A protection method for intercepting Java memory injection based on RASP

Abstract

The present invention relates to the field of network security technology, and in particular to a RASP-based protection technology for intercepting Java memory malware injection. The technology comprises loading a RASP probe on a Java application side; the RASP probe detecting the running dynamics of the Java application in real time; and formulating an application whitelist based on the real-time detected Java application side data information; comparing the class objects loaded by Java obtained in real time by the RASP with the whitelist. When the class objects loaded by Java meet the whitelist requirements, the system command continues to execute; when they do not meet the whitelist requirements, the class object information is backtracked through a feedback mechanism. The present invention primarily addresses the overall lag of traditional memory malware detection by intercepting the behavior of a Java application dynamically adding classes that do not exist on the hard disk during operation, thereby avoiding the overall lag of Java memory malware detection technology.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, in particular to a protection technology for intercepting Java memory horse injection based on RASP. Background Art

[0002] Attackers actively inject memory malware into Java applications, but security personnel can only detect it through passive detection. Since passive detection is a security measure only after successful injection, even if passive detection detects the memory malware, the application has already suffered data theft and privacy leaks. This is primarily due to the fact that memory malware security detection technology requires analyzing hard drive and memory characteristics, performing security calculations on these data to detect the presence of the memory malware. This calculation is complex and time-consuming, consuming computing resources and creating time lags. Furthermore, attackers can exploit the injected memory malware to dynamically uninstall the memory malware detection module, ensuring that the attacker can carry out subsequent attacks. Traditional memory malware detection technology exhibits an overall lag in detecting memory malware injection attacks. Summary of the Invention

[0003] The purpose of the present invention is to solve the defects mentioned in the above background technology by proposing a protection technology for intercepting Java memory injection based on RASP.

[0004] The technical solution adopted in the present invention is as follows:

[0005] Provides a RASP-based protection technology for intercepting Java memory injection, including:

[0006] Load the RASP probe on the Java application side; the RASP probe detects the running dynamics of the Java application in real time; and formulates an application whitelist based on the real-time detected Java application side data information; compares the class objects loaded by Java obtained by RASP in real time with the whitelist. When the class objects loaded by Java meet the whitelist, continue to execute the system command; when they do not meet the whitelist, trace back the class object information through the feedback mechanism.

[0007] As a preferred technical solution of the present invention: the comparison algorithm is as follows:

[0008] S1.1: Encode the character string according to the whitelist and record the position information of each character to create an index table;

[0009] S1.2: When a new class object is detected, the new class object is encoded using the same encoding method and indexed according to the index table;

[0010] S1.3: Perform shift operations on the character position information to perform character matching on the new class object.

[0011] As an optimal technical solution of the present invention: in the comparison algorithm, preliminary information division is performed on the class objects that appear through the weight function, an index table is established, classification is performed according to the character weight function of the number of times the characters appear in the string, and indexing and comparison are performed according to the character weight function of the detected object.

[0012] The weight function is as follows:

[0013]

[0014] Among them, the string Y is a string of k characters. r It is formed by combining the characters in the string Y in any order;

[0015] The character weight function is as follows:

[0016]

[0017] Where, let log0=0, X is a string, y is a character in the string, n y is the number of times character y appears in string X, and n is the total number of characters in string X.

[0018] As a preferred technical solution of the present invention: the index table is updated in real time according to the Java application end data information.

[0019] As a preferred technical solution of the present invention: when the comparison algorithm shows that the Java class object currently loaded by Java does not exist, the stack is traversed in a loop through the feedback mechanism to detect whether there is an exception in the current class.

[0020] As a preferred technical solution of the present invention: in the loop traversal stack, when backtracing determines that the Java class behavior is abnormal, the behavior of the added class is intercepted, an alarm message is generated, and recorded in the file log.

[0021] As a preferred technical solution of the present invention: the interception adds a class behavior, and intercepts the class object with abnormality according to the security interception mechanism.

[0022] As a preferred technical solution of the present invention: the steps of the security interception mechanism are as follows: when Java attempts to load a Java class object that does not exist on the hard disk, it backtracks to determine whether there is reflective behavior or expression engine code for the data entry in the call stack, and intercepts if so.

[0023] As an optimal technical solution of the present invention: a blacklist is generated for the intercepted class objects, the class objects recorded in the blacklist are encoded, recorded in the index table after encoding, and marked as blacklisted; when an abnormal class object is detected and marked as blacklisted, it is directly intercepted, an alarm information is generated and recorded in the file log.

