Method and device for preventing system command injection, electronic equipment and storage medium

Abstract

The application provides a method, device, electronic equipment and storage medium for preventing system command injection. First, the shell instruction and application source code are processed by isomerization to generate an isomerized application corresponding to a target application. Then, the isomerized application is released so that the isomerized application replaces the target application online. In this way, the isomerized application can analyze the instruction containing the command parameter sent by the client by preprocessing the command parameter. Finally, the isomerized application is monitored according to the analysis result of the isomerized application. The method for preventing system command injection provided by the application is based on the isomerized shell and can prevent the execution of system command injection with attack intention, thereby ensuring the normal and stable operation of the system application.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and to a method, apparatus, electronic device and storage medium for preventing system command injection. More specifically, it relates to a method, apparatus, electronic device and storage medium for preventing system command injection based on heterogeneous shell. Background Technology

[0002] In today's network environment, various system applications have made people's lives more convenient. From basic network infrastructure (gateways, firewalls, switches, etc.) to upper-layer applications, which carry sensitive information of individuals, enterprises, and governments, security is of paramount importance. At the same time, these applications exposed to the network, providing interfaces to users, also face various threats. For example, attackers may exploit application interfaces to inject commands containing destructive instructions into system applications, achieving illegal purposes such as obtaining sensitive information, tampering with data, and disrupting normal functions.

[0003] Therefore, how to prevent the injection commands submitted by attacking users from being executed in order to achieve the purpose of defense has become an urgent problem to be solved at this stage. Summary of the Invention

[0004] In view of this, to solve the above problems, the present invention provides a method, apparatus, electronic device, and storage medium for preventing system command injection, the technical solution of which is as follows:

[0005] A method for preventing system command injection, the method comprising:

[0006] By heterogeneously processing shell commands and application source code, a heterogeneous application corresponding to the target application is generated.

[0007] The heterogeneous application is deployed to achieve the following: when the heterogeneous application receives an instruction containing command parameters sent by the client, it parses the instruction by preprocessing the command parameters.

[0008] The heterogeneous application is monitored during operation based on the analysis results of the heterogeneous application.

[0009] Preferably, the step of generating a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code includes:

[0010] Generate random tags when the server is idle;

[0011] The shell commands invoked by the target application are heterogeneously processed based on the random labels to obtain heterogeneous shell commands;

[0012] The heterogeneous application source code is processed by the heterogeneous shell command to obtain the heterogeneous application source code.

[0013] The shell source code corresponding to the heterogeneous shell commands is compiled to generate a shared library containing the heterogeneous shell commands.

[0014] The heterogeneous application source code is compiled based on the shared library to generate the heterogeneous application.

[0015] Preferably, the step of generating a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code includes:

[0016] According to a preset time, the heterogeneous application corresponding to the target application is generated by heterogeneously processing shell commands and application source code.

[0017] Preferably, the deployment of the heterogeneous application enables: when the heterogeneous application receives an instruction containing command parameters sent by the client, it parses the instruction by preprocessing the command parameters, including:

[0018] The heterogeneous application is deployed to achieve the following: when the application interface of the heterogeneous application receives an instruction containing command parameters sent by the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters; the instruction parsing component of the heterogeneous application parses the decoded / decrypted result of the command parameters; if the parsing result indicates that the instruction is an illegal instruction, the parsing result and the client's association information are output, the association information including user information and current behavior information.

[0019] Preferably, the step of monitoring the operation of the heterogeneous application based on the analysis results of the heterogeneous application includes:

[0020] Based on the parsing results, historical behavior information corresponding to the user information is obtained;

[0021] Detect whether the client exhibits abnormal behavior based on the current behavior information and the historical behavior information;

[0022] If the client exhibits abnormal behavior, the client will be blocked, and a log will be generated.

[0023] A device for preventing system command injection, the device comprising: a dynamic heterogeneity module, a system deployment module, and a runtime monitoring module;

[0024] The dynamic heterogeneity module is used to generate a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code.

