Application upgrade method, device, equipment and medium based on RASP

Abstract

The present invention provides a RASP-based application upgrade method, device, equipment and medium, which obtains application security protection rules by loading a RASP probe in a web container, monitors and analyzes the access traffic in the server where the web container is located and the system of the server, obtains application security status information and system security information, performs application security protection operations on the web container, and performs application upgrade operations on a preset RASP system upgrade module. That is, when the technical solution is implemented, the system security information is obtained by monitoring and analyzing the access traffic in the server where the web container is located and the system of the server, and based on this, the application upgrade operation is performed on the preset RASP system upgrade module in real time and quickly, thereby avoiding the protection lag phenomenon. At the same time, the application security status information obtained can also be used to perform high-accuracy application security protection operations on the web container to improve the accuracy of protection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an application upgrade method, device, equipment and medium based on RASP (Runtime application self-protection). Background Art

[0002] Currently, web application security protection is basically handled after security vulnerabilities are discovered, and it is rare to conduct pre-emptive defense against security attacks. Recently, RASP technology has been introduced into the protection of application software security. Currently, patents based on RASP basically use traditional hardware, such as WAF (Web Application Fire ware) rule matching and hardware combination, such as Cloud WAF, etc. However, most of these technologies are based on hardware combination, and related hardware is set up at the front end of the web server to defend against security vulnerabilities. They do not really go deep into the application code level to conduct deep security defense for the web server. The disadvantages are as follows: complex deployment, high cost, and poor universality; unable to conduct real-time warning and defense of security attacks; unable to conduct deep security defense for Web servers; unable to achieve protection lag caused by system upgrades; unable to meet users' personalized security defense needs; low protection accuracy; and limited applicable scenarios.

[0003] Therefore, the prior art needs to be improved. Summary of the invention

[0004] The main purpose of the present invention is to propose an application upgrade method, device, equipment and medium based on RASP, so as to at least solve the technical problem of protection lag existing in the protection method of web applications in the related art.

[0005] A first aspect of the present invention provides an application upgrade method based on RASP, comprising:

[0006] Load the RASP probe in the web container to obtain application security protection rules;

[0007] The access traffic in the server where the web container is located and the system of the server are monitored and analyzed by using the application security protection rules to obtain application security status information and system security information;

[0008] An application security protection operation is performed on the web container according to the application security status information, and an application upgrade operation is performed on a preset RASP system upgrade module according to the system security information.

[0009] A second aspect of the present invention provides an application upgrade device, comprising:

[0010] Loading module, used to load RASP probe in the web container and obtain application security protection rules;

[0011] An analysis module, used to monitor and analyze the access traffic in the server where the web container is located and the system of the server through the application security protection rules, and obtain application security status information and system security information;

[0012] The upgrade module is used to perform application security protection operations on the web container according to the application security status information, and perform application upgrade operations on a preset RASP system upgrade module according to the system security information.

[0013] A third aspect of the present invention provides an electronic device, including a memory, a processor and a bus;

[0014] The bus is used to realize the connection and communication between the memory and the processor;

[0015] The processor is used to execute the computer program stored in the memory;

[0016] When the processor executes the computer program, the steps in the RASP-based application upgrade method provided in the first aspect are implemented.

[0017] A fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the RASP-based application upgrade method provided in the first aspect are implemented.

[0018] The present invention provides an application upgrade method, device, equipment and medium based on RASP, which obtains application security protection rules by loading a RASP probe in a web container, monitors and analyzes the access traffic in the server where the web container is located and the system of the server through the application security protection rules, obtains application security status information and system security information, performs application security protection operations on the web container according to the application security status information, and performs application upgrade operations on the preset RASP system upgrade module according to the system security information. That is, when the technical solution is implemented, the system security information is obtained by monitoring and analyzing the access traffic in the server where the web container is located and the system of the server, and based on this, the application upgrade operation is performed on the preset RASP system upgrade module in real time and quickly, thereby avoiding the protection lag phenomenon. At the same time, the application security status information obtained can also be used to perform high-accuracy application security protection operations on the web container to improve the accuracy of protection; and the RASP technology is used to perform real-time protection on applications in the production environment, and real-time protection can be performed on the application on the production line, and the applicable scenarios are more in line with reality and will not be limited. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A basic flow chart of the RASP-based application upgrade method provided in the first embodiment of the present application;