[0024] As a preferred technical solution of the present invention: when it is determined that an exception occurs, intercepting the behavior of adding a class also includes intercepting the monitoring exceptions of application permissions and intercepting the monitoring exceptions of database function parameters.

[0025] Compared with the prior art, the RASP-based Java memory injection interception protection technology provided by the present invention has the following beneficial effects:

[0026] This invention uses RASP technology to analyze in real time if an application attempts to add a class that doesn't exist on disk. If a Java expression engine stack frame or a Java reflection stack frame specific to a data input point is found during stack traceback, the attempt to add the class is directly intercepted. This invention primarily addresses the overall lag inherent in traditional memory bug detection by intercepting Java applications dynamically adding classes that don't exist on disk during runtime, thus avoiding the overall lag inherent in Java memory bug detection technology.

[0027] By analyzing the technical nature of memory horse injection, we thoroughly research the attacker's attack methods and iterate on the defender's technical solutions. From both the attacker's and defender's perspectives, we propose methods for directly blocking external memory horse attacks and deploying high-quality defenses. We build proactive defense measures to establish attack interception and counterattack capabilities; optimize security attack path management to reduce application security risks; and enhance security personnel's offensive and defensive capabilities and their emergency response capabilities for network security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A technical flow chart of a preferred embodiment of the present invention;

[0029] Figure 2 A diagram of a security interception mechanism for reflective behavior at a data entry in a preferred embodiment of the present invention;

[0030] Figure 3 This is a diagram of the expression engine code security interception mechanism in the preferred embodiment of the present invention. DETAILED DESCRIPTION

[0031] It should be noted that, unless there is a conflict, the embodiments and features in the embodiments of this embodiment can be combined with each other. The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0032] Reference Figure 1-Figure 3 The preferred embodiment of the present invention provides a RASP-based protection technology for intercepting Java memory injection, including:

[0033] Load the RASP probe on the Java application side; the RASP probe detects the running dynamics of the Java application in real time; and formulates an application whitelist based on the real-time detected Java application side data information; compares the class objects loaded by Java obtained by RASP in real time with the whitelist. When the class objects loaded by Java meet the whitelist, continue to execute the system command; when they do not meet the whitelist, trace back the class object information through the feedback mechanism.

[0034] The comparison algorithm is as follows:

[0035] S1.1: Encode the character string according to the whitelist and record the position information of each character to create an index table;

[0036] S1.2: When a new class object is detected, the new class object is encoded using the same encoding method and indexed according to the index table;

[0037] S1.3: Perform shift operations on the character position information to perform character matching on the new class object.

[0038] In the comparison algorithm, the class objects that appear are preliminarily divided by a weight function, an index table is established, classification is performed according to the character weight function of the number of times the characters appear in the string, and indexing and comparison are performed according to the character weight function of the detected object.

[0039] The weight function is as follows:

[0040]

[0041] Among them, the string Y is a string of k characters. r It is formed by combining the characters in the string Y in any order;

[0042] The character weight function is as follows:

[0043]

[0044] Where, let log0=0, X is a string, y is a character in the string, n y is the number of times character y appears in string X, and n is the total number of characters in string X.

[0045] The index table is updated in real time according to the Java application data information.

[0046] When it is found out according to the comparison algorithm that the Java class object currently loaded by Java does not exist, the stack is traversed in a loop through the feedback mechanism to detect whether there is an exception in the current class.

[0047] In the loop traversal stack, when backtracking determines that the Java class behavior is abnormal, the behavior of the added class is intercepted, an alarm message is generated, and it is recorded in the file log.

[0048] The interception adds a class behavior, and intercepts the class object that has an exception according to the security interception mechanism.

[0049] The steps of the security interception mechanism are as follows: when Java attempts to load a Java class object that does not exist on the hard disk, it backtracks to determine whether there is any reflection behavior or expression engine code for the data entry in the call stack, and intercepts if so.

[0050] A blacklist is generated for the intercepted class objects, and the class objects recorded in the blacklist are encoded, recorded in the index table after encoding, and marked as blacklisted; when an abnormal class object is detected and marked as blacklisted, it is directly intercepted, an alarm information is generated and recorded in the file log.

[0051] When it is determined that an exception occurs, intercepting the behavior of adding a class also includes intercepting the monitoring exceptions of application permissions and intercepting the monitoring exceptions of database function parameters.

