A method and apparatus for detecting a calling sequence, an electronic device, and a storage medium

Abstract

The application provides a calling sequence detection method and device, electronic equipment and a storage medium. The method comprises the following steps: obtaining a calling sequence to be detected; if there is a calling sequence identical to the calling sequence to be detected being detected, or a detection result of the calling sequence to be detected already existing, the detection of the calling sequence to be detected is not performed. In the application, if there is a calling sequence identical to the calling sequence to be detected being detected, or a detection result of the calling sequence to be detected already existing, the detection of the calling sequence to be detected is not performed, so that the number of detections of the calling sequence is reduced without affecting the safety of the electronic equipment, and the influence on the performance of the electronic equipment is reduced.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and more specifically, to a method, apparatus, electronic device, and storage medium for detecting call sequences. Background Technology

[0002] As web application attack methods become increasingly sophisticated, request-based protection methods are no longer sufficient to meet enterprise security needs. RASP, a new type of application security protection technology, "injects" protective functions into the application, integrating it seamlessly. By hooking a few key functions, it monitors the internal workings of the application in real time. When suspicious behavior is detected, RASP accurately identifies attack events based on the current context and blocks them in real time, enabling the application to self-protect. RASP improves detection accuracy by collecting high-risk behaviors of web applications in real time and employing various security models, including feature rules, contextual semantic analysis, and data correlation analysis with third-party security products.

[0003] In RASP-based protection schemes, the security of call sequences is checked. Since the number of call sequences is large, checking the call sequences consumes a lot of server overhead, resulting in a decrease in server performance. Summary of the Invention

[0004] The purpose of this application is to provide a method, apparatus, electronic device, and storage medium for detecting call sequences, so as to reduce the impact on the performance of electronic devices while achieving call sequence detection.

[0005] In a first aspect, embodiments of this application provide a method for detecting a called sequence, including:

[0006] Obtain the call sequence to be detected;

[0007] If a call sequence identical to the one to be detected is being detected, or if a detection result for the call sequence to be detected already exists, then the call sequence to be detected will no longer be detected.

[0008] In this embodiment of the application, when there is a call sequence that is the same as the call sequence to be detected being detected, or when there is already a detection result for the call sequence to be detected, the call sequence to be detected will no longer be detected. This reduces the number of times the call sequence is detected without affecting the security of the electronic device, thereby reducing the impact on the performance of the electronic device.

[0009] In any embodiment, if a call sequence identical to the one to be detected is being detected, then the call sequence to be detected is no longer detected, including:

[0010] Obtain the target thread identifier of the call sequence to be detected;

[0011] Determine whether the thread filter contains the target thread identifier. If it does, do not perform the detection on the call sequence to be detected. The thread filter contains the thread identifier of the call sequence that is currently being detected.

[0012] The thread filter in this embodiment contains the thread identifier corresponding to the call sequence being detected. Therefore, by matching the target thread identifier corresponding to the call sequence to be detected with the thread identifier in the thread filter, it can be determined whether there is a call sequence that is the same as the call sequence to be detected being detected. If so, the call sequence to be detected will no longer be detected, thus reducing the number of times the call sequence is detected.

[0013] In any embodiment, the method further includes:

[0014] The detection result corresponding to the call sequence being detected is used as the target detection result of the call sequence to be detected.

[0015] In this embodiment, if the call sequence to be detected is already waiting in the thread filter or is being detected, the call sequence to be detected will no longer be detected, and the detection result of the call sequence being detected will be waited for and used as the result of the call sequence to be detected, thereby reducing the number of times the call sequence is repeatedly detected.

[0016] In any embodiment, the method further includes:

[0017] If the thread filter does not contain the target thread identifier, then obtain the target sequence identifier of the call sequence to be detected;

[0018] Determine whether the sequence filter contains a target sequence identifier. If it does, then the call sequence to be detected will no longer be detected, and the detection result corresponding to the target sequence identifier will be obtained from the sequence filter. The detection result will be determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test.

