An attack protection system based on RASP

Abstract

The present invention discloses an attack protection system based on RASP, which relates to the technical field of security protection, and comprises: a business layer, which adopts metadata to perform data modeling and establish a screening model, wherein the screening model comprises at least one virtual interaction layer, wherein the virtual interaction layer is used to feedback the interaction behavior of the user, and the screening model obtains the user request information and the terminal device fingerprint, and determines the user identity; an application layer, which comprises a business system, and provides application support for users at all levels and layers through tables, views, files and messages; an integration layer, which identifies the interaction behavior between the user and the virtual interaction layer, and determines the noise in the interaction behavior through the user's final operation, and simplifies the interaction behavior into necessary behaviors; the present invention establishes a three-dimensional deception defense system, screens users who perform data interaction, monitors the behavior in the data interaction process through RASP probes, and determines whether the user is an attacker according to the request content and the terminal device fingerprint.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and in particular to an attack protection system based on RASP. Background Art

[0002] RASP (Runtime Application Self-Protection) is a new application security protection technology. It injects protection programs into applications like vaccines, integrates applications, and can detect and block security attacks in real time, giving applications the ability to protect themselves. When an application is actually attacked, it can automatically defend itself without manual intervention.

[0003] In the current context of new power system construction, attack methods emerge in an endless stream, along with the spread of zombie worms, system 0day threats, APT attacks, and social engineering attacks. Faced with a variety of attack methods and difficult-to-defend combined attack chains, traditional detection and defense technologies based on feature matching are difficult to effectively detect attacks.

[0004] Deception defense is based on the attacker's behavioral preferences, setting multiple traps on the attack path to entrap the attacker. Traditional security based on rule features has a relatively high false positive rate, while deception defense detects attack behaviors based on behavioral preferences, with higher accuracy and basically no false positives. Compared with the passive defense of traditional security, deception defense is an active defense, which can effectively complement traditional security measures and build a more secure defense system for enterprises.

[0005] Announcement No. CN114091039A discloses a RASP-based attack protection patch method and system, and the adopted technical solution is: the system includes a Web application end, a Server control end, and the Server control end includes a Portal end and an analysis engine; the method is: loading a probe on the Web application end to exchange real-time data with the Server control end; setting a security protection patch on the Portal end, wherein the security protection patch can set the patch name, the relevant description of the patch, the URL to be blocked, the parameter setting and parameter matching of the blocked URL, and other information; after the security protection patch is set, the Server control end automatically sends the security protection patch to the probe loaded on the web application end to form effective protection, and the analysis engine receives the real-time protection information generated at the probe and summarizes it into attack event information and returns it to the Portal end for display for users to make relevant decisions. The present invention uses RASP technology to protect online applications in real time, and realizes the real-time nature of attack protection.

[0006] Currently, the server-side management configuration of honeypots is mainly used to achieve basic deception defense capabilities, but there are still some limitations. Mainly including:

[0007] 1. The integration degree with the main and auxiliary business systems is not high, the business simulation degree is poor, the honeypot container is identified by the attacker, and the success rate of trapping is not high.

[0008] 2. The deception defense capability is single and has not formed a three-dimensional global deception capability.

[0009] 3. After discovering the attacker, in addition to tracing the source based on IP and phishing, it is impossible to conduct further tracking and analysis of the entire attack team’s attack time cycle behavior Summary of the invention

[0010] One of the purposes of the present invention is to provide an attack protection system based on RASP. By establishing a three-dimensional deception defense system, when an attacker attacks, the identity of the attacker in the data interaction process is determined by inducing the attacker to attack, and the degree of danger of the attacker is determined according to the attacker's attack on sensitive paths. During the attacker's attack, the identity of the attacker is traced.

[0011] To achieve the above objectives, the present invention is implemented through the following technical solutions: an attack protection system based on RASP, comprising:

[0012] The business layer uses metadata to model data and establish a screening model. The screening model includes at least one virtual interaction layer, which is used to feedback the user's interactive behavior. The screening model obtains user request information and terminal device fingerprints to determine the user's identity.

[0013] The application layer, including business systems, provides application support for users at all levels and layers through tables, views, files, and messages;

[0014] The integration layer adopts a bottom-up modeling approach to uniformly clean, encode, check compliance, and post-form the data. It identifies the interaction between the user and the virtual interaction layer, and determines the noise in the interaction through the user's final operation, thus simplifying the interaction into necessary behaviors.