[0021] Figure 2 A detailed flowchart of the RASP-based application upgrade method provided in the second embodiment of the present application;

[0022] Figure 3 A schematic diagram of a program module of an application upgrade device provided in the third embodiment of the present application;

[0023] Figure 4 A schematic diagram of the structure of an electronic device provided in the fourth embodiment of the present application.

[0024] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0025] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0026] It should be noted that related terms such as "first", "second", etc. can be used to describe various components, but these terms do not limit the components. These terms are only used to distinguish one component from another component. For example, without departing from the scope of the present invention, a first component can be referred to as a second component, and the second component can also be referred to as a first component similarly. The term "and / or" refers to any one or more combinations of related items and description items.

[0027] See also Figure 1 , Figure 1 A RASP-based application upgrade method provided by an embodiment of the present invention is shown, which includes the following steps:

[0028] Step S101, loading the RASP probe in the web container to obtain application security protection rules.

[0029] Specifically, a web container is a service program. There is a program that provides corresponding services on a port of the server, and this program processes requests from the client, such as the Tomcat container in JAVA, IIS or PWS in ASP. Generally speaking, a server can have multiple containers, that is, a web container will be in a server.

[0030] It should be understood that the RASP probe is a security detection probe based on the Runtime Application Self-Protection (RASP) technology. RASP is a new type of application security protection technology that injects protection programs into applications like "vaccines". The application is integrated and can detect and block security attacks in real time, so that the application has self-protection capabilities. When the application is actually attacked, it can automatically defend against it without manual intervention. RASP technology can quickly integrate security defense functions into running applications. It intercepts all calls from applications to the system to ensure that they are safe and verifies data requests directly within the application. At the same time, this technology will not affect the design of the application because the detection and protection functions of RASP run on the system where the application runs.

[0031] It should be noted that traditional security vulnerability attack defense technology is usually achieved by installing a firewall, and the installed firewall, whether in series or parallel deployment mode, requires the use of the user's source code, which is easy to leak the privacy of the protected application. In this embodiment, the RASP probe is loaded into the web container, and the entire process does not require the use of the customer's source code, which can protect the privacy of private applications. At the same time, the application security protection rules can also be obtained, which are the rules configured for the web container for security protection of the application.

[0032] In some implementations of this embodiment, the step of obtaining application security protection rules specifically includes: sending rule configuration instructions to the Portal end through the RASP probe, and obtaining the application security protection rules configured by the Portal end according to the rule configuration instructions.

[0033] Specifically, since the RASP probe is loaded in the web container, the RASP probe can communicate with the Portal end, and accordingly, the rule configuration instruction can be automatically generated and sent to the Portal end to instruct the Portal end to send the preset application security protection rules or the configured application security protection rules to the RASP probe, thereby obtaining the application security protection rules. Among them, the Portal end is a terminal for configuring application security protection rules.

[0034] Specifically, the Portal end is a terminal used to configure application security protection rules. Before sending application security protection rules, it is necessary to ensure that the RASP probe and the web container are in the same server. The RASP probe and the web container are deployed on the same server. The specific deployment method is: set the server of the RASP probe as the target server, and set the server of the web container as the target server, so that both are in the same server.

[0035] It should also be noted that traditional security vulnerability attack protection technology usually writes protection rules in the initial stage of installation, which cannot be modified after installation is completed, or the protection device needs to be turned off to modify the rules, and the device needs to be restarted after the modification is completed. In this process, there is a long security vacuum period, and the process is complicated. In this embodiment, the Portal end is connected to the RASP probe and the web container, and based on the Portal end as a terminal for configuring the security protection rules, the Portal end can configure the application security protection rules through configuration instructions (the application security protection rules are used to protect the application in the web container), that is, the configured custom security protection rules can be sent to the RASP probe. Based on this, the RASP probe will perform subsequent security detection and other monitoring processes according to the corresponding application security protection rules.