[0019] Since the detection results corresponding to the call sequence often do not change, this application embodiment saves the sequence identifier and detection result of the call sequence that has passed the security detection in the sequence filter, which makes it easy to determine whether the call sequence to be detected has been detected. After it is determined that it has been detected, it will not be detected again, and the previous detection result can be reused directly, thereby reducing the number of times the call sequence is detected.

[0020] In any embodiment, if a detection result for the call sequence to be detected already exists, then the call sequence to be detected is no longer detected, including:

[0021] Obtain the target sequence identifier of the call sequence to be detected;

[0022] Determine whether the sequence filter contains the target sequence identifier. If it does, the call sequence to be detected will no longer be detected, and the detection result corresponding to the target sequence identifier will be obtained from the sequence filter. The detection result will be determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test.

[0023] Since the detection results corresponding to the call sequence often do not change, this application embodiment saves the sequence identifier and detection result of the call sequence that has passed the security detection in the sequence filter, which makes it easy to determine whether the call sequence to be detected has been detected. After it is determined that it has been detected, it will not be detected again, and the previous detection result can be reused directly, thereby reducing the number of times the call sequence is detected.

[0024] In any embodiment, obtaining the target sequence identifier of the call sequence to be detected includes:

[0025] Obtain the call sequence to be detected based on the target thread context;

[0026] Obtain the memory addresses corresponding to each class in the call sequence to be detected;

[0027] Generate the target sequence identifier based on the memory address.

[0028] This application embodiment generates a target sequence identifier by calling the memory address corresponding to each class in the call sequence, thereby achieving the uniqueness of the call sequence and improving the accuracy of determining whether the call sequence to be detected has been detected.

[0029] In any embodiment, the method further includes:

[0030] If the sequence filter does not contain the target sequence identifier, the target thread identifier is added to the thread filter, and the call sequence to be detected is detected to obtain the target detection result of the call sequence to be detected.

[0031] In this embodiment of the application, if the thread filter does not contain a call sequence that is the same as the call sequence to be detected, and the sequence filter does not contain a detection result of the call sequence to be detected, then the target corresponding to the call sequence to be detected is not being detected. In this case, the target thread identifier is added to the thread filter, and the call sequence to be detected is detected. If the same thread call sequence is triggered again in the future, it will no longer be detected, thus reducing the number of times the call sequence is detected.

[0032] In any embodiment, after obtaining the target detection result of the call sequence to be detected, the method further includes:

[0033] If the target detection result indicates that the call sequence to be detected is a safe call sequence, then the target sequence identifier and the target detection result of the call sequence to be detected are stored in the sequence filter.

[0034] This application embodiment stores the target sequence identifier and target detection result corresponding to the secure call sequence in the sequence filter. When the call sequence is triggered again, the target detection result can be directly reused, thereby reducing the number of times the call sequence is detected.

[0035] In any embodiment, the method further includes:

[0036] If the detection of the call sequence corresponding to the target thread identifier is completed, the target thread identifier is removed from the thread filter.

[0037] This application embodiment prevents omissions in the detection of call sequences by removing the target thread identifier corresponding to the completed call sequence from the thread filter.

[0038] Secondly, embodiments of this application provide a call sequence detection device, including:

[0039] The acquisition module is used to acquire the call sequence to be detected;

[0040] The detection module is used to stop detecting the call sequence if there is a call sequence that is the same as the one to be detected that is being detected, or if there is already a detection result for the call sequence to be detected.

[0041] Thirdly, embodiments of this application provide an electronic device, including: a processor, a memory, and a bus, wherein,

[0042] The processor and the memory communicate with each other via a bus;

[0043] The memory stores program instructions that can be executed by the processor, and the processor can execute the method of the first aspect by calling the program instructions.

[0044] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium, comprising:

[0045] A non-transitory computer-readable storage medium stores computer instructions that cause the computer to perform the method of the first aspect.

