A cross-application dynamic taint tracking method and system

Abstract

The present invention discloses a cross-application dynamic taint tracking method and system, the method comprising: installing a dynamic proxy program for the gateway node of each application in a distributed application cluster; when the distributed application is started, identifying the Web service entrance through the dynamic proxy program, marking the data transmitted from the Web service entrance as tainted data; when the tainted data is transmitted from a certain gateway node to other gateway nodes, marking the target application where the tainted data is located, and transmitting it to the downstream service node of the target application, and continuing to track the tainted data; when the tainted data is returned in the bottom service, the location information of the application through which the tainted data passes is counted, and the comprehensive tracking of the tainted information in the entire distributed application cluster is realized. The tainted data transmitted from the Web service entrance can be automatically tracked by the gateway node, which improves the tracking efficiency and accuracy. The multi-application taint data tracking work can be realized by adaptively tracking and marking the flow application of the tainted data.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed application data management, and in particular to a cross-application dynamic taint tracking method and system. Background Art

[0002] Dynamic taint analysis technology is an effective and practical information flow analysis technology. Dynamic taint analysis technology can be used to more accurately monitor the information flow of applications during operation, such as tracking whether sensitive data is propagated from a preset taint source to a preset security-sensitive operation point. Dynamic taint analysis technology usually consists of three key technical links: taint introduction, taint propagation, and taint verification. Taint introduction means that when reading data from a preset taint source, it is necessary to set a corresponding taint value for the read data. Taint propagation means that in the process of processing tainted data by an application, the taint value is propagated according to the set policy. Taint verification means checking whether the operated data is tainted data at a preset security-sensitive operation point. Nowadays, dynamic taint tracking technology has been widely used in interactive application security testing and sensitive information tracking. With the development of the Internet, computer services have penetrated into people's lives, and the traffic of services is growing. More and more Web services need to use microservices. The existing taint data tracking methods for distributed or cluster applications only track a certain node, which has limitations and cannot effectively track tainted data introduced from the outside world. At the same time, once the tainted data is separated from the current single application, it cannot continue to be tracked and analyzed, which reduces the tracking efficiency and stability. Summary of the invention

[0003] In response to the above-mentioned problems, the present invention provides a cross-application dynamic taint tracking method and system to solve the problem mentioned in the background technology that only tracking a certain node has limitations and cannot effectively track tainted data transmitted from the outside world. At the same time, once the contaminated data leaves the current single application, it cannot be tracked and analyzed anymore, which reduces the tracking efficiency and stability.

[0004] A cross-application dynamic taint tracking method includes the following steps:

[0005] Install a dynamic proxy program for each application gateway node of the distributed application cluster;

[0006] When the distributed application is started, the Web service entry is identified through the dynamic proxy program, and the data passed in from the Web service entry is marked as tainted data;

[0007] When tainted data is transmitted from a gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application to continue tracking the tainted data;

[0008] When the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster.

[0009] Preferably, the step of installing a dynamic proxy program for the gateway node of each application of the distributed application comprises:

[0010] A dynamic management server is deployed on the gateway node of each application in the distributed application cluster, and the functional characteristics of the dynamic management server are set to data incoming detection and marking, and program codes corresponding to data incoming detection and marking are extracted from the code library;

[0011] Writing the program code into the dynamic management server and executing it, and determining whether the program code is compatible with the dynamic management server according to the execution result, if so, confirming that the program code is qualified, and if not, confirming that the program code is unqualified;

[0012] Re-retrieve the data incoming detection and mark related replacement code in the code base and repeat the writing and execution work until the program code is qualified;

[0013] An installation configuration file that runs on the dynamic management server is generated according to the program code, and the dynamic agent program is installed on the dynamic management server according to the installation configuration file.

