Malicious request detection method, device, processor and electronic device

Abstract

The application discloses a malicious request detection method and device, a processor and electronic equipment. The method comprises the following steps: obtaining communication data between a client and a server, and determining a configuration file associated with the communication data; judging whether a character segment in the configuration file matches a third-party dependency list; in the case that the character segment in the configuration file matches the third-party dependency list, obtaining a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result; judging whether the communication data applies a deserialization vulnerability through the first matching result, and determining that the communication data is malicious request data in the case that the communication data utilizes the deserialization vulnerability. Through the application, the problem that a normal communication request is mistakenly detected as a malicious request in the related art by comparing whether a programming class name in communication data matches a white list to detect a malicious request is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of traffic detection, in particular, to a malicious request detection method and device, a processor and an electronic device. BACKGROUND

[0002] When two JAVA (object-oriented programming language) processes in a communication network remotely communicate, various types of data are sent between them, and these data are transmitted in the form of binary sequences between the two processes. JAVA serialization is the conversion of JAVA objects into byte sequences, and JAVA deserialization is the restoration of byte sequences into JAVA objects. JAVA realizes JAVA object transmission when two processes communicate through serialization and deserialization. However, JAVA deserialization has some known public vulnerabilities, such as CVE-2017-12149, CVE-2018-2628, CVE-2015-4852, CVE-2019-17564, etc. Malicious attackers can use these vulnerabilities in combination with JAVA system process operations, network request programs, and other program execution interfaces to send specially designed traffic packets or write malicious files to target servers, thereby invading the target servers and performing malicious operations on the target servers through remote bytecodes.

[0003] In related technologies, a whitelist configuration file pre-stored with multiple objects carrying malicious bytecodes is obtained, the type of a target object to be deserialized is compared with the whitelist configuration file, and if the whitelist configuration file contains an object of the same type as the target object, the deserialization operation of the target object is terminated, thereby preventing malicious attackers from exploiting deserialization vulnerabilities.

[0004] However, the deserialization target object obtained is compared with the deserialization whitelist set that may have vulnerabilities. If the malicious deserialization object is determined by matching the object type set in the whitelist, the deserialization operation is not performed. Lack of specific behavior correlation analysis of the deserialization object directly determines the maliciousness of the deserialization object and blocks the deserialization operation, which may block normal business. In addition, the repair of the deserialization vulnerability requires the use of JAVA proxy mechanism locally, and the JAVA proxy mechanism is used to patch the server. When the business traffic is large, the server personnel may not respond in time when the vulnerability occurs, resulting in the failure to timely implant the byte code check of the deserialization class with the vulnerability, and thus the attacker may exploit the vulnerability to attack successfully.

[0005] The related art detects malicious requests by comparing the programming class name in the communication data with the whitelist. However, there is a problem that normal communication requests are mistakenly detected as malicious requests. Currently, there is no effective solution to this problem. SUMMARY

[0006] The main purpose of the present application is to provide a malicious request detection method, device, processor and electronic equipment, so as to solve the problem that in the related art, a malicious request is detected by comparing whether the programming class name in the communication data matches the white list, and a normal communication request is misdetected as a malicious request.

[0007] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a malicious request detection method is provided. The method comprises: obtaining communication data between a client and a server, and determining a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application program generating the communication data; judging whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains third-party dependency information of a plurality of malicious requests, and each third-party dependency information contains a plurality of character segments; in the case that the character segment in the configuration file matches the third-party dependency list, obtaining a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities; judging whether the communication data applies a deserialization vulnerability through the first matching result, and in the case that the communication data utilizes the deserialization vulnerability, determining that the communication data is malicious request data.

[0008] Optionally, before determining the configuration file associated with the communication data, the method further comprises: judging whether a response status code in the communication data is a target value, wherein the response status code is data returned by the client or the server when responding to the communication request, and the target value represents that the communication data applies a hypertext transfer protocol; in the case that the response status code is not the target value, judging whether the character segment in the communication data matches the third-party dependency list; in the case that the character segment in the communication data matches the third-party dependency list, obtaining the dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with the deserialization vulnerability bytecode chain to obtain a second matching result; judging whether the communication data applies the deserialization vulnerability through the second matching result, and in the case that the communication data utilizes the deserialization vulnerability, determining that the communication data is malicious request data.