[0025] The system publishing module is used to publish the heterogeneous application so as to achieve the following: when the heterogeneous application receives an instruction containing command parameters sent by the client, it parses the instruction by preprocessing the command parameters.

[0026] The operation monitoring module is used to monitor the operation of the heterogeneous application based on the parsing results of the heterogeneous application.

[0027] Preferably, the dynamic heterogeneity module includes: a diversified compilation unit, a shell instruction heterogeneity unit, and an application source code heterogeneity unit;

[0028] The diverse compilation unit is used to generate random tags when the server is idle;

[0029] The shell command heterogeneity unit is used to heterogeneously process the shell commands called by the target application according to the random label to obtain heterogeneous shell commands; the application source code heterogeneity unit is used to heterogeneously process the application source code of the target application based on the heterogeneous shell commands to obtain heterogeneous application source code.

[0030] The diversified compilation unit is also used to compile the shell source code corresponding to the heterogeneous shell instructions to generate a shared library containing the heterogeneous shell instructions; and to compile the heterogeneous application source code based on the shared library to generate the heterogeneous application.

[0031] Preferably, the system publishing module is specifically used for:

[0032] The heterogeneous application is deployed to achieve the following: when the application interface of the heterogeneous application receives an instruction containing command parameters sent by the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters; the instruction parsing component of the heterogeneous application parses the decoded / decrypted result of the command parameters; if the parsing result indicates that the instruction is an illegal instruction, the parsing result and the client's association information are output, the association information including user information and current behavior information.

[0033] An electronic device includes: at least one memory and at least one processor; the memory stores an application program, and the processor invokes the application program stored in the memory, the application program being used to implement the method for preventing system command injection.

[0034] A storage medium storing computer program code, wherein the computer program code, when executed, implements the method for preventing system command injection.

[0035] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0036] This invention provides a method, apparatus, electronic device, and storage medium for preventing system command injection. First, it heterogeneously processes shell commands and application source code to generate a heterogeneous application corresponding to the target application. Then, it deploys the heterogeneous application, allowing it to replace the target application online. This achieves the following: when the heterogeneous application receives a command containing command parameters from a client, it preprocesses the command parameters to parse the command. Finally, it monitors the operation of the heterogeneous application based on the parsing results. The method for preventing system command injection provided by this invention, based on a heterogeneous shell, can prevent the execution of system commands with malicious intent, ensuring the normal and stable operation of system applications. Attached Figure Description

[0037] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0038] Figure 1 A flowchart illustrating the method for preventing system command injection provided in this embodiment of the invention;

[0039] Figure 2 A partial flowchart of the method for preventing system command injection provided in this embodiment of the invention;

[0040] Figure 3 This is another part of the method flowchart for preventing system command injection provided in the embodiments of the present invention;

[0041] Figure 4 This is a schematic diagram of the structure of the device for preventing system command injection provided in an embodiment of the present invention;

[0042] Figure 5 A partial structural schematic diagram of the device for preventing system command injection provided in an embodiment of the present invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0045] Users submit parameters through the application interface. After receiving the parameters, the system application calls the system function interface to execute them and returns the results. This invention draws on the concept of heterogeneity, improving security without changing the user's original usage or affecting the normal functioning of the system. Its aim is to change the execution environment of commands submitted by attacking users, rendering the submitted injection commands unable to execute, thereby achieving the purpose of defense.

[0046] See Figure 1 , Figure 1 A flowchart illustrating the method for preventing system command injection provided in an embodiment of the present invention. Figure 1 As shown, the method for preventing system command injection includes the following steps:

[0047] S10 generates a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code.

[0048] In this embodiment of the invention, the target application is the system application that executes the anti-system command injection scheme. Utilizing the concept of heterogeneity, shell commands are heterogeneously processed, altering the original execution environment of the injection commands to achieve the security objective. Specifically, the shell commands called by the target application and its application source code are heterogeneously processed, and after offline compilation, an application containing heterogeneous commands is generated; this application containing heterogeneous commands is the heterogeneous application.