[0015] The interface layer stores data from the business layer and sets real-time and delayed interfaces to implement interaction between the integration layer and the application layer;

[0016] The business layer also includes a collection unit, which includes a RASP probe and a dense network probe. The RASP probe and the dense network probe monitor the interaction between the user and the screening model in real time.

[0017] In one or more embodiments of the present invention, the real-time interface and the delayed interface of the interface layer are used to connect the application layer and the integration layer respectively. The real-time interface is connected to the application layer to realize real-time transmission between the business system and the interface layer. The delayed interface is connected to the integration layer to form delayed data transmission between the integration layer and the interface layer. When the virtual interaction layer issues a call instruction, the integration layer calls the interface layer data in real time.

[0018] In one or more embodiments of the present invention, the screening model includes at least one honeypot network established by multiple sensitive paths of the business system, the honeypot network includes multiple sub-honeypots, and the sub-honeypots are connected to each other, and the honeypot network simulates the functions and behaviors of the business system;

[0019] Each sub-honeypot contains at least one sensitive path. A dense network probe is placed inside each sub-honeypot to monitor the status of the sensitive path, obtain the attacker's attack time and generate an attack log. When a sub-honeypot is attacked, the honeypot connected to the attacked sub-honeypot induces the attacker to attack by exposing the sensitive path.

[0020] In one or more embodiments of the present invention, the honeypot network also includes a simulation page based on the business system. The screening model implants probe code at a specific position of the screening model established by the business system through the RASP bytecode program insertion technology to form a RASP probe. When the attacker's request is monitored, an induced web path that does not exist in the virtual interaction layer is added under the domain name in the screening model by forging a response. When the attacker accesses the induced web path, he jumps to the simulation page of the honeypot network.

[0021] In one or more embodiments of the present invention, the attacker tracing method is as follows:

[0022] When the terminal browser requests data, a JS script is loaded to obtain the terminal device fingerprint information;

[0023] The user sends an HTTP request through the browser, and the Web business system returns an HTML page with a fingerprint collection script;

[0024] The browser automatically executes JavaScript scripts to render the page, collects browser information and uploads it to the business system;

[0025] Based on the fact that the same fingerprint collection script has the same execution results on the same device browser, users are tracked and their behavior is analyzed through fingerprint matching algorithms.

[0026] In one or more embodiments of the present invention, the honeypot network can realize the attacker's password cracking, vulnerability exploitation, and lateral movement of attacks, obtain the attacker's behavior through the honeypot probe, and analyze the attacker's attack methods and strategies;

[0027] The RASP probe set in the screening model is used to monitor the user's interaction requests, determine the user's risk weight based on the user's interaction requests, and analyze whether the user is an attacker.

[0028] In one or more embodiments of the present invention, the method for determining the user risk weight is as follows:

[0029] Obtain user request type, request frequency, request content, user behavior, and terminal device fingerprint to identify whether the request content and user behavior are dangerous;

[0030] Determine whether the user request type contains sensitive paths and determine the weight value of each sensitive path;

[0031] Calculate the user request frequency weight value;

[0032] Get whether the terminal device fingerprint is recorded;

[0033] Determine the final weight value.

[0034] In one or more embodiments of the present invention, the user risk weight value W is calculated as follows:

[0035] W = 1.x*R+i(y*T)+l*k;

[0036] Among them, x is the number of malicious requests sent by the user in the past, R is the total weight of the sensitive path, T is the weight of the user's abnormal request, y is the number of abnormal requests of the user, l is the number of normal requests of the user, and k is the weight of the normal request of the user;

[0037] The total sensitive path weight R is the sum of all sensitive path weights included in the user request type, R = r1 + r2 + ... + r n .

[0038] In one or more embodiments of the present invention, in the calculation of the user risk weight value W, the user's normal request weight value is a negative value, and the weight value of each sensitive path changes with the access to the sensitive path. The maximum weight value of the sensitive path is 1 and the minimum is 0.2. The weight value of the sensitive path is modified once in a while, and the weight value of the sensitive path is adjusted according to the number of times the sensitive path is requested.

