optional implementation of this embodiment, the import module is specifically used to: create an API interface on the Portal side, and generate an import window for security vulnerability information based on the API interface; select corresponding security vulnerability information according to preset security protection rules, and import the security vulnerability information to the Portal side through the import window.

[0064] Furthermore, in an optional implementation of this embodiment, the IAST-linked real-time protection device further includes a query module and an execution module. The query module is used to: create a security vulnerability information database on the Portal side, and query historical import information of security vulnerability information based on the security vulnerability information database. The execution module is used to: detect whether security vulnerability information exists in the security vulnerability information database based on the historical import information; if the security vulnerability information database does not contain security vulnerability information, then execute the step of importing the security vulnerability information to the Portal side through the import window.

[0065] Furthermore, in another optional implementation of this embodiment, the acquisition module is specifically used to: determine the security vulnerability to be protected based on the user's business needs; and acquire the corresponding security vulnerability information on the Portal based on the security detection probe targeting the security vulnerability.

[0066] In an optional implementation of this embodiment, the IAST-linked real-time protection device further includes an analysis module and a determination module. The analysis module is used to analyze security vulnerability information using the RASP analysis engine. The determination module is used to determine the first severity level of the security vulnerability information based on the analysis results. Specifically, the protection module is used to control the security detection probes to adopt a security protection strategy corresponding to the first severity level, based on the security protection instructions sent from the Portal, to provide security protection against security attacks corresponding to the security vulnerability information.

[0067] Furthermore, in an optional implementation of this embodiment, the protection module is further configured to: when the web server is subjected to a security attack, control the security detection probe to determine the security vulnerability information corresponding to the security attack according to the security protection instruction sent by the Portal; determine the second severity level of the security attack according to the first severity level determined by the RASP analysis engine for the security vulnerability information; if the second severity level is lower than the preset security protection level, control the security detection probe to intercept the security attack; if the second severity level is higher than or equal to the preset security protection level, control the security detection probe to report the security attack to the Portal after intercepting the security attack, and perform real-time security protection according to the characteristics of the security attack.

[0068] According to the IAST-linked real-time protection device provided in this application, a security detection probe based on real-time application self-protection technology is loaded into the web server; IAST security vulnerability information is obtained and imported into the Portal; the security vulnerability information to be protected is obtained from the Portal based on the security detection probe; and the security detection probe is controlled to perform security protection against security attacks corresponding to the security vulnerability information according to the security protection instructions sent by the Portal. Through the implementation of this application, security vulnerability information detected by IAST is aggregated, and security vulnerability information to be protected is obtained through the security detection probe. When a security attack is received, security protection is performed against the security attack based on the security detection probe, improving the accuracy of security vulnerability protection while providing real-time application protection on the production line.

[0069] Figure 4 An electronic device is provided in the fourth embodiment of this application. This electronic device can be used to implement the IAST-linked real-time protection method in the foregoing embodiments, and mainly includes:

[0070] The system includes a memory 401, a processor 402, and a computer program 403 stored on the memory 401 and executable on the processor 402. The memory 401 and the processor 402 are connected via communication. When the processor 402 executes the computer program 403, it implements the IAST-linked real-time protection method described in the foregoing embodiments. The number of processors can be one or more.

[0071] The memory 401 can be a high-speed random access memory (RAM) or a non-volatile memory, such as a disk storage device. The memory 401 is used to store executable program code, and the processor 402 is coupled to the memory 401.

[0072] Furthermore, embodiments of this application also provide a computer-readable storage medium, which may be disposed in the electronic device described in the above embodiments, and the computer-readable storage medium may be as described above. Figure 4 The memory in the illustrated embodiment.

[0073] The computer-readable storage medium stores a computer program that, when executed by a processor, implements the IAST-linked real-time protection method described in the foregoing embodiments. Furthermore, the computer-readable storage medium can also be a USB flash drive, external hard drive, read-only memory (ROM), RAM, magnetic disk, or optical disk, or any other medium capable of storing program code.