[0049] It should be noted that shell commands refer to shell instructions, such as ls, pwd, cd, etc.

[0050] In the specific implementation process, step S10, "generating the heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code," can be performed using the following steps, as shown in the flowchart below. Figure 2 As shown:

[0051] S101 generates random tags when the server is idle.

[0052] In this embodiment of the invention, in order to generate heterogeneous applications using server resources when the server is idle, a random tag can be generated when the server is idle.

[0053] S102, perform heterogeneous processing on the shell commands called by the target application based on random labels to obtain heterogeneous shell commands.

[0054] In this embodiment of the invention, generated random tags can be used to heterogeneously process the shell commands invoked by the target application, thereby obtaining heterogeneous shell commands. This alters the original execution environment of the injected command, achieving a security objective. Specifically, the name of the original shell command can be changed; for example, the shell command `ls` can be heterogeneously transformed into `ls'`, rendering the original `ls` command ineffective.

[0055] S103, heterogeneous processing of the target application's source code is performed based on heterogeneous shell commands to obtain heterogeneous application source code.

[0056] In this embodiment of the invention, after obtaining heterogeneous shell commands, the application source code of the target application can be heterogeneously processed to obtain heterogeneous application source code, thereby ensuring normal application functionality. Specifically, the original system commands in the application are replaced with heterogeneous shell commands, thus ensuring normal application functionality.

[0057] S104 compiles the shell source code corresponding to the heterogeneous shell commands to generate a shared library containing the heterogeneous shell commands.

[0058] In this embodiment of the invention, the shell source code refers to the shell commands within the application source code. After receiving the heterogeneity processing completion signal, various compilation techniques can be used to compile the shell source code, generating a shared library containing heterogeneous shell commands.

[0059] S105 compiles the source code of heterogeneous applications based on shared libraries to generate heterogeneous applications.

[0060] In this embodiment of the invention, based on the generated shared library, diverse compilation techniques can be used to compile the heterogeneous application source code, generating a heterogeneous application. In other words, heterogeneous instructions are stored in the shared library, and the heterogeneous application source code can call the shared library as a third-party library during compilation, thereby generating a heterogeneous application and strengthening it.

[0061] It should be noted that heterogeneity is applied to the original target application while maintaining functional consistency. After compilation using diverse compilation techniques, the security and heterogeneity of the code can be increased.

[0062] It should also be noted that the aforementioned diversified compilation techniques include, but are not limited to, instruction randomization, instruction substitution, stack randomization, and other diverse techniques, enabling applications to maintain consistent functionality while exhibiting heterogeneity under different transformations and techniques. Furthermore, steps S104 and S105 can employ different or the same techniques when using diversified compilation techniques; this embodiment of the invention does not impose any limitations on this.

[0063] S20, Deploy heterogeneous applications to achieve the following: When a heterogeneous application receives an instruction containing command parameters sent by a client, it parses the instruction by preprocessing the command parameters.

[0064] In this embodiment of the invention, after generating the heterogeneous application, the newly generated heterogeneous application can be launched and run online according to the target application that runs online at regular intervals or randomly according to the strategy.

[0065] In some scenarios, when step S10 is executed, it can generate a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code according to a preset time. In other words, for the target application, various compilation techniques can be used to generate and release functionally equivalent heterogeneous applications at regular or irregular intervals, making the heterogeneous applications heterogeneous in time. This creates a time-based dynamic heterogeneous shell command execution environment, increasing the difficulty for attackers to use shell commands to launch attacks, thereby achieving dynamic heterogeneity of the application in time and enhancing system security.

[0066] In addition, when heterogeneous applications receive commands containing command parameters from clients, they can first encode / encrypt the command parameters and then decode / decrypt them. This can prevent injected commands from being split and executed directly in the console or the system's default shell, thus ensuring that the commands are passed in completely and correctly parsed and processed.