[0039] In one or more embodiments of the present invention, the integration layer obtains the interaction behavior between the user and the virtual interaction layer, and determines the data change result generated after the user interacts with the virtual interaction layer, and simplifies the interaction behavior according to the data change result, the steps are as follows:

[0040] Obtain user interaction behavior and determine the results of data changes;

[0041] Determine necessary actions based on the user's initial interaction behavior and data change results;

[0042] Merge the same interactive behaviors without data change results to eliminate the noise in the interactive behaviors;

[0043] Determine necessary action steps and monitor them to ensure the safety of necessary actions;

[0044] The necessary actions are transmitted to the interface layer, which is then transmitted to the application layer and replicated by the business system.

[0045] Through the above technical solution, the present invention has the following beneficial effects:

[0046] 1. The present invention establishes a three-dimensional deception defense system, screens users who interact with data, monitors the behavior during the data interaction process through RASP probes, determines whether the user is an attacker based on the request content and the terminal device fingerprint, and after determining the attacker, traces the attacker based on the terminal fingerprint technology and generates an attacker portrait, which facilitates the defender's forensic investigation and tracing of the attacker.

[0047] 2. Establish a screening model based on the business system, establish a honeypot network by simulating sensitive paths in the business system, disguise and pull data interaction behaviors that have abnormal behaviors, improve the success rate of entrapment, and continuously guide attackers to discover new sensitive paths during the attack process, thereby confusing the attacker's attack target.

[0048] 3. In the process of confusing the attacker's target, the terminal fingerprint technology is combined to realize the fingerprint extraction of the attacker's attack device, accurate perception, and support for the stringing and merging of cases in the tracing work, while continuously providing new sensitive paths to extend the attacker's attack time. By restoring the attack process, the attacker's identity is traced and traced to form a portrait of the attacker.

[0049] 4. The screening model includes an interaction layer. When the user needs to interact with the business system, the interaction layer in the screening model will perform the interaction operation. The security of the interaction process is determined based on the user's interaction behavior. After determining that the interaction process is safe, the user's interaction behavior is streamlined, and then the streamlined necessary behavior is replicated into the business system to realize interactive operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 It is a schematic diagram of the system of the present invention;

[0051] Figure 2 A schematic diagram of interconnection paths of sub-honeypots of the present invention;

[0052] Figure 3 A schematic diagram of inducing an attacker according to the present invention;

[0053] Figure 4 It is a schematic diagram of the fingerprint tracking and tracing model of the present invention. DETAILED DESCRIPTION

[0054] The following will disclose multiple embodiments of the present invention with the accompanying drawings. For the purpose of clear description, many practical details will be described together in the following description. However, it should be understood that these practical details should not be used to limit the present invention. In other words, in some embodiments of the present invention, these practical details are not necessary. And if it is possible to implement, the features of different embodiments can be applied interchangeably.

[0055] Unless otherwise defined, all words (including technical and scientific terms) used herein have their usual meanings, which can be understood by those familiar with this field. Furthermore, the definitions of the above words in commonly used dictionaries should be interpreted as the meanings consistent with the relevant fields of the present invention in the content of this specification. Unless otherwise clearly defined, these words will not be interpreted as idealized or overly formal meanings.

[0056] See also Figure 1 The present invention provides an attack protection system based on RASP, which screens users who access the business system by establishing a three-dimensional deception defense system, determines whether the user is an attacker, and traces the attacker.

[0057] In one embodiment, the attack protection system includes:

[0058] The business layer uses metadata to model data and establish a screening model. The screening model includes at least one virtual interaction layer, which is used to feedback the user's interactive behavior. The screening model obtains user request information and terminal device fingerprints to determine the user's identity.

[0059] The application layer, including business systems, provides application support for users at all levels and layers through tables, views, files, and messages;

[0060] The integration layer adopts a bottom-up modeling approach to uniformly clean, encode, check compliance, and post-form the data. It identifies the interaction between the user and the virtual interaction layer, and determines the noise in the interaction through the user's final operation, thus simplifying the interaction into necessary behaviors.

[0061] The interface layer stores data from the business layer and sets real-time and delayed interfaces to implement interaction between the integration layer and the application layer;

[0062] The business layer also includes a collection unit, which includes a RASP probe and a dense network probe. The RASP probe and the dense network probe monitor the interaction between the user and the screening model in real time.

[0063] In this embodiment, RASP probes and dense network probes are set to monitor users, and the user's identity information is determined based on the data interaction achieved by the user's behavior, and it is analyzed whether the user is an attacker. The user interacts through the virtual interaction layer in the screening model, and the screening model cannot directly interact with the business system. The user's operations after entering the screening model will not affect the business system, thereby ensuring the security of the business system.