[0009] Optionally, after judging whether the response status code in the communication data is the target value, the method further comprises: in the case that the response status code is the target value, judging whether a uniform resource locator in the communication data belongs to a preset white list, wherein the preset white list contains uniform resource locators of historical communication requests; in the case that the uniform resource locator belongs to the preset white list, performing the step of determining the configuration file associated with the communication data; in the case that the uniform resource locator does not belong to the preset white list, determining that the communication data utilizes the deserialization vulnerability, and determining the communication data as malicious request data.

[0010] Optionally, before judging whether the character segment in the configuration file matches the third-party dependency list, the method further comprises: obtaining a plurality of third-party dependency information and a version of each third-party dependency information in the dependency information repository; judging whether the third-party dependency information under each version contains a vulnerability, and adding the character segment contained in the vulnerability to the third-party dependency list.

[0011] Optionally, obtaining the dependency source code corresponding to the character segment from the third-party dependency list and matching the dependency source code with the deserialization vulnerability bytecode chain comprises: comparing each third-party dependency information with the character segment in the configuration file one by one in the third-party dependency list; determining the third-party dependency information containing the character segment in the configuration file as the dependency source code; obtaining the programming class name and the programming method name in the dependency source code, and matching the programming class name and the programming method name with the bytecode in the deserialization vulnerability bytecode chain.

[0012] Optionally, judging whether the communication data applies the deserialization vulnerability through the first matching result comprises: obtaining the programming class name and the programming method name contained in each deserialization vulnerability in the deserialization vulnerability bytecode chain; judging whether the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability; in the case that the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability, determining that the communication data applies the deserialization vulnerability.

[0013] Optionally, the method further comprises: judging whether the communication data contains a program execution function, wherein the program execution function is a function called by the communication data on the client side or the server side; in the case that the communication data contains the program execution function, recording the program execution function to the target log and issuing a prompt information, wherein the prompt information is used to prompt the user that the program execution function is a function called by a malicious request.

[0014] To achieve the above object, according to another aspect of the present application, a malicious request detection device is provided. The device comprises: an acquisition unit configured to acquire communication data between a client and a server and determine a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application generating the communication data; a judgment unit configured to judge whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains third-party dependency information of a plurality of malicious requests, and each third-party dependency information contains a plurality of character segments; a matching unit configured to, in the case that the character segment in the configuration file matches the third-party dependency list, acquire a dependency source code corresponding to the character segment from the third-party dependency list, and match the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities; and a determination unit configured to judge whether the communication data applies a deserialization vulnerability through the first matching result, and determine that the communication data is data of a malicious request in the case that the communication data utilizes the deserialization vulnerability.

[0015] According to the present application, the following steps are adopted: acquiring communication data between a client and a server and determining a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application generating the communication data; judging whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains third-party dependency information of a plurality of malicious requests, and each third-party dependency information contains a plurality of character segments; in the case that the character segment in the configuration file matches the third-party dependency list, acquiring a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities; and judging whether the communication data applies a deserialization vulnerability through the first matching result, and determining that the communication data is data of a malicious request in the case that the communication data utilizes the deserialization vulnerability, thereby solving the problem in the related art that a normal communication request is mistakenly detected as a malicious request by comparing whether a programming class name in the communication data matches a white list. By matching the source code of the third-party dependency information with the deserialization vulnerability bytecode chain to determine whether the communication data utilizes the deserialization vulnerability, the communication data is finally detected as a malicious request, thereby achieving the effect of avoiding mistakenly detecting a normal communication request as a malicious request. BRIEF DESCRIPTION OF DRAWINGS

[0016] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application and are incorporated herein for a purpose of explanations. In the drawings:

[0017] Figure 1is a flowchart of a malicious request detection method according to an embodiment of the present application;

[0018] Figure 2 is a schematic diagram of an optional malicious request detection method according to an embodiment of the present application;

[0019] Figure 3 is a schematic diagram of a malicious request detection device according to an embodiment of the present application;

[0020] Figure 4 is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] It should be noted that the embodiments and features of the embodiments in the present application can be combined with each other without conflict. The technical solutions in the embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0022] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second" and the like in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units need not be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0024] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties.

[0025] The present application will be described below in combination with the preferred implementation steps, Figure 1 is a flowchart of a malicious request detection method according to an embodiment of the present application, as Figure 1 shown, the method comprises the following steps:

[0026] In step S101, communication data between the client and the server is acquired, and a configuration file associated with the communication data is determined, wherein the configuration file is a configuration file of an application program generating the communication data.