[0014] Preferably, when the distributed application is started, the Web service entry is identified by the dynamic proxy program, and the data transmitted from the Web service entry is marked as tainted data, including:

[0015] Call the customized identification feature of the Web service portal and send an authorization login request to the current data transmission portal;

[0016] Obtaining authorization service information of the current data transmission entry based on the authorization login request, and obtaining the current identification feature of the current data transmission entry according to the authorization service information;

[0017] comparing the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, starting the dynamic proxy program;

[0018] The dynamic proxy program is used to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

[0019] Preferably, when the tainted data is transmitted from a certain gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application, and the tainted data is continued to be tracked, including:

[0020] Obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set the node identifier for the gateway node of each application according to the upstream and downstream service relationships;

[0021] Use service discovery and load balancing technology to treat services corresponding to different gateway nodes as different microservices.

[0022] Detect whether the tainted data is in the transmission state. If so, attach the tainted data to the ID of the target microservice, and mark the target application where the tainted data is located by performing log analysis and the ID of the target microservice;

[0023] A data transmission protocol between the target application and the downstream service node is determined, the tainted data is transmitted to the downstream service node of the target application according to the data transmission protocol, and the tainted data is continued to be tracked.

[0024] Preferably, when the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster, including:

[0025] Generate distributed tracing tasks based on tainted data, and detect the interaction information between tainted data and microservices of each application in the distributed application cluster according to the distributed tracing tasks;

[0026] Determine the data service closed loop status of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop status;

[0027] If yes, calculate the application location information of the tainted data based on the interaction information between the tainted data and the microservices of each application in the distributed application cluster;

[0028] Based on the application location information of the tainted data, comprehensive tracking of tainted information in the entire distributed application cluster is achieved.

[0029] A cross-application dynamic taint tracking system, the system comprising:

[0030] An installation module is used to install a dynamic proxy program for a gateway node of each application in a distributed application cluster;

[0031] The marking module is used to identify the Web service entrance through the dynamic proxy program after the distributed application is started, and mark the data passed in from the Web service entrance as tainted data;

[0032] A tracking module is used to mark the target application where the tainted data is located when it is transmitted from a certain gateway node to other gateway nodes, and transmit it to the downstream service node of the target application to continue tracking the tainted data;

[0033] The statistics module is used to count the application location information of the tainted data when it is returned by the bottom-level service, so as to achieve comprehensive tracking of the tainted information in the entire distributed application cluster.

[0034] Preferably, the installation module includes:

[0035] A deployment submodule is used to deploy a dynamic management server on the gateway node of each application in the distributed application cluster, set the functional characteristics of the dynamic management server to data incoming detection and marking, and extract the corresponding program code of data incoming detection and marking from the code library;

[0036] A first determination submodule is used to write the program code into the dynamic management server and execute it, and determine whether the program code is compatible with the dynamic management server according to the execution result, and if so, confirm that the program code is qualified, and if not, confirm that the program code is unqualified;

[0037] A retrieval submodule is used to re-retrieve the data input detection and mark related replacement codes in the code base and repeat the writing and execution work until the program code is qualified;

[0038] The installation submodule is used to generate an installation configuration file running on the dynamic management server according to the program code, and install the dynamic agent program on the dynamic management server according to the installation configuration file.

[0039] Preferably, the marking module comprises:

[0040] The calling submodule is used to call the customized identification feature of the Web service entrance and send an authorization login request to the current data transmission entrance;

[0041] An acquisition submodule, used to acquire authorization service information of the current data transmission entry based on the authorization login request, and acquire the current identification feature of the current data transmission entry according to the authorization service information;

[0042] The second determination submodule is used to compare the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, to start the dynamic proxy program;

[0043] The marking submodule is used to use the dynamic proxy program to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

[0044] Preferably, the tracking module includes:

[0045] Set up a submodule to obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set a node identifier for the gateway node of each application according to the upstream and downstream service relationships;

[0046] The confirmation submodule is used to use service discovery and load balancing technology to treat the services corresponding to different gateway nodes as different microservices.

[0047] The parsing submodule is used to detect whether the tainted data is in the transmission state. If so, the tainted data is attached with the ID of the target microservice, and the target application where the tainted data is located is marked by log parsing and the ID of the target microservice;

[0048] The tracking submodule is used to determine the data transmission protocol between the target application and the downstream service node, transmit the tainted data to the downstream service node of the target application according to the data transmission protocol, and continue to track the tainted data.

