Security product capability evaluation control method, device and equipment and storage medium
By obtaining the attribute information of the security product and generating corresponding request responses, evaluating its protection capabilities under RASP technology, the problem that the existing technology cannot evaluate RASP security products is solved, and a comprehensive and authentic evaluation of its protection capabilities is achieved.
Patent Information
- Application Number
- CN202310789014.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-29
- Publication Date
- 2024-12-31
AI Technical Summary
The prior art cannot effectively evaluate security products composed of RASP technology, and the evaluation is not comprehensive enough to achieve real attack and protection capabilities assessment on them.
By obtaining the attribute information of the security product to be evaluated, an application self-protection proxy object is generated. When an attack request from the intruding device is received, a corresponding request response is generated, and the proxy object is evaluated based on the response to obtain the capability evaluation results of the security product. The method includes obtaining a whitelist of attack requests, matching requests, filtering unmatched requests, executing matching successful requests, detecting attack payload modules and generating corresponding control policies to ensure the authenticity and comprehensiveness of the evaluation.
A comprehensive evaluation of security products composed of RASP technology has been achieved, which improves the authenticity and accuracy of the evaluation, can effectively reflect its protection capabilities, and protects safety when meeting the evaluation standards.
Smart Images
Figure CN119227071A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of security products, and in particular to a method, device, equipment and storage medium for evaluating and controlling the capabilities of security products. Background Art
[0002] Modern society is increasingly dependent on information systems, and security products corresponding to information systems are born out of operation, such as firewalls. However, security products need to undergo strict and comprehensive security assessments in the process from production to application. That is, the assessment of security products is an independent guarantee made by a third party on the security of information technology security products. The current way to evaluate security products is to use intruder simulation attacks, but the above assessment method cannot achieve the assessment of security products based on RASP technology. The specific reason is that security products based on RASP technology only focus on real attacks occurring inside specific container JAVA processes (such as tomcat), and the above simple assessment uses a simple execution simulation attack, which cannot break through the supported target object, resulting in the inability to evaluate security products based on RASP technology and the incompleteness of the assessment of security products.
[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention
[0004] The main purpose of the present invention is to provide a method, device, equipment and storage medium for evaluating and controlling the capabilities of a security product, aiming to solve the technical problem that the existing technology cannot realize the evaluation of security products constructed with RASP technology, and effectively improve the comprehensiveness of evaluating security products.
[0005] To achieve the above object, the present invention provides a method for evaluating and controlling the capability of a security product, the method comprising the following steps:
[0006] Acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information;
[0007] When receiving an attack request sent by an intrusion device, generating a corresponding request response according to the attack request;
[0008] The application self-protection proxy object is evaluated according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0009] Optionally, when receiving an attack request sent by an intrusion device, generating a corresponding request response according to the attack request includes:
[0010] Get the attack request whitelist;
[0011] When receiving an attack request sent by an intrusion device, matching the attack request with the attack requests in the attack request whitelist to obtain an attack request matching result;
[0012] Filtering the unmatched attack requests in the attack request matching results through a Servlet Filter to obtain the matched attack requests;
[0013] A corresponding request response is generated according to the successfully matched attack request.
[0014] Optionally, generating a corresponding request response according to the successfully matched attack request includes:
[0015] Get the type of Servlet Filter;
[0016] Determine the target security scenario execution environment according to the type of the Servlet Filter;
[0017] The successfully matched attack request is executed through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
[0018] Optionally, executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response includes:
[0019] Executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment;
[0020] After the execution is completed, a request response corresponding to the successfully matched attack request is generated through the Servlet.
[0021] Optionally, after receiving the attack request sent by the intrusion device and generating a corresponding request response according to the attack request, the method further includes:
[0022] Detect whether the attack payload module is triggered;
[0023] When a triggering attack payload module is detected, obtaining a target control strategy of the attack payload module;
[0024] The attack payload module is controlled according to the target control strategy.