[0067] Specifically, step S20, "deploying the heterogeneous application to achieve: when the heterogeneous application receives an instruction containing command parameters sent by the client, it parses the instruction by preprocessing the command parameters," can take the following steps:

[0068] Deploy heterogeneous applications to achieve the following: When the application interface of the heterogeneous application receives an instruction containing command parameters from the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters; the instruction parsing component of the heterogeneous application parses the decoded / decrypted result of the command parameters; if the parsing result indicates that the instruction is invalid, it outputs the parsing result and the client's associated information, including user information and current behavior information.

[0069] In this embodiment of the invention, after the heterogeneous application is deployed and running, users can submit commands to the application interface of the heterogeneous application via the network. The command parameters contained therein are encoded / encrypted, and the results are passed to the command preprocessing component of the heterogeneous application. This ensures that the command parameters are passed to the command preprocessing component normally, preventing them from being split and executed in the console or the system default shell. The command preprocessing component decodes / decrypts the encoded / encrypted results of the command parameters and passes the results to the command parsing component of the heterogeneous application. This prevents the spliced ​​parameters contained in the command parameters from being split and executed. The command parsing component parses the decoded / decrypted results of the command parameters. If the parsing determines that the command sent by the client is a heterogeneous shell command in the shared library, then the command is determined to be a legal command. Otherwise, if the parsing determines that the command sent by the client is not a heterogeneous shell command in the shared library, then the command is determined to be an illegal command.

[0070] In response, if the parsing result indicates that the instruction is illegal, the parsing component can determine that a parsing error has occurred and output the parsing result and the client's associated information for subsequent monitoring and analysis. This associated information includes user information and current behavior information. User information may include the IP address and username, while current behavior information may include the client's current actions and attack methods.

[0071] S30, perform operational monitoring of heterogeneous applications based on the analysis results of heterogeneous applications.

[0072] In this embodiment of the invention, after obtaining the parsing results of the heterogeneous application, threat analysis of the heterogeneous application can be performed based on the current execution and combined with the client's historical information, and threat handling can be carried out on the client.

[0073] In the specific implementation process, step S30, "monitoring the operation of heterogeneous applications based on the analysis results of heterogeneous applications," can be performed using the following steps, as shown in the flowchart below. Figure 3 As shown:

[0074] S301, Based on the parsing results, obtain historical behavior information corresponding to the user information.

[0075] In this embodiment of the invention, after obtaining the parsing result indicating that the instruction sent by the client is an illegal instruction, the client's historical behavior information can be obtained by combining the client's user information. The historical behavior information includes the client's historical operation behavior, attack methods, etc.

[0076] S302, detects whether the client has abnormal behavior based on current behavior information and historical behavior information.

[0077] In this embodiment of the invention, the current behavior information and historical behavior information of the client can be combined to determine whether the client's behavior is abnormal. For specific implementation, please refer to the existing solutions, which will not be repeated here.

[0078] S303 blocks the client and generates a log if abnormal behavior is detected on the client side.

[0079] In this embodiment of the invention, if a client exhibits abnormal behavior, it can be blocked, such as by banning its IP address or restricting its use of certain functions. The client's current behavior, user information, and processing results are recorded in a log file, generating a corresponding log entry. Therefore, this invention can combine heterogeneous instruction parsing results with historical user behavior to analyze user behavior, enabling countermeasures against users exhibiting abnormal behavior and increasing system security.

[0080] The method for preventing system command injection provided in this embodiment of the invention is based on heterogeneous shell, which can prevent the execution of system commands with malicious intent and ensure that system applications can run normally and stably.

[0081] Based on the method for preventing system command injection provided in the above embodiments, this invention also provides a device for preventing system command injection, the structural schematic of which is shown below. Figure 4 As shown, it includes: a dynamic heterogeneity module 10, a system deployment module 20, and an operation monitoring module 30;

[0082] The dynamic heterogeneity module 10 is used to generate a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code.