[0049] Preferably, the statistical module includes:

[0050] A detection submodule is used to generate a distributed tracking task based on the tainted data, and detect the interaction information between the tainted data and the microservices of each application in the distributed application cluster according to the distributed tracking task;

[0051] The third determination submodule is used to determine the data service closed loop situation of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop situation;

[0052] A statistical submodule is used to calculate the application location information of the tainted data according to the interaction information between the tainted data and the microservices of each application in the distributed application cluster;

[0053] The comprehensive tracking submodule is used to achieve comprehensive tracking of tainted information in the entire distributed application cluster based on the application location information of the tainted data.

[0054] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description and the accompanying drawings.

[0055] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0057] Figure 1 A workflow diagram of a cross-application dynamic taint tracking method provided by the present invention;

[0058] Figure 2Another workflow diagram of a cross-application dynamic taint tracking method provided by the present invention;

[0059] Figure 3 A schematic diagram of the structure of a cross-application dynamic taint tracking system provided by the present invention;

[0060] Figure 4 This is a structural schematic diagram of an installation module in a cross-application dynamic taint tracking system provided by the present invention. DETAILED DESCRIPTION

[0061] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0062] Dynamic taint analysis technology is an effective and practical information flow analysis technology. Dynamic taint analysis technology can be used to more accurately monitor the information flow of applications during operation, such as tracking whether sensitive data is propagated from a preset taint source to a preset security-sensitive operation point. Dynamic taint analysis technology usually consists of three key technical links: taint introduction, taint propagation, and taint verification. Taint introduction means that when reading data from a preset taint source, it is necessary to set a corresponding taint value for the read data. Taint propagation means that in the process of processing tainted data by an application, the taint value is propagated according to the set policy. Taint verification means checking whether the operated data is tainted data at a preset security-sensitive operation point. Nowadays, dynamic taint tracking technology has been widely used in interactive application security testing and sensitive information tracking. With the development of the Internet, computer services have penetrated into people's lives, and the traffic of services is growing. More and more Web services need to use microservices. The existing taint data tracking methods for distributed or cluster applications only track a certain node, which has limitations and cannot effectively track tainted data introduced from the outside world. At the same time, once the tainted data is separated from the current single application, it cannot continue to be tracked and analyzed, which reduces the tracking efficiency and stability. In order to solve the above problem, this embodiment discloses a cross-application dynamic taint tracking method.

[0063] A dynamic taint tracking method across applications, such as Figure 1 As shown, the following steps are included:

[0064] Step S101: installing a dynamic proxy program for each application gateway node of a distributed application cluster;

[0065] Step S102: When the distributed application is started, the Web service entry is identified through the dynamic proxy program, and the data transmitted from the Web service entry is marked as tainted data;

[0066] Step S103: When the tainted data is transmitted from a certain gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application to continue tracking the tainted data;

[0067] Step S104: When the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster.

[0068] In this embodiment, the dynamic agent is represented by a software program for identifying tainted data.

[0069] The working principle of the above technical solution is as follows: a dynamic proxy program is installed for the gateway node of each application in the distributed application cluster; when the distributed application is started, the Web service entrance is identified through the dynamic proxy program, and the data transmitted from the Web service entrance is marked as tainted data; when the tainted data is transmitted from a gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application to continue tracking the tainted data; when the tainted data is returned at the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster.

[0070] The beneficial effects of the above technical solution are: by installing a dynamic agent program for the gateway node of each application, the tainted data transmitted by the Web service entrance can be automatically tracked through the gateway node, thereby improving the tracking efficiency and accuracy. Furthermore, by adaptively tracking and marking the flow application of tainted data, multi-application tainted data tracking can be achieved, further improving the tracking efficiency and tracking stability, and solving the problem mentioned in the prior art that only tracking a certain node has limitations and cannot effectively track tainted data transmitted from the outside world. At the same time, once the contaminated data is separated from the current single application, it cannot continue to be tracked and analyzed, reducing the tracking efficiency and stability.