[0052] In this embodiment, all systems open to the Internet must record records and perform compatibility tests before going online. After ensuring that there are no compatibility issues, the RASP probe that can intercept the injection of memory horses is installed and configured. Figure 1, the RASP probe detects the running dynamics of Java applications in real time; and formulates an application whitelist based on the data information of the Java application side, and performs a shift comparison index on the class objects loaded by Java obtained by RASP in real time and the index table established based on the whitelist, and matches them with the characters in the index table. When the class objects loaded by Java meet the whitelist, the system command continues to be executed. When they do not meet the whitelist, the class object information is backtracked through the feedback mechanism. The index table is updated in real time based on the data information of the Java application side. In the process of looping through the stack, when the backtracking determines that the class behavior of Java is abnormal, the behavior of adding the class is intercepted, an alarm message is generated, and it is recorded in the file log. Figure 2 、 Figure 3 When Java tries to load a Java class object that does not exist on the hard disk, it will backtrack to determine whether there is any reflective behavior or expression engine code for the data entry in the call stack. If so, it will be intercepted. A blacklist is generated for the intercepted class objects, and the class objects recorded in the blacklist are encoded, recorded in the index table after encoding, and marked as blacklisted. When an abnormal class object is detected as being marked as blacklisted, it is directly intercepted, an alarm message is generated and recorded in the file log. Based on the interception technology of RASP, monitoring anomalies of application permissions and monitoring anomalies of database function parameters are also intercepted.

[0053] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above and that the invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered in all respects as illustrative and non-restrictive, and the scope of the invention is defined by the appended claims, not the foregoing description, and all variations within the meaning and range of equivalents of the claims are intended to be included therein. Any reference sign in a claim should not be construed as limiting the claim to which it relates.

[0054] In addition, it should be understood that although this specification is described in terms of implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation methods that can be understood by those skilled in the art.

Claims

1. A protection method for intercepting Java memory injection based on RASP, characterized by: include: Load the RASP probe on the Java application side; RASP probes detect the running dynamics of Java applications in real time; An application whitelist is created based on the real-time detected Java application data. The class objects loaded by Java obtained by RASP in real time are compared with the whitelist. When the class objects loaded by Java meet the whitelist, the system command is continued to execute. When they do not meet the whitelist, the class object information is backtracked through the feedback mechanism. The comparison of the Java loaded class objects obtained by RASP in real time with the whitelist includes: S1.1: Encode the character string according to the whitelist and record the position information of each character to create an index table; S1.2: When a new class object is detected, the new class object is encoded using the same encoding method and indexed according to the index table; S1.3: Shift the character position information to perform character matching on the new class object; Among them, the weight function is used to perform preliminary information division on the class objects that appear, and an index table is established. Classification is performed according to the character weight function of the number of times the characters appear in the string, and indexing and comparison are performed according to the character weight function of the detected object; The weight function is as follows: ； Among them, the string Y is a string of k characters. It is formed by combining the characters in the string Y in any order; The character weight function is as follows: ； Among them, , X is a string, y is a character in the string, is the number of times character y appears in string X, and n is the total number of characters in string X.

2. The RASP-based protection method for intercepting Java memory injection according to claim 1 is characterized in that: The index table is updated in real time according to the Java application data information.

3. The RASP-based protection method for intercepting Java memory injection according to claim 2 is characterized in that: When the Java class object loaded by RASP obtained in real time is compared with the whitelist and it is found that the Java class object currently loaded by Java does not exist, the stack is traversed in a loop through the feedback mechanism to detect whether there is an exception in the current class.

4. The RASP-based protection method for intercepting Java memory injection according to claim 3 is characterized in that: In the loop traversal stack, when backtracking determines that the Java class behavior is abnormal, the behavior of the added class is intercepted, an alarm message is generated, and it is recorded in the file log.

5. The RASP-based protection method for intercepting Java memory injection according to claim 4 is characterized in that: The interception adds a class behavior, and intercepts the class object that has an exception according to the security interception mechanism.

6. The RASP-based Java memory injection interception protection method according to claim 5 is characterized in that: The steps of the security interception mechanism are as follows: when Java attempts to load a Java class object that does not exist on the hard disk, it backtracks to determine whether there is any reflection behavior or expression engine code for the data entry in the call stack, and intercepts if so.

7. The RASP-based Java memory injection interception protection method according to claim 6, characterized in that: A blacklist is generated for the intercepted class objects, and the class objects recorded in the blacklist are encoded, recorded in the index table after encoding, and marked as blacklisted; when an abnormal class object is detected and marked as blacklisted, it is directly intercepted, an alarm information is generated and recorded in the file log.

8. The RASP-based method for intercepting Java memory injection according to claim 4 is characterized in that: When the Java class behavior is judged to be abnormal by backtracing, the behavior of adding the class is intercepted, and the monitoring abnormality interception of application permissions and the monitoring abnormality interception of database function parameters are also included.

Images