[0027] Specifically, the client and the server can be JAVA processes, and the communication data can be a communication request between the client and the server and a response to the communication request. The configuration file can be a configuration file of a JAVA application program generating the communication data, such as a pom.xml file. The communication data between the client and the server is acquired by a flow detection device. The communication data contains traffic data when the client initiates a request to the server, and also includes traffic data carried by the request response, such as a response status code. By analyzing the communication data, it is determined whether the communication request is a malicious request using JAVA deserialization vulnerability.

[0028] In step S102, it is determined whether the character segment in the configuration file matches the third-party dependency list, wherein the third-party dependency list contains third-party dependency information of a plurality of malicious requests, and each third-party dependency information contains a plurality of character segments.

[0029] Specifically, the third-party dependency list can be a dependency list that records the corresponding programming class name summary of the JAVA application program vulnerability. By matching the character segment in the configuration file with the third-party dependency list, it is determined whether there is a programming class name in the plurality of third-party dependency information in the third-party dependency list that is the same as the character segment in the matching file. If there is a same programming class name, it means matching. If there is no same programming class name in the third-party dependency list as the character segment in the configuration file, it means no matching.

[0030] In step S103, in the case that the character segment in the configuration file matches the third-party dependency list, the dependency source code corresponding to the character segment is obtained from the third-party dependency list, and the dependency source code is matched with the deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities.

[0031] Specifically, if the character segment in the configuration file matches the third-party dependency list, it means that the communication data has the possibility of being malicious request data. The dependency source code is extracted from the third-party dependency information matched with the character segment in the configuration file. The dependency source code is matched with the deserialization vulnerability bytecode chain. If the matching is successful, it means that the communication data uses the deserialization vulnerability. The communication data is malicious request data. If the matching fails, it means that the communication data is not malicious request data, but only carries the same programming class name as the deserialization vulnerability.

[0032] It should be noted that the deserialization vulnerability can be a JAVA memory horse, and the JAVA memory horse is a deserialization vulnerability that writes a malicious backdoor and a Trojan horse in the memory of a JAVA application and executes the Trojan horse. Unlike traditional network attacks, the JAVA memory horse attack is a fileless attack and exists only in the memory space of the JAVA process. Compared with file attacks, JAVA memory horses can be directly detected through disk files, and the detection of fileless attacks is more difficult than the detection of file attacks.

[0033] In step S104, it is judged whether the communication data applies the deserialization vulnerability through the first matching result. In the case that the communication data utilizes the deserialization vulnerability, it is determined that the communication data is the data of the malicious request.

[0034] Specifically, in the case that the first matching result represents that the dependency source code and the deserialization vulnerability bytecode chain are matched successfully, that is, the communication data contains the programming class name and the programming method name utilizing the deserialization vulnerability. It is explained that the communication data is the data of the malicious request.

[0035] The malicious request detection method provided by the embodiment of the application includes the following steps: obtaining communication data between a client and a server, and determining a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application generating the communication data; judging whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains third-party dependency information of a plurality of malicious requests, and each third-party dependency information contains a plurality of character segments; in the case that the character segment in the configuration file matches the third-party dependency list, obtaining dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities; and judging whether the communication data applies the deserialization vulnerability through the first matching result, and in the case that the communication data utilizes the deserialization vulnerability, determining that the communication data is the data of the malicious request. The method solves the problem in the related art that a normal communication request is mistakenly detected as a malicious request by comparing whether a programming class name in the communication data matches a white list to detect a malicious request. The source code of the third-party dependency information is matched with the deserialization vulnerability bytecode chain to determine whether the communication data utilizes the deserialization vulnerability, so as to finally detect whether the communication data is a malicious request, and thus the effect of avoiding mistakenly detecting a normal communication request as a malicious request is achieved.

[0036] The method for determining whether a communication request using different communication protocols is a malicious request is different. Optionally, in the malicious request detection method provided in the embodiments of the present application, before determining the configuration file associated with the communication data, the method further includes: determining whether the response status code in the communication data is a target value, wherein the response status code is data returned by the client or the server when responding to the communication request, and the target value represents that the communication data uses the hypertext transfer protocol; in the case where the response status code is not the target value, determining whether the character segment in the communication data matches the third-party dependency list; in the case where the character segment in the communication data matches the third-party dependency list, obtaining the dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with the deserialization vulnerability bytecode chain to obtain a second matching result; determining whether the communication data uses the deserialization vulnerability through the second matching result, and in the case where the communication data uses the deserialization vulnerability, determining that the communication data is malicious request data.