[0071] In one embodiment, Figure 2 As shown, the step of installing a dynamic proxy program on the gateway node of each application of the distributed application includes:

[0072] Step S201: deploy a dynamic management server on the gateway node of each application in the distributed application cluster, set the functional characteristics of the dynamic management server to data incoming detection and marking, and extract the corresponding program code of data incoming detection and marking from the code library;

[0073] Step S202, writing the program code into the dynamic management server and executing it, and determining whether the program code is compatible with the dynamic management server according to the execution result, if so, confirming that the program code is qualified, if not, confirming that the program code is unqualified;

[0074] Step S203, re-searching the replacement code related to the data incoming detection and marking in the code library and repeating the writing and execution work until the program code is qualified;

[0075] Step S204: Generate an installation configuration file that runs on the dynamic management server according to the program code, and install the dynamic agent program on the dynamic management server according to the installation configuration file.

[0076] The beneficial effects of the above technical solution are: by testing whether the program code is compatible with the dynamic management server, the operating stability and compatibility of the dynamic management server can be guaranteed. Furthermore, by generating an installation configuration file, the installation success rate and stability on the dynamic management server can be guaranteed, further improving practicality and reliability.

[0077] In one embodiment, when the distributed application is started, the Web service entry is identified by the dynamic proxy program, and the data passed in from the Web service entry is marked as tainted data, including:

[0078] Call the customized identification feature of the Web service portal and send an authorization login request to the current data transmission portal;

[0079] Obtaining authorization service information of the current data transmission entry based on the authorization login request, and obtaining the current identification feature of the current data transmission entry according to the authorization service information;

[0080] comparing the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, starting the dynamic proxy program;

[0081] The dynamic proxy program is used to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

[0082] The beneficial effects of the above technical solution are: it can accurately determine whether the current data transmission interface is a Web service entrance, thereby improving the determination efficiency and accuracy. Furthermore, by synchronously downloading the data source and marking it, it is possible to retain the backup of the tainted data while also laying the foundation for its subsequent tracking, further improving the practicality.

[0083] In one embodiment, when the tainted data is transmitted from a certain gateway node to another gateway node, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application, and the tainted data is continued to be tracked, including:

[0084] Obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set a node identifier for the gateway node of each application based on the upstream and downstream service relationships;

[0085] Use service discovery and load balancing technology to treat services corresponding to different gateway nodes as different microservices.

[0086] Detect whether the tainted data is in the transmission state. If so, attach the tainted data to the ID of the target microservice, and mark the target application where the tainted data is located by performing log analysis and the ID of the target microservice;

[0087] A data transmission protocol between the target application and the downstream service node is determined, the tainted data is transmitted to the downstream service node of the target application according to the data transmission protocol, and the tainted data is continued to be tracked.

[0088] The beneficial effects of the above technical solution are: by determining the flow of tainted data between various applications based on the usage status of microservices, the tracking accuracy is improved while the service status between various applications can be intuitively determined, which indirectly realizes application monitoring and further improves practicality. Furthermore, by determining the data transmission protocol between the target application and the downstream service node, the tainted data is transmitted to the downstream service node of the target application according to the data transmission protocol to ensure the stability and reliability of data transmission.

[0089] In one embodiment, when the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster, including:

[0090] Generate distributed tracing tasks based on tainted data, and detect the interaction information between tainted data and microservices of each application in the distributed application cluster according to the distributed tracing tasks;

[0091] Determine the data service closed loop status of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop status;

[0092] If yes, calculate the application location information of the tainted data based on the interaction information between the tainted data and the microservices of each application in the distributed application cluster;

[0093] Based on the application location information of the tainted data, comprehensive tracking of tainted information in the entire distributed application cluster is achieved.

[0094] The beneficial effect of the above technical solution is that the application through which the tainted data flows can be quickly determined through microservice interaction information, thereby improving tracking accuracy.