[0036] Step S102: monitor and analyze the access traffic and system in the server where the web container is located by applying security protection rules to obtain application security status information and system security information.

[0037] Specifically, after obtaining the application security protection rules, the application security protection rules are configured on the RASP probe. Among them, the access traffic represents the access location, access application, access time and access frequency of the application in the server. The system represents the operating system installed on the server, such as the operating system installed on the Web server. It is the infrastructure platform of the enterprise IT system and is also a type 1 operating system divided by the application field. It plays additional management, configuration, stability, security and other functions and is located in the "heart" of each network. In this embodiment, the above-mentioned access traffic and system can be monitored and analyzed by using security protection rules to obtain application security status information and system security information. The application security status information includes the use security level of all applications in the server, such as the low security level of the browser in use (this state is generally presented after being attacked), the high security level of the player in use (this state is generally presented when not attacked), and the low security level of the chat interface in use. And the system security information includes the security level of the current architecture in the system, such as the abnormal state of the front-end framework in the operating system in use (this state is generally presented when the response time is too long), and the abnormal state of the back-end framework in the operating system in use (this state is generally presented when the code reports an error).

[0038] Step S103: perform application security protection operations on the web container according to the application security status information, and perform application upgrade operations on the preset RASP system upgrade module according to the system security information.

[0039] Specifically, after obtaining the application security status information and system security information, since the application security status information can reflect the security status of the application in the server where the web container is located, that is, it can determine the target application with the lowest security level, the application security protection operation is performed on the target application in the web container through the application security status information, and precise protection is performed to further improve the protection accuracy of the web container. At the same time, since the system security information can reflect the security status of the framework of the system in the server, that is, it can determine the framework of the system in an abnormal state, the preset RASP system upgrade module is applied through the system security information. The upgrade operation is performed to improve the RASP system upgrade module, that is, the abnormal state in the framework is repaired through the upgrade operation to avoid the phenomenon of protection lag. In addition, the RASP technology is used to provide real-time protection for applications in the production environment, and real-time protection can be provided for applications on the production line. The applicable scenarios are more practical and will not be limited.

[0040] In some specific implementations of this embodiment, the step of performing application security protection operations on the web container according to the application security status information specifically includes: sequentially using a preset cookie detection strategy, a process security detection strategy, a background weak password detection strategy, a database connection account security detection strategy, and a user-defined security detection strategy to analyze the application security status information, summarize the security detection information, and perform application security protection operations on the web container according to the security detection information.

[0041] Specifically, since the RASP probe has been configured with application security protection rules, when the application security protection rules include cookie detection strategy, process security detection strategy, background weak password detection strategy, database connection account security detection strategy and user-defined security detection strategy, the cookie detection strategy, process security detection strategy, background weak password detection strategy, database connection account security detection strategy and user-defined security detection strategy can be used in turn to analyze the application security status information, thereby summarizing the security detection information, and then performing application security protection operations on the web container based on the summarized security detection information.

[0042] The following is an explanation of the detection strategy in the application security protection rules:

[0043] Specifically, the cookie detection policy means at least a policy that includes prohibiting the use of cookies, cookie storage path, cookie expiration check, checking cookie options in the browser, browser deleting cookies, cookie encryption, and other cookie detection methods. Among them, cookies contain limited data collected by each website to be visited, and then store the information in a text file in the hard drive of the device used during the session, and access the data when the browser requests information from the server, such as the user ID or preferences previously established. Cookies are most commonly used to store the visitor's user ID or remember the code of certain websites, which makes it faster and more convenient for users to visit the next time. They are often used by shopping websites, especially those that use shopping carts, and marketing websites use them to personalize advertisements based on the user's interests previously tracked and recorded in cookies; they are also used by other websites that are interested in tracking user visits. As such, since cookies can play an important role in the smoothness of website operation, it is important to test how they are written and stored on your hard drive through the websites you visit, and the security issues exposed are also important, because each cookie stores important information locally. If a cookie detection policy is not in place, the security of the web container will be greatly affected.