[0083] The system publishing module 20 is used to publish heterogeneous applications so as to achieve the following: when a heterogeneous application receives an instruction containing command parameters sent by a client, it parses the instruction by preprocessing the command parameters.

[0084] The operation monitoring module 30 is used to monitor the operation of heterogeneous applications based on the parsing results of the heterogeneous applications.

[0085] Optional, see Figure 5 , Figure 5 This is a partial structural schematic diagram of the device for preventing system command injection provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the dynamic heterogeneity module 10 includes: a diversified compilation unit 101, a shell instruction heterogeneity unit 102, and an application source code heterogeneity unit 103;

[0086] A diverse compilation unit 101 is used to generate random tags when the server is idle;

[0087] Shell instruction heterogeneity unit 102 is used to heterogeneously process the shell instructions called by the target application according to random tags to obtain heterogeneous shell instructions; application source code heterogeneity unit is used to heterogeneously process the application source code of the target application based on the heterogeneous shell instructions to obtain heterogeneous application source code.

[0088] The diversified compilation unit 103 is also used to compile the shell source code corresponding to the heterogeneous shell commands to generate a shared library containing the heterogeneous shell commands; and to compile the heterogeneous application source code based on the shared library to generate the heterogeneous application.

[0089] Optional, dynamic heterogeneity module 10, specifically used for:

[0090] According to a preset time, the heterogeneous application corresponding to the target application is generated by heterogeneously processing shell commands and application source code.

[0091] Optional, system publishing module 20, specifically used for:

[0092] Deploy heterogeneous applications to achieve the following: When the application interface of the heterogeneous application receives an instruction containing command parameters from the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters; the instruction parsing component of the heterogeneous application parses the decoded / decrypted result of the command parameters; if the parsing result indicates that the instruction is invalid, it outputs the parsing result and the client's associated information, including user information and current behavior information.

[0093] Optionally, the operation monitoring module 30 is used for:

[0094] Based on the parsing results, obtain historical behavior information corresponding to user information; detect whether there is abnormal behavior in the client based on the current behavior information and historical behavior information; if abnormal behavior is found in the client, block the client and generate a log record.

[0095] It should be noted that the detailed functions of each module and unit in the embodiments of the present invention can be found in the corresponding disclosure of the above-mentioned method embodiments for preventing system command injection, and will not be repeated here.

[0096] Based on the method for preventing system command injection provided in the above embodiments, this invention also provides an electronic device, which includes: at least one memory and at least one processor; the memory stores an application program, and the processor calls the application program stored in the memory, the application program being used to implement the method for preventing system command injection.

[0097] Based on the method for preventing system command injection provided in the above embodiments, this embodiment of the invention also provides a storage medium that stores computer program code, and the computer program code implements the method for preventing system command injection when executed.

[0098] The present invention has provided a detailed description of a method, apparatus, electronic device, and storage medium for preventing system command injection. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

[0099] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0100] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that elements inherent to a process, method, article, or apparatus that comprises a list of elements, or elements inherent to such processes, methods, articles, or apparatus, are also included. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0101] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for preventing system command injection, characterized in that, The method includes: By heterogeneously processing shell commands and application source code, a heterogeneous application corresponding to the target application is generated. The heterogeneous application is deployed to achieve the following: when the heterogeneous application receives an instruction containing command parameters sent by the client, it preprocesses the command parameters and parses the preprocessing result. If the shell instruction contained in the instruction is a heterogeneous shell instruction in the shared library, the parsing result is determined to be a valid instruction; otherwise, the parsing result is determined to be an invalid instruction. The heterogeneous application is monitored during operation based on the analysis results of the heterogeneous application. The step of generating a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code includes: Generate random tags when the server is idle; The shell commands invoked by the target application are heterogeneously processed based on the random labels to obtain heterogeneous shell commands; The heterogeneous application source code is processed by the heterogeneous shell command to obtain the heterogeneous application source code. The shell source code corresponding to the heterogeneous shell commands is compiled to generate a shared library containing the heterogeneous shell commands. The heterogeneous application source code is compiled based on the shared library to generate the heterogeneous application.