[0095] In this embodiment, determining the data service closed loop status of tainted data in a distributed application cluster includes:

[0096] Analyze the data service process of tainted data to determine monitoring tasks;

[0097] Construct an action timing monitoring strategy for tainted data based on the data characteristics of the tainted data according to the monitoring task;

[0098] Construct a service process tracking model for tainted data based on action timing monitoring strategy;

[0099] Obtain the API interface parameters of each distributed application in the distributed application cluster, and set the API access semantic information of each distributed application according to the API interface parameters;

[0100] Parse the configuration access file of each distributed application according to the API access semantic information of the distributed application to obtain the data mapping rules between each distributed application;

[0101] Generate an initial trace file of tainted data in each distributed application based on data mapping rules;

[0102] Obtain data features of the tainted data, modify the initial tracking file according to the data features, and generate a target tracking file;

[0103] The service process tracking model is used to detect the service status of tainted data in the distributed application cluster according to the target tracking file;

[0104] The data service closed loop status of the tainted data in the distributed application cluster is determined according to the service status.

[0105] The beneficial effects of the above technical solution are: by constructing a service process tracking model for tainted data, a unique dynamic tracking model can be constructed based on the data characteristics of the tainted data to ensure tracking efficiency and stability. Furthermore, by generating tracking files based on the mapping rules of tainted data in different distributed applications, accurate tracking of tainted data services in different distributed applications can be further guaranteed, thereby improving practicality and reliability.

[0106] In one embodiment, this embodiment also discloses a cross-application dynamic taint tracking system, such as Figure 3 As shown, the system includes:

[0107] An installation module 301 is used to install a dynamic proxy program for a gateway node of each application of a distributed application cluster;

[0108] The marking module 302 is used to identify the Web service entry through the dynamic proxy program after the distributed application is started, and mark the data introduced from the Web service entry as tainted data;

[0109] The tracking module 303 is used to mark the target application where the tainted data is located when the tainted data is transmitted from a certain gateway node to other gateway nodes, and transmit it to the downstream service node of the target application to continue tracking the tainted data;

[0110] The statistics module 304 is used to count the application location information of the tainted data when the tainted data is returned by the bottom-level service, so as to achieve comprehensive tracking of the tainted information in the entire distributed application cluster.

[0111] The working principle of the above technical solution is: first, a dynamic proxy program is installed for the gateway node of each application in the distributed application cluster through the installation module; secondly, a marking module is used to identify the Web service entrance through the dynamic proxy program after the distributed application is started, and the data transmitted from the Web service entrance is marked as tainted data; then, through the tracking module, when the tainted data is transmitted from a certain gateway node to other gateway nodes, the target application where the tainted data is located is marked, and it is transmitted to the downstream service node of the target application to continue tracking the tainted data; finally, the statistical module is used to count the application location information of the tainted data when the tainted data is returned at the bottom service, so as to realize comprehensive tracking of tainted information in the entire distributed application cluster.

[0112] The beneficial effects of the above technical solution are: by installing a dynamic agent program for the gateway node of each application, the taint data transmitted by the Web service entrance can be automatically tracked through the gateway node, thereby improving the tracking efficiency and accuracy. Furthermore, by adaptively tracking and marking the flow of taint data in the application, multi-application taint data tracking can be achieved, further improving the tracking efficiency and tracking stability.

[0113] In one embodiment, Figure 4 As shown, the installation module 301 includes:

[0114] The deployment submodule 3011 is used to deploy a dynamic management server on the gateway node of each application in the distributed application cluster, set the functional characteristics of the dynamic management server to data incoming detection and marking, and extract the corresponding program code of data incoming detection and marking from the code library;

[0115] The first determination submodule 3012 is used to write the program code into the dynamic management server and execute it, and determine whether the program code is compatible with the dynamic management server according to the execution result. If so, confirm that the program code is qualified, and if not, confirm that the program code is unqualified;

[0116] The retrieval submodule 3013 is used to re-retrieve the replacement code related to the data input detection and marking in the code library and repeat the writing and execution work until the program code is qualified;

[0117] The installation submodule 3014 is used to generate an installation configuration file running on the dynamic management server according to the program code, and install the dynamic agent program on the dynamic management server according to the installation configuration file.