[0037] Specifically, the response status code can be the response data of the server to the communication request after the client initiates the communication request to the server, and the target value can be 200. If the response status code is 200, it means that the communication protocol used in this communication request is the hypertext transfer protocol. If the response status code is not 200, it means that the communication protocol used in this communication request is not the hypertext transfer protocol. At this time, it is necessary to directly determine whether there is a character segment in the character segment in the communication data that is the same as the programming class name and / or the programming method name in the third-party dependency list. If there is a same character segment, it means that the character segment in the communication data matches the third-party dependency list. In the matching case, the dependency source code corresponding to the same character segment is obtained from the third-party dependency list, and then the dependency source code is matched with the deserialization vulnerability bytecode chain. According to the second matching result, it is determined whether the communication data uses the deserialization vulnerability. If the deserialization vulnerability is used, it means that the communication data is malicious request data. By directly matching the character segment in the communication data with the third-party dependency list for the communication data using a communication protocol other than the hypertext transfer protocol, it is determined whether the communication data is malicious request data.

[0038] The unified resource locator in the communication data is judged to belong to a preset white list to preliminarily screen malicious requests. Optionally, in the malicious request detection method provided in the embodiments of the present application, after determining whether the response status code in the communication data is a target value, the method further includes: in the case where the response status code is the target value, determining whether the unified resource locator in the communication data belongs to a preset white list, wherein the preset white list contains the unified resource locator of the historical communication request; in the case where the unified resource locator belongs to the preset white list, performing the step of determining the configuration file associated with the communication data; in the case where the unified resource locator does not belong to the preset white list, determining that the communication data uses the deserialization vulnerability, and determining that the communication data is malicious request data.

[0039] Specifically, if the response status code is 200, it indicates that the communication protocol used by the current communication data is the hypertext transfer protocol, at this time, the URL (Uniform Resource Locator) in the communication data needs to be obtained, and then it is judged whether the URL in the communication data is in the preset URL whitelist. The URL whitelist records the URLs of historical communication requests. If the URL in the communication data belongs to the URL whitelist, it indicates that the current communication data has the possibility of being malicious request data. Next, the step of determining the configuration file associated with the communication data is performed, and it is determined whether the communication data is malicious request data through the configuration file. If the URL in the communication data does not belong to the URL whitelist, it indicates that the current communication data is successfully initiated by using the deserialization vulnerability, and it is directly determined that the communication data is malicious request data. Whether the URL of the communication data using the hypertext transfer protocol belongs to the preset URL whitelist is judged to preliminarily determine whether the communication data is malicious request data.

[0040] Optionally, in the malicious request detection method provided in the embodiment of the application, before judging whether the character segment in the configuration file matches the third-party dependency list, the method further includes: obtaining a plurality of third-party dependency information and a version of each third-party dependency information in a dependency information repository; judging whether the third-party dependency information under each version contains a vulnerability, and adding the character segment contained in the vulnerability to the third-party dependency list.

[0041] Specifically, the dependency information repository can be a library of JAVA data packages storing third-party dependency information. The dependency information repository records the data package of each version of each third-party dependency information, and the data package records the programming class name and the programming method name of the vulnerability that may exist in the JAVA application. By configuring the dependency information repository, the third-party dependency information that may have a vulnerability can be recorded, thereby providing a matching basis for screening malicious requests.

[0042] The programming class name and the programming method name are matched to determine whether the communication data uses the deserialization vulnerability. Optionally, in the malicious request detection method provided in the embodiment of the application, the dependency source code corresponding to the character segment is obtained from the third-party dependency list, and the dependency source code is matched with the deserialization vulnerability bytecode chain, including: comparing each third-party dependency information with the character segment in the configuration file one by one in the third-party dependency list; determining the third-party dependency information containing the character segment in the configuration file as the dependency source code; obtaining the programming class name and the programming method name in the dependency source code, and matching the programming class name and the programming method name with the bytecodes in the deserialization vulnerability bytecode chain.

[0043] Specifically, by matching the character segment in the configuration file with the dependency source code of each third-party dependency information in the third-party dependency list, it is determined whether the character segment in each dependency source code is the same as the character segment in the configuration file. In the case that the character segment in one of the dependency source codes is the same as the character segment in the configuration file, it is determined that the dependency source code of the third-party dependency information matches the character segment in the configuration file associated with the communication data, and the programming class name and the programming method name in the dependency source code are obtained. The programming class name and the programming method name are matched with the multiple bytecodes in the deserialization vulnerability bytecode chain, so as to determine whether the communication data utilizes the deserialization vulnerability.