[0046] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing embodiments of this application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0047] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a schematic diagram of a call sequence detection method provided in an embodiment of this application;

[0049] Figure 2 This is a schematic diagram of another call sequence detection method provided in an embodiment of this application;

[0050] Figure 3 This is a schematic diagram of a call sequence detection device provided in an embodiment of this application;

[0051] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0052] The embodiments of the technical solution of this application will now be described in detail with reference to the accompanying drawings. These embodiments are only used to more clearly illustrate the technical solution of this application and are therefore merely examples, and should not be used to limit the scope of protection of this application.

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0054] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0055] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0056] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0057] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0058] In the description of the embodiments of this application, the technical terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," and "circumferential" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing the embodiments of this application and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the embodiments of this application.

[0059] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0060] To facilitate understanding of the embodiments of this application, the relevant concepts involved are explained:

[0061] Call sequence: The code segment that implements a procedure call allocates space on the stack for an activation record and fills in the fields of this record (pushing information onto the stack). Simply put, a call sequence is used to record the call chain of various classes. For example, a call sequence includes class A calling class B, and class B calling class C. The principle is as follows: the caller calculates the value of the actual parameter; the caller places the return address (the address after the program counter) into the machine status word of the callee; the caller places the original stack pointer into the control chain of the callee; then, the value of the stack pointer is incremented so that it points to the beginning of the callee's local data (at this point, the stack pointer points to itself); the callee saves register values ​​and other state information; the callee initializes its local data and begins execution.

[0062] RASP (Runtime Application Self-Protection) is a new type of application security technology that "injects" protective functions into the application, making it an integral part of the application. It uses hooks to a few key functions to monitor the internal workings of the application in real time. When suspicious behavior occurs, RASP accurately identifies the attack event based on the current context and blocks it in real time, enabling the application to protect itself without manual intervention.

[0063] RASP improves detection accuracy by collecting high-risk behaviors of web applications in real time and employing various security models, including feature rules, contextual semantic analysis, and data correlation analysis with third-party security products. Compared to traditional web application security products, RASP filters out a large number of invalid attacks from a massive dataset, focusing on discovering real known and unknown security threats. Furthermore, in its alerts, RASP can clearly reconstruct attack paths at the line-of-code level, greatly aiding in vulnerability reproduction and remediation.

[0064] Currently, in RASP-based protection schemes, a security check is triggered for each call sequence. Since a large number of call sequences are triggered during server operation, the number of checks on the call sequences is also very large, which has a significant impact on server performance.

[0065] Through long-term research, the inventors of this application have discovered that among the numerous call sequences triggered in a server, the same call sequence is frequently triggered repeatedly. Therefore, existing technologies often perform multiple checks on the same call sequence. To ensure the security of call sequences and reduce the impact on server performance, embodiments of this application provide a call sequence detection method, apparatus, electronic device, and storage medium. This method determines whether a call sequence to be detected needs to be detected by recording the thread identifier of the call sequence being detected and the target sequence identifier of previously detected call sequences.

[0066] It is understood that the call sequence detection method provided in this application embodiment can be applied to electronic devices, which may include terminals and servers; wherein the terminal device may specifically be a smartphone, tablet computer, computer, personal digital assistant (PDA), etc.; the server may specifically be an application server or a web server.

[0067] For ease of understanding, the technical solutions provided in the embodiments of this application will be described below using a server as the execution subject as an example.

[0068] Figure 1 This is a schematic diagram of a call sequence detection method provided in an embodiment of this application, such as... Figure 1 As shown, the method includes:

[0069] Step 101: Obtain the call sequence to be detected;

[0070] Step 102: If a call sequence identical to the one to be detected is being detected, or if a detection result for the call sequence to be detected already exists, then the call sequence to be detected will no longer be detected.

[0071] In step 101, the triggered call sequence can be obtained through a pre-defined monitoring function. In order to protect itself, the server needs to perform security checks on each triggered call sequence. Therefore, the obtained call sequence is the call sequence to be checked.