[0044] Specifically, the process security detection strategy refers to the process of verifying the security level of the application and identifying potential security defects. Its main purpose is to find the security risks in the software's own programming and check the application's ability to prevent illegal intrusion. Different security indicators have different testing strategies. The process security detection strategy usually includes static code inspection (verifying data flow, control flow, and information flow by comparing with the security rule library), dynamic penetration testing (using tools to simulate hacker input) and scanning data (memory) in the program. Static code inspection mainly tests the security of the source code by code reading. Common code inspection methods include data flow, control flow, information flow, etc. These test methods are matched with the security rule library to find potential security vulnerabilities. The static code inspection method is mainly tested in the coding stage to find security problems as early as possible. The dynamic penetration testing method mainly uses tools or manual methods to simulate hacker input, conduct security tests on the application, and then find security problems in the system. Dynamic penetration testing is generally carried out in the system testing stage, but the coverage rate is low, because it is difficult to cover all possibilities during the testing process. It can only provide more test data as much as possible to achieve a higher coverage rate. The main purpose of scanning the data in the program is to ensure the security of the data during the program operation and prevent it from being damaged, otherwise it will lead to buffer overflow attacks. Data scanning mainly tests the memory and tries to find vulnerabilities such as buffer overflow, which is also difficult to test with static code inspection and dynamic penetration testing.

[0045] In some specific implementations of the present embodiment, the step of performing an application security protection operation on a web container according to security detection information specifically includes: analyzing the security detection information through a preset logical link analysis rule to obtain first analysis data, matching the first analysis data through a preset feature matching rule to obtain second analysis data, determining a target security vulnerability corresponding to the second analysis data from a preset vulnerability library, determining a target to be protected according to the target security vulnerability, and performing an application security protection operation on the target to be protected.

[0046] Specifically, the RASP probe can configure preset logical link analysis rules and feature matching rules through the Portal end, and the RASP probe can establish communication with the vulnerability library. After obtaining the security protection information, the security protection information is analyzed by the preset logical link analysis rules to obtain the first analysis data, and the first analysis data is matched by the preset feature matching rules to obtain the second analysis data, and then the target security vulnerability corresponding to the second analysis data is determined in the preset vulnerability library. Among them, the vulnerability library includes the authoritative vulnerability library of CVE and CNNVD, which is linked through the RASP probe to timely protect against security attacks. Among them, the preset logical link analysis rule can be a logical tree analysis method, and the feature matching rule can be a feature point matching method.

[0047] In some specific implementations of this embodiment, the step of performing application security protection operations on the protected target specifically includes: creating a logical interface and control instructions, sending security detection information and control instructions to the Portal end through the logical interface, and when receiving an execution instruction based on display processing feedback from the Portal end, performing application security protection operations on the protected target.

[0048] Specifically, after the target to be protected is determined, such as a certain application, a logical interface and a control instruction are created, and the security detection information and the control instruction are sent to the Portal end through the created logical interface. The control instruction is used to control the Portal end to display and process the security detection information, so that the user can observe the entire life cycle of the security vulnerability through the security detection information through the Portal end, and take actions to block security attacks. And when the execution instruction based on the display processing feedback is received from the Portal end, the application security protection operation such as increasing the security protection level and closing the application is performed on the target to be protected.

[0049] In some specific implementations of this embodiment, the step of performing an application upgrade operation on a preset RASP system upgrade module according to system security information specifically includes: determining first upgrade information corresponding to the application front end and second upgrade information corresponding to the application back end according to the system security information, and performing application upgrade operations on the web application front end upgrade module and the web application back end upgrade module in the preset RASP system upgrade module according to the first upgrade information and the second upgrade information, respectively, to form a first web application system. Among them, the web application front end upgrade module in the RASP system upgrade module represents a module for upgrading and managing the front end, and the web application back end upgrade module represents a module for upgrading and managing the back end. Generally, the program written by the front end mainly runs on the client, while the program written by the back end mainly runs on the server. The front end and the back end cooperate with each other, and the data required by the front end is provided by the back end, such as the back end outputs data to the front end through an API. The technologies used in the front end usually include HTML, CSS, and JS; the technology used in the back end is one of the programming development languages ​​such as JAVA, PHP, and Python.