[0064] In order to ensure the stability of the business system and avoid paralysis when the number of interactions is large, the integration layer is used to remove noise in user interaction behaviors, streamline user interaction behaviors, reduce unnecessary interactions, reduce the pressure on the business system, and retain the necessary behaviors to achieve the ultimate goal. As for user queries, real-time data transmission between the business layer and the application layer is realized to support user queries.

[0065] In one embodiment, the real-time interface and the delayed interface of the interface layer are used to connect the application layer and the integration layer respectively. The real-time interface is connected to the application layer to realize real-time transmission between the business system and the interface layer. The delayed interface is connected to the integration layer to form delayed data transmission between the integration layer and the interface layer. When the virtual interaction layer issues a call instruction, the integration layer calls the interface layer data in real time.

[0066] In this embodiment, through delayed transmission between the interface layer and the integration layer, when in use, delayed transmission can avoid real-time data transmission between the business layer and the application layer, and prevent attackers from directly entering the business system from the business layer. When the user queries the required information through the virtual interaction layer, the interaction layer issues an instruction. After the instruction is transmitted to the integration layer, the integration layer integrates the content of the retrieved data and feeds it back to the interface layer. The interface layer transmits the queried data to the integration layer, thereby realizing real-time data query.

[0067] like Figure 2 As shown, in one embodiment, the screening model includes at least one honeypot network established by multiple sensitive paths of the business system, the honeypot network includes multiple sub-honeypots, and the sub-honeypots are connected to each other, and the honeypot network simulates the functions and behaviors of the business system;

[0068] Each sub-honeypot contains at least one sensitive path. A dense network probe is placed inside each sub-honeypot to monitor the status of the sensitive path, obtain the attacker's attack time and generate an attack log. When a sub-honeypot is attacked, the honeypot connected to the attacked sub-honeypot induces the attacker to attack by exposing the sensitive path.

[0069] In this embodiment, by establishing a honeypot network containing sensitive paths, when the user enters the screening model to interact with data, the attacker hidden in the user will be induced to attack the sub-honeypot, and the honeypot probe will monitor each sub-honeypot to obtain the status of the sensitive path, and determine the attacker's attack time according to the status of the sensitive path.

[0070] Optionally, sensitive paths can be: / admin, / upload, / database, / bak and other sensitive paths that attackers are interested in, and the sensitive paths in the honeypot network can be replaced with any content that attackers are interested in. The honeypot network established by the sensitive paths of the business system only contains path data and does not contain any valuable real information and resources.

[0071] Alternatively, in order to ensure the non-repetitiveness of the honeypot network, the sensitive paths in the sub-honeypot are adjusted through automatic updating. After a period of time, the sensitive paths contained in the sub-honeypot are modified / replaced to avoid duplication of sensitive paths within the sub-honeypot, thereby reducing the attractiveness to attackers.

[0072] In one embodiment, the honeypot network also includes a simulation page based on the business system. The screening model implants probe code at a specific position of the screening model established by the business system through the RASP bytecode program instrumentation technology to form a RASP probe. When the attacker's request is monitored, an induced web path that does not exist in the virtual interaction layer is added under the domain name in the screening model by forging a response. When the attacker accesses the induced web path, he jumps to the simulation page of the honeypot network.

[0073] In this embodiment, an induced web path is established to cause the attacker to jump to a simulation page, making it impossible for the attacker to distinguish the authenticity, thereby improving the simulation degree of the business system and solving the problem that the existing honeypot network is easily identified by attackers. After the attacker enters the screening model and bypasses the honeypot network, he will be monitored by the RASP probe. When the attacker makes an abnormal request, the attacker can be guided again to the honeypot network covered by the simulation page.

[0074] For example, Figure 3 As shown, when the user makes a normal http request through the browser, the virtual interaction layer responds normally. When the attacker makes an abnormal http request through the browser, RASP hijacks and forms an induced web path to respond to the attacker. The attacker accesses the induced web path and enters the simulation page.