[0118] The beneficial effects of the above technical solution are: by testing whether the program code is compatible with the dynamic management server, the operating stability and compatibility of the dynamic management server can be guaranteed. Furthermore, by generating an installation configuration file, the installation success rate and stability on the dynamic management server can be guaranteed, further improving practicality and reliability.

[0119] In one embodiment, the marking module comprises:

[0120] The calling submodule is used to call the customized identification feature of the Web service entrance and send an authorization login request to the current data transmission entrance;

[0121] An acquisition submodule, used to acquire authorization service information of the current data transmission entry based on the authorization login request, and acquire the current identification feature of the current data transmission entry according to the authorization service information;

[0122] The second determination submodule is used to compare the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, to start the dynamic proxy program;

[0123] The marking submodule is used to use the dynamic proxy program to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

[0124] The beneficial effects of the above technical solution are: it can accurately determine whether the current data transmission interface is a Web service entrance, thereby improving the determination efficiency and accuracy. Furthermore, by synchronously downloading the data source and marking it, it is possible to retain the backup of the tainted data while also laying the foundation for its subsequent tracking, further improving the practicality.

[0125] In one embodiment, the tracking module includes:

[0126] Set up a submodule to obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set a node identifier for the gateway node of each application according to the upstream and downstream service relationships;

[0127] The confirmation submodule is used to use service discovery and load balancing technology to treat the services corresponding to different gateway nodes as different microservices.

[0128] The parsing submodule is used to detect whether the tainted data is in the transmission state. If so, the tainted data is attached with the ID of the target microservice, and the target application where the tainted data is located is marked by log parsing and the ID of the target microservice;

[0129] The tracking submodule is used to determine the data transmission protocol between the target application and the downstream service node, transmit the tainted data to the downstream service node of the target application according to the data transmission protocol, and continue to track the tainted data.

[0130] The beneficial effects of the above technical solution are: by determining the flow of tainted data between various applications based on the usage status of microservices, the tracking accuracy is improved while the service status between various applications can be intuitively determined, which indirectly realizes application monitoring and further improves practicality. Furthermore, by determining the data transmission protocol between the target application and the downstream service node, the tainted data is transmitted to the downstream service node of the target application according to the data transmission protocol to ensure the stability and reliability of data transmission.

[0131] In one embodiment, the statistics module includes:

[0132] A detection submodule is used to generate a distributed tracking task based on the tainted data, and detect the interaction information between the tainted data and the microservices of each application in the distributed application cluster according to the distributed tracking task;

[0133] The third determination submodule is used to determine the data service closed loop situation of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop situation;

[0134] A statistical submodule is used to calculate the application location information of the tainted data according to the interaction information between the tainted data and the microservices of each application in the distributed application cluster;

[0135] The comprehensive tracking submodule is used to achieve comprehensive tracking of tainted information in the entire distributed application cluster based on the application location information of the tainted data.

[0136] The beneficial effect of the above technical solution is that the application through which the tainted data flows can be quickly determined through microservice interaction information, thereby improving tracking accuracy.

[0137] Those skilled in the art should understand that the first and second in the present invention merely refer to different application stages.