[0050] Specifically, after obtaining the system security information, the first upgrade information corresponding to the application front end and the second upgrade information corresponding to the application back end are determined from the system security information through preset analysis rules, so that the web application front end upgrade module in the preset RASP system upgrade module can be upgraded according to the first upgrade information, and the web application back end upgrade module in the preset RASP system upgrade module can be upgraded according to the second upgrade information.

[0051] In some specific implementations of this embodiment, after the step of sending the security detection information and the control instruction to the Portal end through the logical interface, it also includes: when the execution instruction based on the display processing feedback of the Portal end is not received, the current system security level coefficient of the current web container is calculated, and when the current system security level coefficient is greater than the preset system security level coefficient threshold, the web upgrade information is determined according to the security detection information, the web upgrade information is sent to the Portal end, and the first web application system is upgraded according to the web upgrade package to obtain the second web application system. That is, when this embodiment is implemented, the web upgrade information is used to control the Portal end to generate a web upgrade package corresponding to the web upgrade information, that is, the upgrade package can be preset and generated through the Portal end, and the first web application system that has completed the initial stage upgrade is upgraded to the final stage, thereby further improving the web application system and ensuring the protection of the web application system finally formed.

[0052] Among them, the current system security level coefficient can be calculated by the preset calculation formula y=f(x)*A, y represents the current system security level coefficient, f(x) represents the preset function, x represents the number of target applications, and A represents the system security parameter (when an abnormality occurs in the front end of the system, the corresponding security parameter is 0.8; when an abnormality occurs in the back end of the system, the corresponding security parameter is 0.6).

[0053] See also Figure 2 , Figure 2 The method in is a refined RASP-based application upgrade method provided in the second embodiment of the present application, and the RASP-based application upgrade method includes:

[0054] Step S201, loading the RASP probe in the web container;

[0055] Step S202: Send a rule configuration instruction to the Portal end through the RASP probe to obtain the application security protection rules configured by the Portal end according to the rule configuration instruction;

[0056] Step S203, monitoring and analyzing the access traffic in the server where the web container is located and the server system by applying security protection rules, and obtaining application security status information and system security information;

[0057] Step S204, sequentially using the preset cookie detection strategy, process security detection strategy, background weak password detection strategy, database connection account security detection strategy and user-defined security detection strategy to analyze the application security status information and summarize the security detection information;

[0058] Step S205, analyzing the security detection information by using a preset logical link analysis rule to obtain first analysis data, matching the first analysis data by using a preset feature matching rule to obtain second analysis data, and determining a target security vulnerability corresponding to the second analysis data from a preset vulnerability library;

[0059] Step S206, determining a target to be protected according to the target security vulnerability, and performing an application security protection operation on the target to be protected;

[0060] Step S207, determining first upgrade information corresponding to the application front end and second upgrade information corresponding to the application back end according to the system security information, and performing application upgrade operations on the web application front end upgrade module and the web application back end upgrade module in the preset RASP system upgrade module according to the first upgrade information and the second upgrade information, respectively, to form a first web application system;

[0061] Step S208, determining the web upgrade information according to the security detection information, sending the web upgrade information to the Portal end, and performing an upgrade operation on the first web application system according to the generated web upgrade package to obtain a second web application system.