[0025] Optionally, the evaluating the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated includes:
[0026] Querying the target attack result data in a preset query database according to the request response;
[0027] Generate a target capability assessment strategy based on the target attack result data;
[0028] The application self-protection agent object is evaluated according to the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0029] Optionally, the evaluating the application self-protection agent object according to the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated includes:
[0030] Obtain the host security protection system of the security product to be evaluated;
[0031] Obtaining a corresponding security protection process according to the host security protection system;
[0032] Determining the capability assessment dimension of the application self-protection agent object according to the security protection process;
[0033] The application self-protection agent object is evaluated according to the capability evaluation dimension and the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0034] Optionally, obtaining a corresponding security protection process according to the host security protection system includes:
[0035] Determine the target attack object according to the host security protection system;
[0036] Obtaining a command action that triggers the host security protection system to perform protection;
[0037] A corresponding security protection process is generated according to the target attack object and the command action.
[0038] Optionally, the acquiring attribute information of the security product to be evaluated and obtaining the application self-protection proxy object according to the attribute information includes:
[0039] Obtaining attribute information of the security product to be evaluated;
[0040] Determine a target Java container of the host security protection system according to the attribute information;
[0041] Obtaining actual attack data in the target Java container;
[0042] An application self-protection proxy object is obtained according to the actual attack data.
[0043] Optionally, after evaluating the application self-protection proxy object according to the request response to obtain the capability evaluation result of the security product to be evaluated, the method further includes:
[0044] Determine the security protection performance of the security product to be evaluated according to the capability evaluation result;
[0045] When the value corresponding to the security protection performance is greater than a preset performance threshold, security protection is performed on other objects through the security product to be evaluated.
[0046] In addition, to achieve the above-mentioned purpose, the present invention further proposes a security product capability evaluation control device, the security product capability evaluation control device comprising:
[0047] An acquisition module, used to acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information;
[0048] A generating module, configured to generate a corresponding request response according to the attack request when receiving an attack request sent by the intrusion device;
[0049] An evaluation module is used to evaluate the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0050] Optionally, the acquisition module is further used to obtain attribute information of the security product to be evaluated; determine the target Java container of the host security protection system based on the attribute information; obtain actual attack data in the target Java container; and obtain an application self-protection proxy object based on the actual attack data.
[0051] Optionally, the generation module is also used to obtain an attack request whitelist; when receiving an attack request sent by an intrusion device, matching the attack request with the attack requests in the attack request whitelist to obtain an attack request matching result; filtering the unmatched attack requests in the attack request matching result through a Servlet Filter to obtain a successfully matched attack request; and generating a corresponding request response based on the successfully matched attack request.
[0052] Optionally, the generation module is also used to obtain the type of Servlet Filter; determine the target security scenario execution environment according to the type of Servlet Filter; and execute the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
[0053] Optionally, the generating module is further configured to execute the successfully matched attack request through the ServletFilter in the target security scenario execution environment; after the execution is completed, generate a request response corresponding to the successfully matched attack request through the Servlet.
[0054] Optionally, the generation module is further used to detect whether the attack payload module is triggered; when it is detected that the attack payload module is triggered, obtain a target control strategy for the attack payload module; and control the attack payload module according to the target control strategy.
[0055] Optionally, the evaluation module is also used to query target attack result data in a preset query database according to the request response; generate a target capability evaluation strategy based on the target attack result data; evaluate the application self-protection agent object according to the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated.
[0056] Optionally, the evaluation module is also used to obtain the host security protection system of the security product to be evaluated; obtain the corresponding security protection process based on the host security protection system; determine the capability evaluation dimension of the application self-protection agent object based on the security protection process; evaluate the application self-protection agent object according to the capability evaluation dimension and the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated.
[0057] Optionally, the evaluation module is further used to determine the target attack object according to the host security protection system; obtain the command action that triggers the host security protection system to perform protection; and generate a corresponding security protection process according to the target attack object and the command action.
[0058] Optionally, the evaluation module is also used to determine the security protection performance of the security product to be evaluated based on the capability evaluation result; when the numerical value corresponding to the security protection performance is greater than a preset performance threshold, security protection is performed on other objects through the security product to be evaluated.
[0059] In addition, to achieve the above-mentioned purpose, the present invention also proposes a security product capability assessment and control device, the security product capability assessment and control device comprising: a memory, a processor, and a security product capability assessment and control program stored in the memory and executable on the processor, the security product capability assessment and control program being configured to implement the security product capability assessment and control method as described above.
[0060] In addition, to achieve the above-mentioned purpose, the present invention also proposes a storage medium, on which a security product capability assessment control program is stored. When the security product capability assessment control program is executed by a processor, the security product capability assessment control method as described above is implemented.