[0044] It should be noted that the deserialization vulnerability bytecode chain is derived by analyzing the programming class name and the programming method name of the third-party dependency information with the deserialization vulnerability, and the utilization bytecode chain of the deserialization vulnerability class that can trigger remote bytecode through the deserialization operation is derived. That is, the deserialization vulnerability bytecode chain records the bytecodes for utilizing various deserialization vulnerabilities.

[0045] By matching the programming class name and the programming method name, it is determined whether the communication data utilizes the deserialization vulnerability. Optionally, in the malicious request detection method provided in the embodiments of the present application, the step of determining whether the communication data utilizes the deserialization vulnerability through the first matching result comprises: obtaining the programming class name and the programming method name contained in each deserialization vulnerability in the deserialization vulnerability bytecode chain; determining whether the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability; and in the case that the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability, it is determined that the communication data utilizes the deserialization vulnerability.

[0046] Specifically, the deserialization vulnerability bytecode chain is a collection of utilization bytecodes of multiple deserialization vulnerabilities. Whether the communication data utilizes the deserialization vulnerability is determined by matching the programming class name and the programming method name in the dependency source code with the programming class name and the programming method name in the deserialization vulnerability bytecode chain.

[0047] Optionally, in the malicious request detection method provided in the embodiments of the present application, the method further comprises: determining whether the communication data contains a program execution function, wherein the program execution function is a function called by the communication data on the client side or the server side; and in the case that the communication data contains the program execution function, recording the program execution function to a target log and issuing a prompt information, wherein the prompt information is used to prompt the user that the program execution function is a function called by the malicious request.

[0048] Specifically, after obtaining the communication data, it is judged whether the program execution function for calling the JAVA application is contained in the communication data. If the program execution function is contained in the communication data, after it is determined that the communication data is malicious request data, the program execution function is recorded to the target log, and a prompt information is sent to avoid the JAVA application from executing the program execution function contained in the communication data, so as to avoid the JAVA application from being maliciously attacked. If the communication data only contains the bytecode for exploiting the deserialization vulnerability but does not contain the program execution function, only the communication data is recorded to the target log. By judging whether the program execution function is contained in the communication data, the JAVA application is avoided from being maliciously called to execute the program execution function.

[0049] According to another embodiment provided by the present application, Figure 2 is a schematic diagram of an optional malicious request detection method provided by the embodiment of the present application. As shown in the figure, Figure 2 the method comprises: obtaining the flow detection record and analyzing the communication request data and the response data in the record. It is judged whether the status code in the response data is 200. If not, it is detected whether the exploitable dependent class name is contained in the communication request data. If yes, the communication data is matched with the deserialization vulnerability bytecode chain. According to the matching result, it is judged whether the communication request data exploits the deserialization vulnerability, and the program execution function is analyzed in association. If the deserialization vulnerability is exploited, it is indicated that the communication request data is a malicious communication request. If the program execution function is contained in the malicious communication request, the JAVA application is subjected to false alarm detection, and it is determined that the program execution function is a function called by the malicious communication request, so as to avoid the JAVA application from falsely reporting the program execution function.

[0050] If the status code in the response data is 200, the URL in the communication request data is extracted, the URL is detected by the JAVA program check, if the URL of the communication request data is not in the URL whitelist, it is indicated that the communication request data is a communication request issued by writing a memory hook into a JAVA application program by using a deserialization vulnerability, and it is determined that the communication request data is a malicious communication request. If the URL of the communication request data is in the URL whitelist, the JAVA program check third-party dependency information and version information, by obtaining the pom.xml configuration file of the JAVA application program, it is judged whether the data in the configuration file matches the exploitable dependency list, if it matches, the data in the configuration file is matched with the deserialization vulnerability bytecode chain, according to the matching result, it is judged whether the communication request data uses the deserialization vulnerability, and at the same time, the program execution function association analysis is performed, if the deserialization vulnerability is used, it is indicated that the communication request data is a malicious communication request, if the malicious communication request contains a program execution function, the JAVA application program is false alarm detection, the program execution function is determined as a function called by the malicious communication request, and false alarm of the JAVA application program on the program execution function is avoided.