[0138] Other embodiments of the present disclosure will be readily apparent to those skilled in the art after considering the specification and practicing the disclosure disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0139] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A cross-application dynamic taint tracking method, characterized in that: The following steps are involved: Install a dynamic proxy program for each application gateway node of the distributed application cluster; When the distributed application is started, the Web service entry is identified through the dynamic proxy program, and the data passed in from the Web service entry is marked as tainted data; When tainted data is transmitted from a gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application to continue tracking the tainted data; When the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of tainted information in the entire distributed application cluster; When the tainted data is returned by the bottom-level service, the application location information of the tainted data is counted to achieve comprehensive tracking of the tainted information in the entire distributed application cluster, including: Generate distributed tracing tasks based on tainted data, and detect the interaction information between tainted data and microservices of each application in the distributed application cluster according to the distributed tracing tasks; Determine the data service closed loop status of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop status; If yes, calculate the application location information of the tainted data based on the interaction information between the tainted data and the microservices of each application in the distributed application cluster; Based on the application location information of the tainted data, comprehensive tracking of tainted information in the entire distributed application cluster is achieved; Determine the data service closed loop of tainted data in the distributed application cluster, including: Analyze the data service process of tainted data to determine monitoring tasks; Construct an action timing monitoring strategy for tainted data based on the data characteristics of the tainted data according to the monitoring task; Construct a service process tracking model for tainted data based on action timing monitoring strategy; Obtain the API interface parameters of each distributed application in the distributed application cluster, and set the API access semantic information of each distributed application according to the API interface parameters; Parse the configuration access file of each distributed application according to the API access semantic information of the distributed application to obtain the data mapping rules between each distributed application; Generate an initial trace file of tainted data in each distributed application based on data mapping rules; Obtain data features of the tainted data, modify the initial tracking file according to the data features, and generate a target tracking file; The service process tracking model is used to detect the service status of tainted data in the distributed application cluster according to the target tracking file; The data service closed loop status of the tainted data in the distributed application cluster is determined according to the service status.

2. The cross-application dynamic taint tracking method according to claim 1, characterized in that: The step of installing a dynamic proxy program on the gateway node of each application of the distributed application includes: A dynamic management server is deployed on the gateway node of each application in the distributed application cluster, and the functional characteristics of the dynamic management server are set to data incoming detection and marking, and program codes corresponding to data incoming detection and marking are extracted from the code library; Writing the program code into the dynamic management server and executing it, and determining whether the program code is compatible with the dynamic management server according to the execution result, if so, confirming that the program code is qualified, and if not, confirming that the program code is unqualified; Re-retrieve the data incoming detection and mark related replacement code in the code base and repeat the writing and execution work until the program code is qualified; An installation configuration file that runs on the dynamic management server is generated according to the program code, and the dynamic agent program is installed on the dynamic management server according to the installation configuration file.

3. The cross-application dynamic taint tracking method according to claim 1, characterized in that: When the distributed application is started, the Web service entry is identified through the dynamic proxy program, and the data passed in from the Web service entry is marked as tainted data, including: Call the customized identification feature of the Web service portal and send an authorization login request to the current data transmission portal; Obtaining authorization service information of the current data transmission entry based on the authorization login request, and obtaining the current identification feature of the current data transmission entry according to the authorization service information; comparing the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, starting the dynamic proxy program; The dynamic proxy program is used to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

4. The cross-application dynamic taint tracking method according to claim 1, characterized in that: When the tainted data is transmitted from a certain gateway node to other gateway nodes, the target application where the tainted data is located is marked and transmitted to the downstream service node of the target application, and the tainted data is continued to be tracked, including: Obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set a node identifier for the gateway node of each application based on the upstream and downstream service relationships; Use service discovery and load balancing technology to treat services corresponding to different gateway nodes as different microservices. Detect whether the tainted data is in the transmission state. If so, attach the tainted data to the ID of the target microservice, and mark the target application where the tainted data is located by performing log analysis and the ID of the target microservice; A data transmission protocol between the target application and the downstream service node is determined, the tainted data is transmitted to the downstream service node of the target application according to the data transmission protocol, and the tainted data is continued to be tracked.