[0075] In one embodiment, the attacker tracing method is as follows:

[0076] When the terminal browser requests data, a JS script is loaded to obtain the terminal device fingerprint information;

[0077] The user sends an HTTP request through the browser, and the Web business system returns an HTML page with a fingerprint collection script;

[0078] The browser automatically executes JavaScript scripts to render the page, collects browser information and uploads it to the business system;

[0079] Based on the fact that the same fingerprint collection script has the same execution results on the same device browser, users are tracked and their behavior is analyzed through fingerprint matching algorithms.

[0080] In this embodiment, based on the terminal fingerprint tracking and tracing model, Figure 4 As shown, the fingerprint tracking and tracing model includes browser script deployment, browser script execution, feature information extraction, browser fingerprint generation, data storage and association analysis.

[0081] The generated terminal device fingerprint information includes detailed information such as the operating system, graphics card device, audio device, etc., combined with link tracking, attack source detection and other technologies to capture the virtual identity of the intruder, accurate positioning, multi-dimensional aggregation, and by restoring the attack process, tracing the attacker's identity, forming an attacker portrait, and finding the threat from the root.

[0082] After determining the attacker's portrait, anti-eavesdropping measures are taken against the attacker to obtain the attacker's information, including the basic information of the attacker's current device, WiFi connection status and network adaptation information, attacker's account and process information, etc., to provide complete information to solve the problem of asymmetric attack and defense.

[0083] In one embodiment, the honeypot network can realize the attacker's password cracking, vulnerability exploitation, and lateral movement of attacks, obtain the attacker's behavior through the honeypot probe, and analyze the attacker's attack methods and strategies;

[0084] The RASP probe set in the screening model is used to monitor the user's interaction requests, determine the user's risk weight based on the user's interaction requests, and analyze whether the user is an attacker.

[0085] In this embodiment, the RASP probe monitors the user's interaction requests, determines the user's risk weight based on the user's interaction requests, uses the risk weight to distinguish between users and attackers, and transmits users and attackers to different pages for separate interactions, thereby ensuring the stability of the interaction.

[0086] After determining the user's risk weight to distinguish users from attackers, attackers can induce users to enter the honeypot network without interfering with the virtual interaction layer through flood attacks or brute force attacks, thus ensuring the stability of the virtual interaction layer.

[0087] In one embodiment, the method for determining the user risk weight is as follows:

[0088] Obtain user request type, request frequency, request content, user behavior, and terminal device fingerprint to identify whether the request content and user behavior are dangerous;

[0089] Determine whether the user request type contains sensitive paths and determine the weight value of each sensitive path;

[0090] Calculate the user request frequency weight value;

[0091] Get whether the terminal device fingerprint is recorded;

[0092] Determine the final weight value.

[0093] In this embodiment, the user's risk weight is determined, the user's interaction request is analyzed, and whether the user is an attacker is determined, so as to induce the attacker, and different measures are taken for different risk weight values ​​according to the change of the risk weight value.

[0094] For example, a user views and edits personal information through the virtual interaction layer, and the virtual interaction layer receives the following HTTP request:

[0095] GET / user / edit? id='OR'1'='1

[0096] The user request attempts to access the sensitive path / user / edit, and contains a SQL injection attack code 'OR'1'='1' in the query parameter id. Through a SQL injection attack, the attacker attempts to obtain unauthorized data by modifying the logic of the SQL query.

[0097] In the above user request,

[0098] Request type: The user request attempts to access a sensitive path / user / edit and contains attack code in the query parameters.

[0099] Request frequency: User requests are sent multiple times in a short period of time, indicating that the attacker is attempting a brute force attack.

[0100] Request content: The user request contains SQL injection attack code and is determined to be malicious behavior.

[0101] User Behavior: The user has sent similar malicious requests in the past and is identified as an experienced attacker.

[0102] Terminal device fingerprint: obtain the user's terminal device fingerprint and ensure that the user's terminal device fingerprint is recorded.

[0103] Among them, the weight values ​​of the sensitive path / user / edit are set to 0.4 / 0.39 respectively. The user request frequency is 35 times, the weight value of each abnormal request of the user is 0.2, the user has sent 3 malicious requests in the past, the user behavior weight value is 1.3, and the user terminal device fingerprint is recorded, then the weight value of each abnormal request of the user is doubled.

[0104] In one embodiment, the user risk weight value W is calculated as follows:

[0105] W = 1.x*R+i(y*T)+l*k;

[0106] Among them, x is the number of malicious requests sent by the user in the past, R is the total weight of the sensitive path, T is the weight of the user's abnormal request, y is the number of abnormal requests of the user, l is the number of normal requests of the user, and k is the weight of the normal request of the user;

[0107] The total sensitive path weight R is the sum of all sensitive path weights included in the user request type, R = r1 + r2 + ... + r n .