[0061] The security product capability assessment control method proposed in the present invention obtains attribute information of the security product to be assessed, and obtains an application self-protection proxy object according to the attribute information; when an attack request sent by an intrusion device is received, a corresponding request response is generated according to the attack request; the application self-protection proxy object is evaluated according to the request response to obtain a capability assessment result of the security product to be assessed; through the above-mentioned method, after obtaining the application self-protection proxy object of the security product to be assessed constructed with the RASP technology, a request response is generated through the attack request sent by the intrusion device, and the capability assessment result of the security product to be assessed is obtained according to the request response and the application self-protection proxy object, thereby realizing the assessment of the security product to be assessed constructed with the RASP technology and effectively improving the comprehensiveness of the assessed security product. BRIEF DESCRIPTION OF THE DRAWINGS
[0062] Figure 1 It is a structural diagram of a security product capability evaluation control device for a hardware operating environment involved in an embodiment of the present invention;
[0063] Figure 2 A schematic flow chart of a first embodiment of a method for controlling the security product capability of the present invention;
[0064] Figure 3 It is a schematic diagram of the overall structure of an embodiment of a method for evaluating and controlling the security product capability of the present invention;
[0065] Figure 4 It is a flow chart of a second embodiment of the method for evaluating and controlling the security product capability of the present invention;
[0066] Figure 5 A schematic flow chart of a third embodiment of a method for controlling the security product capability of the present invention;
[0067] Figure 6 This is a functional module diagram of the first embodiment of the safety product capability assessment control device of the present invention.
[0068] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION
[0069] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.
[0070] Reference Figure 1 , Figure 1 A schematic diagram of the structure of a control device for evaluating the security product capabilities of a hardware operating environment according to an embodiment of the present invention.
[0071] like Figure 1 As shown, the evaluation control device of the security product capability may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, Wi-Fi) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.
[0072] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the safety product capability assessment control device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.
[0073] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and a security product capability assessment control program.
[0074] exist Figure 1 In the security product capability assessment and control device shown, the network interface 1004 is mainly used for data communication with the network integration platform workstation; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the security product capability assessment and control device of the present invention can be set in the security product capability assessment and control device, and the security product capability assessment and control device calls the security product capability assessment control program stored in the memory 1005 through the processor 1001, and executes the security product capability assessment and control method provided by the embodiment of the present invention.
[0075] Based on the above hardware structure, an embodiment of the evaluation control method of the security product capability of the present invention is proposed.
[0076] Reference Figure 2 , Figure 2 It is a flowchart of the first embodiment of the evaluation control method of the security product capability of the present invention.
[0077] In a first embodiment, the security product capability assessment control method includes the following steps:
[0078] Step S10, obtaining attribute information of the security product to be evaluated, and obtaining an application self-protection proxy object according to the attribute information.
[0079] It should be noted that the executor of this embodiment is a security product capability assessment control device, and may also be other devices that can achieve the same or similar functions, such as a security product capability assessment system, etc. This embodiment does not limit this. In this embodiment, the security product capability assessment system is taken as an example for explanation.
[0080] It should be understood that the security product to be evaluated refers to a security product constructed with RASP (Runtime Application Self-Protection) technology. RASP technology utilizes four major methods, such as Servlet filters, binary instructions, Java virtual machine replacement, and virtualization. Attribute information refers to attribute-related information of the security product to be evaluated, such as the name, protection object of the application, specific process of security protection, etc. The self-protection proxy object refers to the core object of the security product to be evaluated, which can be RASPAGENT. The importance of the self-protection proxy object to the important program of the security product to be evaluated is equivalent to the importance of the CPU to the computer.
[0081] It is understandable that RASP technology is widely used in website security. The relevant jar package is injected into the java container process, such as the tomcat process, through the javaagent process parameters, and then the execution permission before the main function of the java container process is obtained through premain and agentmain. Then the hook of the key function is set to obtain the monitoring of the key system function call. For details, refer to Table 1:
[0082] Table 1
[0083] Execution permissions corresponding to the content The name of the calling function File upload org.apache.commons.fileupload.disk.DiskFileItem.setHeaders() org.apache.commons.fileupload.FileUploadBase.parseRequest() File Reading java.io.FileInputStream(File file) File Writing java.io.FileOutputStream() java.io.FileOutputStream(String name,boolean append) File Renaming java.io.File.renameTo() File traversal java.io.File.list()
[0084] Further, step S10 includes: obtaining attribute information of the security product to be evaluated; determining the target Java container of the host security protection system according to the attribute information; obtaining actual attack data in the target Java container; and obtaining an application self-protection proxy object according to the actual attack data.