[0072] In step 102, after obtaining the call sequence to be detected, the server determines whether there is a call sequence identical to the one being detected that is currently being detected, or whether the call sequence to be detected has already been detected previously and corresponding monitoring results have been obtained. If there is a call sequence identical to the one being detected that is currently being detected, then the call sequence to be detected will no longer be detected. Alternatively, if the server has already stored the detection results for the call sequence to be detected, it means that the call sequence to be detected has already been detected previously; therefore, the call sequence to be detected will no longer be detected, and the stored detection results can be reused, that is, the stored detection results will be used as the detection results for the call sequence to be detected.

[0073] In this embodiment of the application, when there is a call sequence that is the same as the call sequence to be detected being detected, or when there is already a detection result for the call sequence to be detected, the call sequence to be detected will no longer be detected. This reduces the number of times the call sequence is detected without affecting the security of the electronic device, thereby reducing the impact on the performance of the electronic device.

[0074] Based on the above embodiments, if a call sequence identical to the one to be detected is being detected, then the call sequence to be detected will no longer be detected, including:

[0075] Obtain the target thread identifier of the call sequence to be detected;

[0076] Determine whether the thread filter contains the target thread identifier. If it does, do not perform the detection on the call sequence to be detected. The thread filter contains the thread identifier of the call sequence that is currently being detected.

[0077] In the specific implementation process, the method for determining whether there is a call sequence identical to the one to be detected being detected is as follows:

[0078] It is understood that the call sequence is executed by a thread. One thread is used to process one calling program. The same calling program can be processed by multiple threads, and each thread has its corresponding thread identifier. In this embodiment, the thread identifier of the call sequence to be detected is called the target thread identifier.

[0079] The server pre-generates a thread filter, which can be a cache used to store the thread identifiers corresponding to the call sequences being detected. Therefore, the target thread identifier can be matched against the thread identifiers stored in the thread filter. If a match is found, it means that a call sequence identical to the one to be detected is being detected; otherwise, if a match is unsuccessful, it means that no call sequence identical to the one to be detected is being detected.

[0080] If a match is successful, the server will no longer perform further testing on the call sequence to be tested. Instead, it will wait for the result of the call sequence currently being tested and use that result as the target detection result for the call sequence to be tested.

[0081] The thread filter in this embodiment contains the thread identifier corresponding to the call sequence being detected. Therefore, by matching the target thread identifier corresponding to the call sequence to be detected with the thread identifier in the thread filter, it can be determined whether there is a call sequence that is the same as the call sequence to be detected being detected. If so, the call sequence to be detected will no longer be detected, thus reducing the number of times the call sequence is detected.

[0082] Based on the above embodiments, the method further includes:

[0083] If the thread filter does not contain the target thread identifier, then obtain the target sequence identifier of the call sequence to be detected;

[0084] Determine whether the sequence filter contains the target sequence identifier. If it does, the call sequence to be detected will no longer be detected, and the detection result corresponding to the target sequence identifier will be obtained from the sequence filter. The detection result will be determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test.

[0085] In the specific implementation process Figure 2 This is a schematic diagram of another call sequence detection method provided in an embodiment of this application, as shown below. Figure 2 As shown, the method includes:

[0086] Step 201: Obtain the call sequence to be detected;

[0087] Step 202: Determine whether the thread filter contains the target thread identifier;

[0088] It is understood that the specific details of steps 201 and 202 can be found in the above embodiments, and will not be repeated here. If the thread filter contains the target thread identifier, then step 205 is executed; otherwise, step 203 is executed.