[0108] In this embodiment, the user risk weight value W is calculated, and the risk of the attacker can be analyzed, and different countermeasures can be taken according to different risk weight values ​​of the attacker.

[0109] In one embodiment, in the calculation of the user risk weight value W, the user's normal request weight value is a negative value, and the weight value of each sensitive path changes with the access to the sensitive path. The maximum weight value of the sensitive path is 1 and the minimum is 0.2. The weight value of the sensitive path is modified once in a while, and the weight value of the sensitive path is adjusted according to the number of times the sensitive path is requested.

[0110] In this embodiment, the maximum number of times p of the sensitive path is requested is determined, and a weight value w=max / p for each request is obtained. If the weight value of the sensitive path is less than 0.2, it is calculated as 0.2.

[0111] In one embodiment, the integration layer obtains the interaction behavior between the user and the virtual interaction layer, determines the data change result generated after the user interacts with the virtual interaction layer, and simplifies the interaction behavior according to the data change result, and the steps are as follows:

[0112] Obtain user interaction behavior and determine the results of data changes;

[0113] Determine necessary actions based on the user's initial interaction behavior and data change results;

[0114] Merge the same interactive behaviors without data change results to eliminate the noise in the interactive behaviors;

[0115] Determine necessary action steps and monitor them to ensure the safety of necessary actions;

[0116] The necessary actions are transmitted to the interface layer, which is then transmitted to the application layer and replicated by the business system.

[0117] In this embodiment, changes to user data in the business system are implemented by replication, which reduces user interaction and reduces pressure on the business system during peak periods. Changes to user data are implemented by replication rather than by synchronizing data, which can further ensure the security of the business system and avoid potential dangers after the security system synchronizes data.

[0118] In summary, the technical solutions disclosed in the above embodiments of the present invention have at least the following advantages:

[0119] 1. The present invention establishes a three-dimensional deception defense system, screens users who interact with data, monitors the behavior during the data interaction process through RASP probes, determines whether the user is an attacker based on the request content and the terminal device fingerprint, and after determining the attacker, traces the attacker based on the terminal fingerprint technology and generates an attacker portrait, which facilitates the defender's forensic investigation and tracing of the attacker.

[0120] 2. Establish a screening model based on the business system, establish a honeypot network by simulating sensitive paths in the business system, disguise and pull data interaction behaviors that have abnormal behaviors, improve the success rate of entrapment, and continuously guide attackers to discover new sensitive paths during the attack process, thereby confusing the attacker's attack target.

[0121] 3. In the process of confusing the attacker's target, the terminal fingerprint technology is combined to realize the fingerprint extraction of the attacker's attack device, accurate perception, and support for the stringing and merging of cases in the tracing work, while continuously providing new sensitive paths to extend the attacker's attack time. By restoring the attack process, the attacker's identity is traced and traced to form a portrait of the attacker.

[0122] 4. The screening model includes an interaction layer. When the user needs to interact with the business system, the interaction layer in the screening model will perform the interaction operation. The security of the interaction process is determined based on the user's interaction behavior. After determining that the interaction process is safe, the user's interaction behavior is streamlined, and then the streamlined necessary behavior is replicated into the business system to realize interactive operations.

[0123] Although the present invention is disclosed in conjunction with the above embodiments, it is not intended to limit the present invention. Anyone familiar with this technology can make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the definition of the attached claims.