[0074] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0075] The modules described as separate components may or may not be physically separate. Similarly, the components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0076] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0077] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned readable storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0078] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0079] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0080] The above is a description of the RASP-based IAST linkage real-time protection method and related devices provided in this application. For those skilled in the art, based on the ideas of the embodiments of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A real-time protection method for IAST linkage, characterized in that, include: Load a security detection probe based on real-time application self-protection technology into the web server; Obtain IAST security vulnerability information and import the IAST security vulnerability information into the Portal terminal; The security vulnerability information to be protected is obtained from the Portal based on the security detection probe. Based on the security protection instructions sent by the Portal, the security detection probe is controlled to perform security protection against security attacks corresponding to the security vulnerability information. The step of obtaining security vulnerability information from IAST includes: determining security vulnerability information based on IAST during the testing phase; wherein, IAST is an interactive application security test; the security vulnerability information includes: security vulnerability identifier and security vulnerability type; and obtaining security vulnerability information through the security vulnerability information summarized by IAST. After the step of obtaining the security vulnerability information to be protected from the Portal based on the security detection probe, the method further includes: analyzing the security vulnerability information based on the RASP analysis engine; and determining the first severity level of the security vulnerability information based on the analysis results. The step of controlling the security detection probe to perform security protection against security attacks corresponding to the security vulnerability information according to the security protection command sent by the Portal includes: when the web server is subjected to a target security attack, controlling the security detection probe to determine the target security vulnerability information corresponding to the target security attack according to the security protection command sent by the Portal; determining a second severity level corresponding to the target security attack according to the first severity level; if the second severity level is lower than a preset security protection level, controlling the security detection probe to intercept the security attack; if the second severity level is higher than or equal to the preset security protection level, controlling the security detection probe to report the security attack to the Portal after intercepting the security attack, and performing real-time security protection according to the characteristics of the security attack.

2. The IAST-linked real-time protection method according to claim 1, characterized in that, The step of importing the IAST security vulnerability information into the Portal includes: Create an API interface on the Portal and generate an import window for the security vulnerability information based on the API interface; Select the corresponding security vulnerability information according to the preset security protection rules, and import the security vulnerability information into the Portal through the import window.

3. The IAST-linked real-time protection method according to claim 2, characterized in that, After the step of importing the security vulnerability information to the Portal through the import window, the method further includes: A security vulnerability information database is created on the Portal, and historical import information of the security vulnerability information is queried based on the security vulnerability information database; Based on historical imported information, check whether the security vulnerability information exists in the security vulnerability information database; If the security vulnerability information database does not contain the security vulnerability information, then the step of importing the security vulnerability information into the Portal through the import window is executed.

4. The IAST-linked real-time protection method according to claim 2, characterized in that, The step of obtaining the security vulnerability information to be protected from the Portal based on the security detection probe includes: Identify the security vulnerabilities to be protected based on the user's business needs; Based on the security detection probe targeting the security vulnerability, the corresponding security vulnerability information is obtained at the Portal.

5. An IAST-linked real-time protection device, characterized in that, include: The loading module is used to load security detection probes based on real-time application self-protection technology into the web server; The import module is used to obtain IAST security vulnerability information and import the IAST security vulnerability information into the Portal terminal. When the import module performs the function of obtaining security vulnerability information from IAST, it is specifically used to: determine security vulnerability information based on IAST during the testing phase; wherein, IAST is an interactive application security test; the security vulnerability information includes: security vulnerability identifier and security vulnerability type; and obtain security vulnerability information through the security vulnerability information summarized by IAST. The acquisition module is used to acquire information about security vulnerabilities to be protected from the Portal based on the security detection probe. The protection module is used to control the security detection probe to perform security protection on the security vulnerability corresponding to the security vulnerability information according to the security protection command sent by the Portal terminal; The analysis module is used to analyze security vulnerability information based on the RASP analysis engine; The determination module is used to determine the first severity level of the security vulnerability information based on the analysis results. The protection module is specifically used for: when the web server is subjected to a target security attack, controlling the security detection probe to determine the target security vulnerability information corresponding to the target security attack according to the security protection instruction sent by the Portal; determining the second severity level corresponding to the target security attack according to the first severity level; if the second severity level is lower than the preset security protection level, controlling the security detection probe to intercept the security attack; if the second severity level is higher than or equal to the preset security protection level, controlling the security detection probe to report the security attack to the Portal after intercepting the security attack, and performing real-time security protection according to the characteristics of the security attack.

6. An electronic device, characterized in that, Includes memory and processor, of which: The processor is used to execute computer programs stored in the memory; When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images