[0051] According to the optional malicious request detection method provided by the embodiment of the application, the bytecode chain of the deserialization vulnerability is used to enhance the detection capability of the flow detection device, and the IP determined as a malicious communication request can be recorded to prevent the malicious communication request of this type. The malicious request detection method of the embodiment can also reduce the false alarm rate of the malicious program execution function by associating the program execution function in flow detection.

[0052] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0053] The embodiment of the application also provides a malicious request detection device. It should be noted that the malicious request detection device of the embodiment of the application can be used to execute the malicious request detection method provided by the embodiment of the application. The malicious request detection device provided by the embodiment of the application is introduced as follows.

[0054] Figure 3 is a schematic diagram of the malicious request detection device provided by the embodiment of the application. As shown in Figure 3 , the device includes:

[0055] The acquisition unit 10 is configured to acquire communication data between a client and a server, and determine a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application program generating the communication data;

[0056] The judging unit 20 is configured to judge whether the character segment in the configuration file matches the third-party dependency list, wherein the third-party dependency list contains third-party dependency information of multiple malicious requests, and each third-party dependency information contains multiple character segments.

[0057] The matching unit 30 is configured to, in the case that the character segment in the configuration file matches the third-party dependency list, obtain the dependency source code corresponding to the character segment from the third-party dependency list, and match the dependency source code with the deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is bytecode containing multiple deserialization vulnerabilities.

[0058] The determining unit 40 is configured to judge whether the communication data applies the deserialization vulnerability through the first matching result, and determine that the communication data is malicious request data in the case that the communication data utilizes the deserialization vulnerability.

[0059] The malicious request detection device provided by the embodiment of the present application includes the following steps: the obtaining unit 10 is configured to obtain the communication data between the client and the server, and determine the configuration file associated with the communication data, wherein the configuration file is the configuration file of the application program generating the communication data; the judging unit 20 is configured to judge whether the character segment in the configuration file matches the third-party dependency list, wherein the third-party dependency list contains third-party dependency information of multiple malicious requests, and each third-party dependency information contains multiple character segments; the matching unit 30 is configured to, in the case that the character segment in the configuration file matches the third-party dependency list, obtain the dependency source code corresponding to the character segment from the third-party dependency list, and match the dependency source code with the deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is bytecode containing multiple deserialization vulnerabilities; and the determining unit 40 is configured to judge whether the communication data applies the deserialization vulnerability through the first matching result, and determine that the communication data is malicious request data in the case that the communication data utilizes the deserialization vulnerability. The present application solves the problem that, in the related art, the malicious request is detected by comparing whether the programming class name in the communication data matches the white list, and the normal communication request is mistakenly detected as the malicious request. The present application determines whether the communication data utilizes the deserialization vulnerability by matching the source code of the third-party dependency information with the deserialization vulnerability bytecode chain, so as to finally detect whether the communication data is the malicious request, and further achieves the effect of avoiding the normal communication request from being mistakenly detected as the malicious request.

[0060] Optionally, in the malicious request detection apparatus provided by the embodiment of the present application, the apparatus further comprises: a target value judging unit configured to judge whether the response status code in the communication data is a target value, wherein the response status code is data returned by the client or the server when responding to the communication request, and the target value indicates that the communication data applies the HTTP protocol; a character segment judging unit configured to, when the response status code is not the target value, judge whether the character segment in the communication data matches the third-party dependency list; a dependency source code obtaining unit configured to, when the character segment in the communication data matches the third-party dependency list, obtain the dependency source code corresponding to the character segment from the third-party dependency list, and match the dependency source code with the deserialization vulnerability bytecode chain to obtain a second matching result; and a first vulnerability judging unit configured to judge whether the communication data applies the deserialization vulnerability through the second matching result, and determine that the communication data is malicious request data when the communication data utilizes the deserialization vulnerability.

[0061] Optionally, in the malicious request detection apparatus provided by the embodiment of the present application, the apparatus further comprises: a white list judging unit configured to, when the response status code is the target value, judge whether the uniform resource locator in the communication data belongs to a preset white list, wherein the preset white list contains the uniform resource locator of the historical communication request; an executing unit configured to, when the uniform resource locator belongs to the preset white list, execute the step of determining the configuration file associated with the communication data; and a malicious request determining unit configured to, when the uniform resource locator does not belong to the preset white list, determine that the communication data utilizes the deserialization vulnerability, and determine that the communication data is malicious request data.

[0062] Optionally, in the malicious request detection apparatus provided by the embodiment of the present application, the apparatus further comprises: a third-party dependency information obtaining unit configured to obtain a plurality of third-party dependency information and the version of each third-party dependency information in the dependency information repository; and a second vulnerability judging unit configured to judge whether the third-party dependency information under each version contains a vulnerability, and add the character segment contained in the vulnerability to the third-party dependency list.