[0089] Step 203: Determine whether the sequence filter contains the target sequence identifier;

[0090] The server pre-generates a sequence filter, which can be a Bloom filter or other types of filter; this embodiment does not specifically limit this. The sequence filter stores the sequence identifiers of call sequences that have already been detected and their corresponding detection results. Therefore, after determining that the thread filter does not contain the target thread identifier, the server then determines whether the sequence filter contains the target sequence identifier corresponding to the call sequence to be detected. If it does, it means that the call sequence to be detected has already been detected previously, so step 205 is executed; otherwise, it means that the call sequence to be detected is not currently being detected and has not been detected before, so step 204 is executed. It is understood that the target sequence identifier is used to characterize the uniqueness of the call sequence; that is, one call sequence corresponds to one target sequence identifier.

[0091] Step 204: Detect the call sequence to be detected; it is understood that the server can use a pre-configured detection method to detect the call sequence to be detected, for example, RASP protection technology can be used, and this application embodiment does not specifically limit this.

[0092] Step 205: Stop detection. If the thread filter contains the target thread identifier, it means that the call sequence to be detected is being detected and can be stopped. If the sequence filter contains the target sequence identifier, the call sequence to be detected can reuse the detection results corresponding to the target sequence identifier stored in the sequence filter.

[0093] In another embodiment, the sequence filter may only contain the detection result indicating that the corresponding call sequence is a safe call sequence. For call sequences detected as abnormal, their corresponding sequence identifiers and detection results are not stored in the sequence filter, and abnormal call sequences are processed accordingly, such as interception or alerting. It is understood that the call sequence to be detected is a child node of the call sequence currently being detected, and processing call sequences detected as abnormal is equivalent to processing the call sequence to be detected.

[0094] Since the detection results corresponding to the call sequence often do not change, this application embodiment saves the sequence identifier and detection result of the call sequence that has passed the security detection in the sequence filter, which makes it easy to determine whether the call sequence to be detected has been detected. After it is determined that it has been detected, it will not be detected again, and the previous detection result can be reused directly, thereby reducing the number of times the call sequence is detected.

[0095] Based on the above embodiments, it can be determined whether the detection result of the call sequence to be detected already exists in the sequence filter in the following way:

[0096] The server pre-generates a sequence filter, which stores the sequence identifiers and detection results of call sequences that have already been tested. The detection result is used to characterize whether the call sequence is normal. It can be understood that the sequence identifier is used to characterize the uniqueness of the call sequence; that is, a call sequence has a sequence identifier that uniquely identifies it.

[0097] Obtain the target sequence identifier of the call sequence to be detected. Match the target sequence identifier with the sequence identifiers in the sequence filter. If a match is successful, it is determined that the call sequence to be detected has been detected before. Therefore, the call sequence to be detected will not be detected again in this test. Instead, the detection result of the sequence identifier that matches the target sequence identifier from the sequence filter will be used as the target detection result of the call sequence to be detected. If a match fails, the call sequence to be detected can be detected.

[0098] Since the detection results corresponding to the call sequence often do not change, this application embodiment saves the sequence identifier and detection result of the call sequence that has passed the security detection in the sequence filter, which makes it easy to determine whether the call sequence to be detected has been detected. After it is determined that it has been detected, it will not be detected again, and the previous detection result can be reused directly, thereby reducing the number of times the call sequence is detected.

[0099] Based on the above embodiments, the target sequence identifier of the call sequence to be detected can be obtained by the following method:

[0100] Obtain the call sequence to be detected based on the target thread context;

[0101] Obtain the memory addresses corresponding to each class in the call sequence to be detected;

[0102] Generate the target sequence identifier based on the memory address.

[0103] In the specific implementation process, the target thread context includes the call sequence to be detected. Therefore, the call sequence to be detected can be obtained based on the target thread context. The call sequence to be detected includes multiple classes, each with its corresponding memory address. The memory address of each class can be obtained through the call sequence to be detected. The specific method for obtaining the memory address can be the native hash algorithm of the calling class, or other methods can be used. This application embodiment does not specifically limit this. After obtaining the memory addresses corresponding to each class, a preset method can be used to generate the target sequence identifier of the call sequence to be detected. Specifically, a digest algorithm can be used to generate the target sequence identifier from the memory addresses corresponding to each class. For example, the memory address corresponding to each class can be calculated using the MD5 algorithm, and then the calculation results can be added together to obtain the target sequence identifier. For example, if the call sequence to be detected contains three classes: A, B, and C, and the MD5 value of A is 1, the MD5 value of B is 2, and the MD5 value of C is 3, then the target sequence identifier is 1+2+3=6. Alternatively, the calculation results can be concatenated sequentially according to the order of the classes in the call sequence to obtain the target sequence identifier. In this case, the target sequence identifier is 123.