2. The method according to claim 1, characterized in that, The process of generating a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code includes: According to a preset time, the heterogeneous application corresponding to the target application is generated by heterogeneously processing shell commands and application source code.

3. The method according to claim 1, characterized in that, The heterogeneous application is deployed to achieve the following: when the heterogeneous application receives an instruction containing command parameters sent by the client, it preprocesses the command parameters and parses the preprocessing result. If the shell instruction contained in the instruction is a heterogeneous shell instruction in the shared library, the parsing result is determined to be a valid instruction; otherwise, the parsing result is determined to be an invalid instruction, including: The heterogeneous application is deployed to achieve the following: when the application interface of the heterogeneous application receives an instruction containing command parameters sent by the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters; the instruction parsing component of the heterogeneous application parses the decoded / decrypted result of the command parameters; if the parsing result indicates that the instruction is an illegal instruction, the parsing result and the client's association information are output, the association information including user information and current behavior information.

4. The method according to claim 3, characterized in that, The step of monitoring the operation of the heterogeneous application based on the analysis results of the heterogeneous application includes: Based on the parsing results, historical behavior information corresponding to the user information is obtained; Detect whether the client exhibits abnormal behavior based on the current behavior information and the historical behavior information; If the client exhibits abnormal behavior, the client will be blocked, and a log will be generated.

5. A device for preventing system command injection, characterized in that, The device includes: a dynamic heterogeneity module, a system deployment module, and an operation monitoring module; The dynamic heterogeneity module is used to generate a heterogeneous application corresponding to the target application by heterogeneously processing shell commands and application source code. The system publishing module is used to publish the heterogeneous application to achieve the following: when the heterogeneous application receives an instruction containing command parameters sent by the client, it preprocesses the command parameters and parses the preprocessing result. If the shell instruction contained in the instruction is a heterogeneous shell instruction in the shared library, the parsing result is determined to be a legal instruction; otherwise, the parsing result is determined to be an illegal instruction. The operation monitoring module is used to monitor the operation of the heterogeneous application based on the parsing results of the heterogeneous application. The dynamic heterogeneity module includes: a diversified compilation unit, a shell instruction heterogeneity unit, and an application source code heterogeneity unit; The diverse compilation unit is used to generate random tags when the server is idle; The shell instruction heterogeneity unit is used to heterogeneously process the shell instructions called by the target application according to the random label to obtain heterogeneous shell instructions. The application source code heterogeneity unit is used to perform heterogeneous processing on the application source code of the target application based on the heterogeneous shell command to obtain heterogeneous application source code. The diversified compilation unit is also used to compile the shell source code corresponding to the heterogeneous shell instructions to generate a shared library containing the heterogeneous shell instructions; and to compile the heterogeneous application source code based on the shared library to generate the heterogeneous application.

6. The apparatus according to claim 5, characterized in that, The system publishing module is specifically used for: The heterogeneous application is deployed to achieve the following: when the application interface of the heterogeneous application receives an instruction containing command parameters sent by the client, it encodes / encrypts the command parameters; the instruction preprocessing component of the heterogeneous application decodes / decrypts the encoded / encrypted result of the command parameters. The instruction parsing component of the heterogeneous application parses the decoding / decryption results of the command parameters; if the parsing result indicates that the instruction is an illegal instruction, it outputs the parsing result and the association information of the client, the association information including user information and current behavior information.

7. An electronic device, characterized in that, The electronic device includes: at least one memory and at least one processor; the memory stores an application program, and the processor calls the application program stored in the memory, the application program being used to implement the method for preventing system command injection as described in any one of claims 1-4.

8. A storage medium, characterized in that, The storage medium stores computer program code, which, when executed, implements the method for preventing system command injection as described in any one of claims 1-4.

Images