[0063] Optionally, in the malicious request detection apparatus provided by the embodiment of the present application, the matching unit 30 comprises: a comparison module configured to compare each third-party dependency information with the character segment in the configuration file one by one in the third-party dependency list; a first determining module configured to determine the third-party dependency information containing the character segment in the configuration file as the dependency source code; a first obtaining module configured to obtain the programming class name and the programming method name in the dependency source code, and match the programming class name and the programming method name with the bytecode in the deserialization vulnerability bytecode chain.

[0064] Optionally, in the malicious request detection device provided by the embodiment of the application, the determining unit 40 comprises: a second acquisition module, configured to acquire the programming class name and the programming method name contained in each deserialization vulnerability in the deserialization vulnerability bytecode chain; a judging module, configured to judge whether the programming class name and the programming method name in the dependency source code are same as the programming class name and the programming method name in the deserialization vulnerability; and a second determining module, configured to determine that the communication data applies the deserialization vulnerability in a case where the programming class name and the programming method name in the dependency source code are same as the programming class name and the programming method name in the deserialization vulnerability.

[0065] Optionally, in the malicious request detection device provided by the embodiment of the application, the device further comprises: a program execution function judging unit, configured to judge whether the communication data contains a program execution function, wherein the program execution function is a function called by the communication data on the client side or the server side; and a recording unit, configured to record the program execution function to the target log and send a prompt information in a case where the communication data contains the program execution function, wherein the prompt information is used to prompt the user that the program execution function is a function called by the malicious request.

[0066] The malicious request detection device comprises a processor and a memory, and the above-mentioned acquisition unit 10, the judging unit 20, the writing unit 30, the determining unit 40 and the processing unit 50 are all stored in the memory as program units, and the corresponding functions are realized by the processor executing the above-mentioned program units stored in the memory.

[0067] The processor contains a core, and the core calls the corresponding program units in the memory. The core can be set to one or more, and the normal communication request is avoided from being mistakenly detected as the malicious request by adjusting the core parameters.

[0068] The memory can comprise a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory comprises at least one memory chip.

[0069] The embodiment of the application provides a computer readable storage medium, which stores a program, and the program is executed by a processor to realize the malicious request detection method.

[0070] The embodiment of the application provides a processor, which is used to run a program, and the program is executed to realize the malicious request detection method.

[0071] As Figure 4As shown, the embodiment of the present application provides an electronic device, the device 401 comprises a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the following steps when executing the program: the malicious request detection method. The device in this paper can be a server, a PC, a PAD, a mobile phone, etc.

[0072] The present application also provides a computer program product, when executed on a data processing device, is adapted to execute the program of the following method steps: the malicious request detection method.

[0073] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present application is described with reference to flowcharts and / or block diagrams according to the method, device (system), and computer program product of the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to produce a machine, so that the instructions executed by the computer or other programmable data processing devices produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The functions specified in one or more flows and / or blocks

[0075] These computer program instructions can also be stored in a computer-readable memory that can guide the computer or other programmable data processing devices to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1 The functions specified in one or more flows and / or blocks

[0076] These computer program instructions can also be loaded into a computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in one or more flows and / or blocks Figure 1steps of a function specified in one or more blocks.

[0077] In one typical arrangement, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0078] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) and / or cache memory, non-volatile memory, such as read-only memory (ROM), EPROM, and / or flash memory, etc. The memory is an example of computer readable media.

[0079] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without limitation, an element preceded by "comprises... a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0081] Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media (including, but not limited to, disk memory, CD-ROMs, optical storage devices, etc.) embodying computer readable program code thereon.

[0082] The above merely provides an example of the present application, and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall fall into the scope of claims of the present application.

Claims

1. A malicious request detection method characterized by, The method comprises the following steps: acquiring communication data between a client and a server, and determining a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application program generating the communication data; determining whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains third-party dependency information of multiple malicious requests, and each third-party dependency information contains multiple character segments; in the case that the character segment in the configuration file matches the third-party dependency list, acquiring a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing multiple deserialization vulnerabilities; determining whether the communication data applies a deserialization vulnerability through the first matching result, and determining that the communication data is malicious request data in the case that the communication data utilizes the deserialization vulnerability. wherein determining whether the communication data applies a deserialization vulnerability through the first matching result comprises: acquiring a programming class name and a programming method name contained in each deserialization vulnerability in the deserialization vulnerability bytecode chain; determining whether the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability; and determining that the communication data applies a deserialization vulnerability in the case that the programming class name and the programming method name in the dependency source code are the same as the programming class name and the programming method name in the deserialization vulnerability.