[0085] It is understood that the target Java container refers to the container protected by the host security protection system in the security product to be evaluated. Figure 3 , Figure 3 It is a schematic diagram of the overall structure, which specifically includes a target Java container and an intrusion device. The target Java container includes a self-protection agent object RASP AGENT, multiple Servlet Filters and Servlets.
[0086] It should be understood that the actual attack data refers to the actual data used to attack the object to be evaluated, and the actual attack object of the attack request is determined through the actual attack data, and then the attack object is analyzed to obtain the application self-protection proxy object.
[0087] Step S20: upon receiving an attack request sent by the intrusion device, generating a corresponding request response according to the attack request.
[0088] It can be understood that an attack request refers to a request used to attack the object to be evaluated, which is issued by the intrusion device and reaches the Servlet Filter of the target Java container. A request response refers to a response based on the attack request, which is generated by the Servlet.
[0089] Furthermore, after step S10, it also includes: detecting whether the attack payload module is triggered; when it is detected that the attack payload module is triggered, obtaining a target control strategy for the attack payload module; and controlling the attack payload module according to the target control strategy.
[0090] It should be understood that the attack payload module refers to the module used to establish a stable connection between the intrusion device and the target Java container. The attack payload module is directly generated through the generate command. The target control strategy refers to the strategy used to control the attack payload module. When determining to trigger the attack payload module, the target control strategy is used to control the attack payload module, thereby ensuring the real attack effect and ensuring the effectiveness of the evaluation.
[0091] Step S30: Evaluate the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0092] It should be understood that the capability assessment result refers to the capability assessment result of the security product to be assessed, which evaluates the application self-protection agent object through request response, and the capability assessment result can accurately reflect the protection capability of the security product to be assessed.
[0093] Furthermore, after step S30, it also includes: determining the security protection performance of the security product to be evaluated according to the capability evaluation result; when the numerical value corresponding to the security protection performance is greater than a preset performance threshold, providing security protection for other objects through the security product to be evaluated.
[0094] It can be understood that the safety protection performance refers to the safety protection performance of the safety product to be evaluated. The higher the safety protection performance, the safer the object protected by the safety product to be evaluated. After evaluating the safety protection performance of the safety product to be evaluated, it is determined whether the corresponding value of the safety protection performance is greater than the preset performance threshold. If so, it indicates that the product to be evaluated is qualified in terms of safety protection. At this time, the safety product to be evaluated can be used to provide safety protection for other objects.
[0095] This embodiment obtains attribute information of the security product to be evaluated, and obtains an application self-protection proxy object according to the attribute information; when receiving an attack request sent by an intrusion device, a corresponding request response is generated according to the attack request; the application self-protection proxy object is evaluated according to the request response to obtain a capability evaluation result of the security product to be evaluated; through the above method, after obtaining the application self-protection proxy object of the security product to be evaluated constructed with the RASP technology, a request response is generated through the attack request sent by the intrusion device, and the capability evaluation result of the security product to be evaluated is obtained according to the request response and the application self-protection proxy object, thereby enabling the evaluation of the security product constructed with the RASP technology to be realized and effectively improving the comprehensiveness of the evaluated security products.
[0096] In one embodiment, if Figure 4 Based on the first embodiment, a second embodiment of the security product capability assessment control method of the present invention is proposed. Step S20 includes:
[0097] Step S201, obtaining an attack request whitelist.
[0098] It should be understood that the attack request whitelist refers to a whitelist constructed by various verified and safe attack requests, that is, all attack requests in the attack request whitelist will not carry defective data such as viruses.
[0099] Step S202: When receiving an attack request sent by an intrusion device, the attack request is matched with the attack requests in the attack request whitelist to obtain an attack request matching result.
[0100] It can be understood that the attack request is simulated and sent by the intrusion device. When the attack request sent by the intrusion device is received, the attack request is matched one by one with each attack request in the attack request whitelist to obtain the attack request matching result, which includes the attack request that is successfully matched and the attack request that is not successfully matched.
[0101] Step S203: filtering unsuccessfully matched attack requests in the attack request matching results through a Servlet Filter to obtain successfully matched attack requests.