Claims

1. A RASP-based attack protection system, characterized in that: An attack protection system based on RASP, comprising: The business layer uses metadata to model data and establish a screening model. The screening model includes at least one virtual interaction layer, which is used to feedback the user's interactive behavior. The screening model obtains user request information and terminal device fingerprints to determine the user's identity. The application layer, including business systems, provides application support for users at all levels and layers through tables, views, files, and messages; The integration layer adopts a bottom-up modeling approach to uniformly clean, encode, check compliance, and post-form the data. It identifies the interaction between the user and the virtual interaction layer, and determines the noise in the interaction through the user's final operation, thus simplifying the interaction into necessary behaviors. The interface layer stores data from the business layer and sets real-time and delayed interfaces to implement interaction between the integration layer and the application layer; The business layer also includes a collection unit, which includes a RASP probe and a dense network probe. The RASP probe and the dense network probe monitor the interaction between the user and the screening model in real time; Honeypot networks can enable attackers to crack passwords, exploit vulnerabilities, and perform lateral attacks. Through honeypot probes, the attackers’ behaviors can be obtained and their attack methods and strategies can be analyzed. The RASP probe set in the screening model is used to monitor the user's interaction requests, and determine the user's risk weight based on the user's interaction requests to analyze whether the user is an attacker; The method for determining user risk weight is as follows: Obtain user request type, request frequency, request content, user behavior, and terminal device fingerprint to identify whether the request content and user behavior are dangerous; Determine whether the user request type contains sensitive paths and determine the weight value of each sensitive path; Calculate the user request frequency weight value; Get whether the terminal device fingerprint is recorded; Determine the final weight value; The integration layer obtains the interaction behavior between the user and the virtual interaction layer, and determines the data change results generated after the user interacts with the virtual interaction layer, and simplifies the interaction behavior according to the data change results. The steps are as follows: Obtain user interaction behavior and determine the results of data changes; Determine necessary actions based on the user's initial interaction behavior and data change results; Merge the same interactive behaviors without data change results to eliminate the noise in the interactive behaviors; Determine necessary action steps and monitor them to ensure the safety of necessary actions; The necessary actions are transmitted to the interface layer, which is then transmitted to the application layer and replicated by the business system.

2. The RASP-based attack protection system according to claim 1, characterized in that: The real-time interface and delayed interface of the interface layer are used to connect the application layer and the integration layer respectively. The real-time interface is connected to the application layer to realize the real-time transmission between the business system and the interface layer. The delayed interface is connected to the integration layer to form delayed data transmission between the integration layer and the interface layer. When the virtual interaction layer issues a call instruction, the integration layer calls the interface layer data in real time.

3. The RASP-based attack protection system according to claim 2, characterized in that: The screening model includes at least one honeypot network established by multiple sensitive paths of the business system. The honeypot network includes multiple sub-honeypots, and the sub-honeypots are interconnected. The honeypot network simulates the functions and behaviors of the business system. Each sub-honeypot contains at least one sensitive path. A dense network probe is placed inside each sub-honeypot to monitor the status of the sensitive path, obtain the attacker's attack time and generate an attack log. When a sub-honeypot is attacked, the honeypot connected to the attacked sub-honeypot induces the attacker to attack by exposing the sensitive path.

4. The RASP-based attack protection system according to claim 3, characterized in that: The honeypot network also includes a simulation page based on the business system. The screening model uses the RASP bytecode program insertion technology to implant probe code at a specific location of the screening model established by the business system to form a RASP probe. When the attacker's request is detected, an induced web path that does not exist in the virtual interaction layer is added under the domain name in the screening model by forging a response. When the attacker accesses the induced web path, he jumps to the simulation page of the honeypot network.

5. The RASP-based attack protection system according to claim 4, characterized in that: The attacker tracing method is as follows: When the terminal browser requests data, a JS script is loaded to obtain the terminal device fingerprint information; The user sends an HTTP request through the browser, and the Web business system returns an HTML page with a fingerprint collection script; The browser automatically executes JavaScript scripts to render the page, collects browser information and uploads it to the business system; Based on the fact that the same fingerprint collection script has the same execution results on the same device browser, users are tracked and their behavior is analyzed through fingerprint matching algorithms.

6. The RASP-based attack protection system according to claim 1, characterized in that: The calculation formula of user risk weight value W is as follows: W = 1.x*R+i(y*T)+l*k; Among them, x is the number of malicious requests sent by the user in the past, R is the total weight of the sensitive path, T is the weight of the user's abnormal request, y is the number of abnormal requests of the user, l is the number of normal requests of the user, and k is the weight of the normal request of the user; The total sensitive path weight R is the sum of all sensitive path weights included in the user request type, R = r1 + r2 + ... + r n .

7. The RASP-based attack protection system according to claim 6, characterized in that: In the calculation of the user risk weight value W, the user's normal request weight value is a negative value, and the weight value of each sensitive path changes with the access of the sensitive path. The maximum weight value of the sensitive path is 1 and the minimum is 0.

2. The weight value of the sensitive path is modified once in a while and adjusted according to the number of times the sensitive path is requested.

Images