2. The method of claim 1, wherein, Before determining the configuration file associated with the communication data, the method further comprises: determining whether a response status code in the communication data is a target value, wherein the response status code is data returned by the client or the server in response to a communication request, and the target value indicates that the communication data applies a hypertext transfer protocol; in the case that the response status code is not the target value, determining whether a character segment in the communication data matches the third-party dependency list; in the case that the character segment in the communication data matches the third-party dependency list, acquiring a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain to obtain a second matching result; determining whether the communication data applies a deserialization vulnerability through the second matching result, and determining that the communication data is malicious request data in the case that the communication data utilizes the deserialization vulnerability.

3. The method of claim 2, wherein, After determining whether the response status code in the communication data is a target value, the method further comprises: in the case that the response status code is the target value, determining whether a uniform resource locator in the communication data belongs to a preset white list, wherein the preset white list contains uniform resource locators of historical communication requests; in the case that the uniform resource locator belongs to the preset white list, performing the step of determining the configuration file associated with the communication data. In a case where the uniform resource locator does not belong to the preset whitelist, it is determined that the communication data utilizes the deserialization vulnerability, and the communication data is determined as malicious request data.

4. The method of claim 1, wherein, Before judging whether the character segment in the configuration file matches the third-party dependency list, the method further comprises: obtaining a plurality of third-party dependency information and a version of each third-party dependency information in a dependency information repository; judging whether the third-party dependency information under each version contains a vulnerability, and adding a character segment contained in the vulnerability to the third-party dependency list.

5. The method of claim 1, wherein, obtaining a dependency source code corresponding to the character segment from the third-party dependency list, and matching the dependency source code with a deserialization vulnerability bytecode chain comprises: comparing each third-party dependency information with the character segment in the configuration file one by one in the third-party dependency list; determining the third-party dependency information containing the character segment in the configuration file as the dependency source code; obtaining a programming class name and a programming method name in the dependency source code, and matching the programming class name and the programming method name with bytecodes in the deserialization vulnerability bytecode chain.

6. The method of claim 1, wherein, The method further comprises: judging whether the communication data contains a program execution function, wherein the program execution function is a function called by the communication data on the client or the server; in a case where the communication data contains the program execution function, recording the program execution function to a target log, and issuing a prompt information, wherein the prompt information is used to prompt a user that the program execution function is a function called by the malicious request.

7. A malicious request detection apparatus characterized by comprising: comprises: an obtaining unit, configured to obtain communication data between a client and a server, and determine a configuration file associated with the communication data, wherein the configuration file is a configuration file of an application program generating the communication data; a judging unit, configured to judge whether a character segment in the configuration file matches a third-party dependency list, wherein the third-party dependency list contains a plurality of third-party dependency information of malicious requests, and each third-party dependency information contains a plurality of character segments; a matching unit, configured to, in a case where the character segment in the configuration file matches the third-party dependency list, obtain a dependency source code corresponding to the character segment from the third-party dependency list, and match the dependency source code with a deserialization vulnerability bytecode chain to obtain a first matching result, wherein the deserialization vulnerability bytecode chain is a bytecode containing a plurality of deserialization vulnerabilities; a determining unit, configured to judge whether the communication data utilizes the deserialization vulnerability through the first matching result, and determine the communication data as malicious request data in a case where the communication data utilizes the deserialization vulnerability. The determining unit comprises: a second acquisition module, configured to acquire a programming class name and a programming method name contained in each deserialization vulnerability in the deserialization vulnerability bytecode chain; a judging module, configured to judge whether the programming class name and the programming method name in the dependent source code are same as the programming class name and the programming method name in the deserialization vulnerability; and a second determining module, configured to determine that the communication data applies the deserialization vulnerability in a case where the programming class name and the programming method name in the dependent source code are same as the programming class name and the programming method name in the deserialization vulnerability.

8. A processor, comprising: The processor is configured to run a program, and the program is configured to execute the malicious request detection method in any one of claims 1 to 6 when the program is running.

9. An electronic device, comprising: The apparatus comprises one or more processors and a memory configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the malicious request detection method in any one of claims 1 to 6.

Images