[0104] It is understood that any method that can generate a target sequence identifier to represent the uniqueness of the call sequence to be detected based on the memory address of each class is acceptable, and this application embodiment does not specifically limit this.

[0105] This application embodiment generates a target sequence identifier by calling the memory address corresponding to each class in the call sequence, thereby achieving the uniqueness of the call sequence and improving the accuracy of determining whether the call sequence to be detected has been detected.

[0106] Based on the above embodiments, the method further includes:

[0107] If the sequence filter does not contain the target sequence identifier, the target thread identifier is added to the thread filter, and the call sequence to be detected is detected to obtain the target detection result of the call sequence to be detected.

[0108] In the specific implementation process, if the sequence filter does not contain the target sequence identifier, it means that the sequence filter does not have a reusable detection result for the call sequence to be detected. Therefore, the call sequence to be detected can be detected. During detection, the target thread identifier corresponding to the call sequence to be detected can be added to the thread filter. If the server triggers the call sequence again later, it can know through the thread filter that the call sequence is being detected, and it is not necessary to detect the call sequence that is triggered again.

[0109] In this embodiment of the application, if the thread filter does not contain a call sequence that is the same as the call sequence to be detected, and the sequence filter does not contain a detection result of the call sequence to be detected, then the target corresponding to the call sequence to be detected is not being detected. In this case, the target thread identifier is added to the thread filter, and the call sequence to be detected is detected. If the same thread call sequence is triggered again in the future, it will no longer be detected, thus reducing the number of times the call sequence is detected.

[0110] Based on the above embodiments, after obtaining the target detection result of the call sequence to be detected, the method further includes:

[0111] If the target detection result indicates that the call sequence to be detected is a safe call sequence, then the target sequence identifier and the target detection result of the call sequence to be detected are stored in the sequence filter.

[0112] In the specific implementation process, for the case where the sequence filter only stores information about safe call sequences, after the call sequence to be detected is detected, if the target detection result indicates that the call sequence to be detected is a safe call sequence, then the sequence identifier of the call sequence to be detected and the target detection result are stored as a piece of data in the sequence filter.

[0113] This application embodiment stores the target sequence identifier and target detection result corresponding to the secure call sequence in the sequence filter. When the call sequence is triggered again, the target detection result can be directly reused, thereby reducing the number of times the call sequence is detected.

[0114] In another embodiment, if the sequence filter contains all detected call sequences, regardless of the detection result of the call sequence to be detected, the detection result and the corresponding target call identifier are stored as a data entry in the sequence filter.

[0115] Based on the above embodiments, the method further includes:

[0116] If the detection of the call sequence corresponding to the target thread identifier is completed, the target thread identifier is removed from the thread filter.

[0117] In the specific implementation process, when detecting the call sequence to be detected, the target thread identifier corresponding to the call sequence can be removed from the thread filter after the detection is completed.

[0118] This application embodiment prevents omissions in the detection of call sequences by removing the target thread identifier corresponding to the completed call sequence from the thread filter.

[0119] Figure 3This is a schematic diagram of a call sequence detection device provided in an embodiment of this application. The device can be a module, program segment, or code on an electronic device. It should be understood that this device is similar to the one described above. Figure 1 The method implementation corresponds to this and can be executed. Figure 1 The various steps involved in the method embodiment, and the specific functions of the device, can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here. The device includes: an acquisition module 301 and a detection module 302, wherein:

[0120] The acquisition module 301 is used to acquire the call sequence to be detected;

[0121] The detection module 302 is used to stop detecting the call sequence to be detected if there is a call sequence that is the same as the call sequence to be detected being detected, or if there is already a detection result for the call sequence to be detected.