[0102] It should be understood that after obtaining the attack request matching result, the Servlet Filter is used to filter out the unmatched attack requests in the attack request matching result to obtain the successfully matched attack requests.
[0103] Step S204: Generate a corresponding request response according to the successfully matched attack request.
[0104] Further, step S204 includes: obtaining the type of the Servlet Filter; determining the target security scenario execution environment according to the type of the ServletFilter; and executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
[0105] It should be understood that since different Servlet Filters implement different security scenario execution environments, it is necessary to obtain the type of the Servlet Filter and determine the target security scenario execution environment based on the type of the Servlet Filter. The target security scenario execution environment may be a SQL injection scenario. For example, the security scenario execution environment of a type A Servlet Filter is a, and the security scenario execution environment of a type B Servlet Filter is b. In the target security scenario execution environment, the Servlet Filter executes the successfully matched attack request, so that the simulated attack request is executed in a preset manner, thereby ensuring the authenticity and security of the attack.
[0106] Furthermore, executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response includes: executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment; after the execution is completed, generating a request response corresponding to the successfully matched attack request through the Servlet.
[0107] It can be understood that after determining the target security scenario execution environment, the Servlet Filter executes the successfully matched attack request in the target security scenario execution environment, and the Servlet is responsible for generating a request response corresponding to the successfully matched attack request.
[0108] This embodiment obtains an attack request whitelist; when receiving an attack request sent by an intrusion device, matches the attack request with the attack request in the attack request whitelist to obtain an attack request matching result; filters the unmatched attack requests in the attack request matching result by a Servlet Filter to obtain a successfully matched attack request; generates a corresponding request response according to the successfully matched attack request; through the above manner, when receiving an attack request, matches the attack request with the attack request in the attack request whitelist one by one, filters the unmatched attack request by the ServletFilter, and then generates a request response corresponding to the attack request by the Servlet, thereby effectively improving the correctness and efficiency of generating a request response.
[0109] In one embodiment, if Figure 5 Based on the first embodiment, a third embodiment of the security product capability assessment control method of the present invention is proposed. Step S30 includes:
[0110] Step S301, querying target attack result data in a preset query database according to the request response.
[0111] It can be understood that the preset query database refers to a database containing a mapping relationship between request response data and attack result data, and the target attack result data refers to the result data after the attack is carried out through the attack request. After obtaining the request response generated by the Servlet, the corresponding target attack result data is queried in the preset query database according to the request response.
[0112] Step S302: generating a target capability assessment strategy according to the target attack result data.
[0113] It should be understood that the target capability assessment strategy refers to a strategy for assessing the capability of the object to be assessed, and different attack result data may generate different capability assessment strategies.
[0114] Step S303: Evaluate the application self-protection agent object according to the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0115] Further, step S303 includes: obtaining the host security protection system of the security product to be evaluated; obtaining the corresponding security protection process based on the host security protection system; determining the capability assessment dimension of the application self-protection agent object based on the security protection process; evaluating the application self-protection agent object according to the capability assessment dimension and the target capability assessment strategy to obtain the capability assessment result of the security product to be evaluated.
[0116] It should be understood that the host security protection system refers to the system used for security protection of the security product to be evaluated, and the security protection process refers to the specific process of security protection by the host security protection system. There can be multiple capability assessment dimensions, that is, the application self-protection agent object is evaluated from multiple capability assessment dimensions using the target capability assessment strategy to obtain the capability assessment results of the security product to be evaluated.
[0117] Furthermore, the corresponding security protection process is obtained according to the host security protection system, including: determining the target attack object according to the host security protection system; obtaining the command action that triggers the host security protection system to perform protection; and generating the corresponding security protection process according to the target attack object and the command action.
[0118] It can be understood that the target attack object refers to the object that needs to be attacked to evaluate the object to be evaluated. For example, when the process of the target JAVA container is tomcat, the target attack object is the website supported by tomcat. The command action refers to the command action issued to trigger the host security protection system to perform protection. The command action can be a malicious command action. After obtaining the command action, the corresponding security protection process is generated in combination with the target attack object.