[0062] According to the RASP-based application upgrade method provided by the present application scheme, since the application security status information can reflect the usage security of the application in the server where the web container is located, that is, it can determine the target application with the lowest usage security level, the application security protection operation is performed on the target application in the web container through the application security status information, and precise protection is performed to further improve the protection accuracy of the web container. At the same time, since the system security information can reflect the security status of the framework of the system in the server, that is, it can determine the framework of the system in an abnormal state, the application upgrade operation is performed on the preset RASP system upgrade module through the system security information, thereby improving the RASP system upgrade module, that is, repairing the abnormal state in the framework through the upgrade operation, and avoiding the phenomenon of protection lag. And by using RASP technology to perform real-time protection on applications in the production environment, real-time protection can be performed on the production line for applications, and the applicable scenarios are more in line with reality and will not be limited.

[0063] It should also be noted that this embodiment also has the following advantages: it can simultaneously perform imperceptible automatic system upgrades on the Web server during the security protection process; further consolidate the security of the protected Web application server through multi-dimensional security defense detection; install our probes in the web application, and the probes can display the status of Web server attack events in detail to our portal end in real time, facilitating upper-level leaders to make decisions; the preset web system installation package can be used through the portal end to upgrade the front-end and back-end functions in a completely safe environment; the attack events are blocked and reported with high accuracy; the customer source code does not need to be used, and the privacy of private applications can be protected.

[0064] Figure 3 An application upgrade device provided in the third embodiment of the present application is shown, and the application upgrade device can be used to implement the above-mentioned RASP-based application upgrade method, which specifically includes:

[0065] The loading module 301 is used to load the RASP probe in the web container to obtain application security protection rules;

[0066] The analysis module 302 is used to monitor and analyze the access traffic and the system of the server in which the web container is located by applying security protection rules to obtain application security status information and system security information;

[0067] The upgrade module 303 is used to perform application security protection operations on the web container according to the application security status information, and perform application upgrade operations on the preset RASP system upgrade module according to the system security information.

[0068] According to the implementation of the above-mentioned application upgrade device, since the application security status information can reflect the use security status of the application in the server where the web container is located, that is, it can determine the target application with the lowest use security level, the application security protection operation is performed on the target application in the web container through the application security status information, and precise protection is performed to further improve the protection accuracy of the web container. At the same time, since the system security information can reflect the security status of the framework of the system in the server, that is, it can determine the framework of the system in an abnormal state, the preset RASP system upgrade module is applied through the system security information. The upgrade operation is performed to improve the RASP system upgrade module, that is, the abnormal state in the framework is repaired through the upgrade operation to avoid the phenomenon of protection lag. And by using RASP technology to perform real-time protection on applications in the production environment, real-time protection can be performed on the production line for applications, and the applicable scenarios are more in line with reality and will not be limited.

[0069] Figure 4 The electronic device provided by the fourth embodiment of the present invention is shown, and the electronic device can be used to implement the RASP-based application upgrade method in any of the above embodiments. The electronic device includes:

[0070] Memory 401, processor 402, bus 403, and a computer program stored in memory 401 and executable on processor 402, memory 401 and processor 402 are connected via bus 403. When processor 402 executes the computer program, the RASP-based application upgrade method in the aforementioned embodiment is implemented. The number of processors may be one or more.

[0071] The memory 401 may be a high-speed random access memory (RAM) memory, or a non-volatile memory, such as a disk memory. The memory 401 is used to store executable program codes, and the processor 402 is coupled to the memory 401 .

[0072] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which may be disposed in the electronic device in each of the above embodiments, and the computer-readable storage medium may be a memory.

[0073] The computer readable storage medium stores a computer program, and when the program is executed by the processor, the RASP-based application upgrade method in the aforementioned embodiment is implemented. Furthermore, the computer storable medium can also be a U disk, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk or an optical disk, and other media that can store program codes.

[0074] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0075] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] In addition, each functional module in each embodiment of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The above integrated modules can be implemented in the form of hardware or software functional modules.

[0077] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a readable storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned readable storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.