[0122] Based on the above embodiments, the detection module 302 is specifically used for:

[0123] Obtain the target thread identifier of the call sequence to be detected;

[0124] Determine whether the thread filter contains the target thread identifier. If it does, do not perform the detection on the call sequence to be detected. The thread filter contains the thread identifier of the call sequence that is currently being detected.

[0125] Based on the above embodiments, the device further includes a result acquisition module, used for:

[0126] The detection result corresponding to the call sequence being detected is used as the target detection result of the call sequence to be detected.

[0127] Based on the above embodiments, the detection module 302 is specifically used for:

[0128] If the thread filter does not contain the target thread identifier, then obtain the target sequence identifier of the call sequence to be detected;

[0129] Determine whether the target sequence identifier is contained in the sequence filter. If it is, the call sequence to be detected will no longer be detected, and the detection result corresponding to the target sequence identifier will be obtained from the sequence filter. The detection result will be determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test.

[0130] Based on the above embodiments, the detection module 302 is specifically used for:

[0131] Obtain the target sequence identifier of the call sequence to be detected;

[0132] Determine whether the sequence filter contains the target sequence identifier. If it does, the call sequence to be detected will no longer be detected, and the detection result corresponding to the target sequence identifier will be obtained from the sequence filter. The detection result will be determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test.

[0133] Based on the above embodiments, the detection module 302 is specifically used for:

[0134] Obtain the call sequence to be detected based on the target thread context;

[0135] Obtain the memory addresses corresponding to each class in the call sequence to be detected;

[0136] Generate the target sequence identifier based on the memory address.

[0137] Based on the above embodiments, the detection module 302 is specifically used for:

[0138] If the sequence filter does not contain the target sequence identifier, the target thread identifier is added to the thread filter, and the call sequence to be detected is detected to obtain the target detection result of the call sequence to be detected.

[0139] Based on the above embodiments, the device further includes a storage module for:

[0140] If the target detection result indicates that the call sequence to be detected is a safe call sequence, then the target sequence identifier and the target detection result of the call sequence to be detected are stored in the sequence filter.

[0141] Based on the above embodiments, the device further includes a rejection module, used for:

[0142] If the detection of the call sequence corresponding to the target thread identifier is completed, the target thread identifier is removed from the thread filter.

[0143] Figure 4 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of this application, such as... Figure 4 As shown, the electronic device includes: a processor 401, a memory 402, and a bus 403; wherein,

[0144] The processor 401 and the memory 402 communicate with each other through the bus 403;

[0145] The processor 401 is used to call program instructions in the memory 402 to execute the methods provided in the above method embodiments, such as: obtaining a call sequence to be detected; if there is a call sequence identical to the call sequence to be detected being detected, or if there is already a detection result for the call sequence to be detected, then the call sequence to be detected will no longer be detected.

[0146] Processor 401 can be an integrated circuit chip with signal processing capabilities. The processor 401 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0147] The memory 402 may include, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc.

[0148] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can perform the methods provided in the above-described method embodiments, such as: obtaining a call sequence to be detected; if a call sequence identical to the call sequence to be detected is being detected, or if a detection result for the call sequence to be detected already exists, then the call sequence to be detected is no longer detected.

[0149] This embodiment provides a non-transitory computer-readable storage medium that stores computer instructions that cause the computer to execute the methods provided in the above-described method embodiments, such as: obtaining a call sequence to be detected; if a call sequence identical to the call sequence to be detected is being detected, or if a detection result for the call sequence to be detected already exists, then the call sequence to be detected is no longer detected.