5. A cross-application dynamic taint tracking system, characterized in that: The system includes: An installation module is used to install a dynamic proxy program for a gateway node of each application in a distributed application cluster; The marking module is used to identify the Web service entrance through the dynamic proxy program after the distributed application is started, and mark the data passed in from the Web service entrance as tainted data; A tracking module is used to mark the target application where the tainted data is located when it is transmitted from a certain gateway node to other gateway nodes, and transmit it to the downstream service node of the target application to continue tracking the tainted data; The statistics module is used to count the application location information of the tainted data when it is returned by the bottom-level service, so as to achieve comprehensive tracking of the tainted information in the entire distributed application cluster; The statistical module comprises: A detection submodule is used to generate a distributed tracking task based on the tainted data, and detect the interaction information between the tainted data and the microservices of each application in the distributed application cluster according to the distributed tracking task; The third determination submodule is used to determine the data service closed loop situation of the tainted data in the distributed application cluster, and determine whether the tainted data is in the bottom layer service according to the data service closed loop situation; A statistical submodule is used to calculate the application location information of the tainted data according to the interaction information between the tainted data and the microservices of each application in the distributed application cluster; The comprehensive tracking submodule is used to achieve comprehensive tracking of tainted information in the entire distributed application cluster based on the application location information of the tainted data; Determine the data service closed loop of tainted data in the distributed application cluster, including: Analyze the data service process of tainted data to determine monitoring tasks; Construct an action timing monitoring strategy for tainted data based on the data characteristics of the tainted data according to the monitoring task; Construct a service process tracking model for tainted data based on action timing monitoring strategy; Obtain the API interface parameters of each distributed application in the distributed application cluster, and set the API access semantic information of each distributed application according to the API interface parameters; Parse the configuration access file of each distributed application according to the API access semantic information of the distributed application to obtain the data mapping rules between each distributed application; Generate an initial trace file of tainted data in each distributed application based on data mapping rules; Obtain data features of the tainted data, modify the initial tracking file according to the data features, and generate a target tracking file; The service process tracking model is used to detect the service status of tainted data in the distributed application cluster according to the target tracking file; The data service closed loop status of the tainted data in the distributed application cluster is determined according to the service status.

6. The cross-application dynamic taint tracking system according to claim 5, characterized in that: The installation module comprises: A deployment submodule is used to deploy a dynamic management server on the gateway node of each application in the distributed application cluster, set the functional characteristics of the dynamic management server to data incoming detection and marking, and extract the corresponding program code of data incoming detection and marking from the code library; A first determination submodule is used to write the program code into the dynamic management server and execute it, and determine whether the program code is compatible with the dynamic management server according to the execution result, and if so, confirm that the program code is qualified, and if not, confirm that the program code is unqualified; A retrieval submodule is used to re-retrieve the data input detection and mark related replacement codes in the code base and repeat the writing and execution work until the program code is qualified; The installation submodule is used to generate an installation configuration file running on the dynamic management server according to the program code, and install the dynamic agent program on the dynamic management server according to the installation configuration file.

7. The cross-application dynamic taint tracking system according to claim 5, characterized in that: The marking module comprises: The calling submodule is used to call the customized identification feature of the Web service entrance and send an authorization login request to the current data transmission entrance; An acquisition submodule, used to acquire authorization service information of the current data transmission entry based on the authorization login request, and acquire the current identification feature of the current data transmission entry according to the authorization service information; The second determination submodule is used to compare the customized identification feature with the customized identification feature to determine whether the current data transmission entry is a Web service entry, and if so, to start the dynamic proxy program; The marking submodule is used to use the dynamic proxy program to detect the data input timing of the Web service entrance and synchronously download the data source and mark the data source as tainted data.

8. The cross-application dynamic taint tracking system according to claim 5, characterized in that: The tracking module comprises: Set up a submodule to obtain the upstream and downstream service relationships of each application in the distributed application cluster, and set a node identifier for the gateway node of each application according to the upstream and downstream service relationships; The confirmation submodule is used to use service discovery and load balancing technology to treat the services corresponding to different gateway nodes as different microservices. The parsing submodule is used to detect whether the tainted data is in the transmission state. If so, the tainted data is attached with the ID of the target microservice, and the target application where the tainted data is located is marked by log parsing and the ID of the target microservice; The tracking submodule is used to determine the data transmission protocol between the target application and the downstream service node, transmit the tainted data to the downstream service node of the target application according to the data transmission protocol, and continue to track the tainted data.

Images