[0078] It should be noted that, for the convenience of description, the aforementioned method embodiments are all described as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described action sequence, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0079] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0080] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A RASP-based application upgrade method, characterized in that: include: Load the RASP probe in the web container to obtain application security protection rules; The access traffic and system in the server where the web container is located are monitored and analyzed by using the application security protection rules to obtain application security status information and system security information; Performing an application security protection operation on the web container according to the application security status information, and performing an application upgrade operation on a preset RASP system upgrade module according to the system security information; The step of obtaining application security protection rules specifically includes: Sending a rule configuration instruction to a Portal end through the RASP probe; wherein the Portal end is a terminal for configuring the application security protection rule; Obtaining the application security protection rules configured by the Portal end according to the rule configuration instruction; The step of performing an application security protection operation on the web container according to the application security status information specifically includes: The preset cookie detection strategy, process security detection strategy, background weak password detection strategy, database connection account security detection strategy and user-defined security detection strategy are used in turn to analyze the application security status information and summarize the security detection information; Performing application security protection operations on the web container according to the security detection information; The step of performing an application security protection operation on the web container according to the security detection information specifically includes: Analyze the security detection information according to a preset logical link analysis rule to obtain first analysis data; Matching the first analysis data using a preset feature matching rule to obtain second analysis data; Determining a target security vulnerability corresponding to the second analysis data from a preset vulnerability library; A target to be protected is determined according to the target security vulnerability, and an application security protection operation is performed on the target to be protected.

2. The RASP-based application upgrade method according to claim 1, characterized in that: The step of performing the application security protection operation on the target to be protected specifically includes: Creating a logical interface and a control instruction, and sending the security detection information and the control instruction to the Portal end through the logical interface; wherein the control instruction is used to control the Portal end to display and process the security detection information; When receiving the execution instruction of the portal end based on the display processing feedback, the application security protection operation is performed on the target to be protected.

3. The RASP-based application upgrade method according to claim 2, characterized in that: The step of performing an application upgrade operation on a preset RASP system upgrade module according to the system security information specifically includes: Determine, according to the system security information, first upgrade information corresponding to the application front end and second upgrade information corresponding to the application back end; According to the first upgrade information and the second upgrade information, application upgrade operations are performed on the web application front-end upgrade module and the web application back-end upgrade module in the preset RASP system upgrade module respectively to form a first web application system.

4. The RASP-based application upgrade method according to claim 3, characterized in that: After the step of sending the security detection information and the control instruction to the portal end through the logical interface, the method further includes: When no execution instruction based on the display processing feedback is received from the Portal end, determining web upgrade information according to the security detection information; Sending the web upgrade information to the Portal end; wherein the web upgrade information is used to control the Portal end to generate a web upgrade package corresponding to the web upgrade information; An upgrade operation is performed on the first web application system according to the web upgrade package to obtain a second web application system.

5. An application upgrade device, characterized in that: include: A loading module, used to load a RASP probe in a web container, and send a rule configuration instruction to a Portal end through the RASP probe; wherein the Portal end is a terminal for configuring the application security protection rule; and obtain the application security protection rule configured by the Portal end according to the rule configuration instruction; An analysis module, used to monitor and analyze the access traffic in the server where the web container is located and the system of the server through the application security protection rules, and obtain application security status information and system security information; An upgrade module is used to analyze the application security status information in sequence by using a preset cookie detection strategy, a process security detection strategy, a background weak password detection strategy, a database connection account security detection strategy and a user-defined security detection strategy, and summarize the security detection information; analyze the security detection information by using a preset logical link analysis rule to obtain first analysis data; match the first analysis data by using a preset feature matching rule to obtain second analysis data; determine a target security vulnerability corresponding to the second analysis data from a preset vulnerability library; determine a target to be protected based on the target security vulnerability, and perform application security protection operations on the target to be protected; and perform application upgrade operations on a preset RASP system upgrade module based on system security information.

6. An electronic device, characterized in that: Includes memory, processor and bus; The bus is used to realize the connection and communication between the memory and the processor; The processor is used to execute the computer program stored in the memory; When the processor executes the computer program, the steps of the RASP-based application upgrade method described in any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the RASP-based application upgrade method described in any one of claims 1 to 4 are implemented.

Images