[0150] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0151] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0152] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0153] In this document, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0154] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting call sequences, characterized in that, include: Obtain the call sequence to be detected; If a call sequence identical to the one to be detected is being detected, or if a detection result for the call sequence to be detected already exists, then the call sequence to be detected will no longer be detected. The step of stopping the detection of the call sequence if a call sequence identical to the one to be detected is already being detected includes: Obtain the target thread identifier of the call sequence to be detected; Determine whether the target thread identifier is contained in the thread filter. If it is, do not perform detection on the call sequence to be detected. The thread filter contains the thread identifier of the call sequence that is currently being detected. The method further includes: If the target thread identifier is not included in the thread filter, then the target sequence identifier of the call sequence to be detected is obtained; Determine whether the target sequence identifier is contained in the sequence filter. If it is, then the call sequence to be detected is no longer detected, and the detection result corresponding to the target sequence identifier is obtained from the sequence filter. The detection result is determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test. The step of not further detecting the call sequence if a detection result already exists for the call sequence to be detected includes: Obtain the target sequence identifier of the call sequence to be detected; Determine whether the target sequence identifier is contained in the sequence filter. If it is, no further detection is performed on the call sequence to be detected, and the detection result corresponding to the target sequence identifier is obtained from the sequence filter. The detection result is determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed security detection.

2. The method according to claim 1, characterized in that, The method further includes: The detection result corresponding to the call sequence being detected is used as the target detection result of the call sequence to be detected.

3. The method according to claim 1, characterized in that, The step of obtaining the target sequence identifier of the call sequence to be detected includes: The call sequence to be detected is obtained based on the target thread context; Obtain the memory address corresponding to each class in the call sequence to be detected; The target sequence identifier is generated based on the memory address.

4. The method according to claim 1, characterized in that, The method further includes: If the sequence filter does not contain the target sequence identifier, then the target thread identifier is added to the thread filter, and the call sequence to be detected is detected to obtain the target detection result of the call sequence to be detected.

5. The method according to claim 4, characterized in that, After obtaining the target detection result of the call sequence to be detected, the method further includes: If the target detection result indicates that the call sequence to be detected is a safe call sequence, then the target sequence identifier and the target detection result of the call sequence to be detected are stored in the sequence filter.

6. The method according to claim 1 or 3, characterized in that, The method further includes: If the detection of the call sequence corresponding to the target thread identifier is completed, then the target thread identifier is removed from the thread filter.

7. A sequence detection device, characterized in that, include: The acquisition module is used to acquire the call sequence to be detected; The detection module is configured to stop detecting the call sequence to be detected if there is a call sequence identical to the one to be detected being detected, or if there is already a detection result for the call sequence to be detected. The detection module is specifically used for: Obtain the target thread identifier of the call sequence to be detected; Determine whether the target thread identifier is contained in the thread filter. If it is, do not perform detection on the call sequence to be detected. The thread filter contains the thread identifier of the call sequence that is currently being detected. If the target thread identifier is not included in the thread filter, then the target sequence identifier of the call sequence to be detected is obtained; Determine whether the target sequence identifier is contained in the sequence filter. If it is, then the call sequence to be detected is no longer detected, and the detection result corresponding to the target sequence identifier is obtained from the sequence filter. The detection result is determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed the security test. The step of not further detecting the call sequence if a detection result already exists for the call sequence to be detected includes: Obtain the target sequence identifier of the call sequence to be detected; Determine whether the target sequence identifier is contained in the sequence filter. If it is, no further detection is performed on the call sequence to be detected, and the detection result corresponding to the target sequence identifier is obtained from the sequence filter. The detection result is determined as the target detection result of the call sequence to be detected. The sequence filter includes the sequence identifier and detection result of the call sequence that has passed security detection.

8. An electronic device, characterized in that, include: Processor, memory, and bus, among which, The processor and the memory communicate with each other via the bus; The memory stores program instructions that can be executed by the processor, and the processor can invoke the program instructions to perform the method as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores computer instructions, which, when executed by a computer, cause the computer to perform the method as described in any one of claims 1-6.

Images