[0119] This embodiment queries the target attack result data in a preset query database according to the request response; generates a target capability assessment strategy according to the target attack result data; evaluates the application self-protection agent object according to the target capability assessment strategy to obtain the capability assessment result of the security product to be evaluated; through the above method, the target attack result data corresponding to the request response is queried in the preset query database, and then the target attack result data is used to generate a target capability assessment strategy, and finally the capability assessment result of the security product to be evaluated is evaluated through the target capability assessment strategy, thereby enabling the evaluation of security products constructed with RASP technology.
[0120] In addition, an embodiment of the present invention further proposes a storage medium on which a security product capability assessment control program is stored. When the security product capability assessment control program is executed by a processor, the steps of the security product capability assessment control method described above are implemented.
[0121] Since the storage medium adopts all the technical solutions of all the above embodiments, it has at least all the beneficial effects brought by the technical solutions of the above embodiments, which will not be described one by one here.
[0122] In addition, refer to Figure 6 The embodiment of the present invention further provides a security product capability evaluation control device, the security product capability evaluation control device comprising:
[0123] The acquisition module 10 is used to acquire the attribute information of the security product to be evaluated, and obtain the application self-protection proxy object according to the attribute information.
[0124] The generating module 20 is used to generate a corresponding request response according to the attack request when receiving the attack request sent by the intrusion device.
[0125] The evaluation module 30 is used to evaluate the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0126] This embodiment obtains attribute information of the security product to be evaluated, and obtains an application self-protection proxy object according to the attribute information; when receiving an attack request sent by an intrusion device, a corresponding request response is generated according to the attack request; the application self-protection proxy object is evaluated according to the request response to obtain a capability evaluation result of the security product to be evaluated; through the above method, after obtaining the application self-protection proxy object of the security product to be evaluated constructed with the RASP technology, a request response is generated through the attack request sent by the intrusion device, and the capability evaluation result of the security product to be evaluated is obtained according to the request response and the application self-protection proxy object, thereby enabling the evaluation of the security product constructed with the RASP technology to be realized and effectively improving the comprehensiveness of the evaluated security products.
[0127] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of them according to actual needs to achieve the purpose of the present embodiment, and no limitation is made here.
[0128] In addition, for technical details not fully described in this embodiment, reference can be made to the security product capability assessment and control method provided in any embodiment of the present invention, and will not be repeated here.
[0129] In one embodiment, the acquisition module 10 is also used to obtain attribute information of the security product to be evaluated; determine the target Java container of the host security protection system based on the attribute information; obtain actual attack data in the target Java container; and obtain an application self-protection proxy object based on the actual attack data.
[0130] In one embodiment, the generation module 20 is also used to obtain an attack request whitelist; when receiving an attack request sent by an intrusion device, the attack request is matched with the attack requests in the attack request whitelist to obtain an attack request matching result; the unsuccessfully matched attack requests in the attack request matching result are filtered through a Servlet Filter to obtain a successfully matched attack request; and a corresponding request response is generated according to the successfully matched attack request.
[0131] In one embodiment, the generation module 20 is further used to obtain the type of the Servlet Filter; determine the target security scenario execution environment according to the type of the Servlet Filter; and execute the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
[0132] In one embodiment, the generating module 20 is further used to execute the successfully matched attack request through the Servlet Filter in the target security scenario execution environment; after the execution is completed, generate a request response corresponding to the successfully matched attack request through the Servlet.
[0133] In one embodiment, the generation module 20 is further used to detect whether the attack payload module is triggered; when it is detected that the attack payload module is triggered, obtain the target control strategy of the attack payload module; and control the attack payload module according to the target control strategy.
[0134] In one embodiment, the evaluation module 30 is also used to query target attack result data in a preset query database according to the request response; generate a target capability evaluation strategy based on the target attack result data; evaluate the application self-protection agent object according to the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated.
[0135] In one embodiment, the evaluation module 30 is also used to obtain the host security protection system of the security product to be evaluated; obtain the corresponding security protection process based on the host security protection system; determine the capability evaluation dimension of the application self-protection agent object based on the security protection process; evaluate the application self-protection agent object according to the capability evaluation dimension and the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated.
[0136] In one embodiment, the evaluation module 30 is also used to determine the target attack object based on the host security protection system; obtain the command action that triggers the host security protection system to perform protection; and generate a corresponding security protection process based on the target attack object and the command action.
[0137] In one embodiment, the evaluation module 30 is also used to determine the security protection performance of the security product to be evaluated based on the capability evaluation result; when the numerical value corresponding to the security protection performance is greater than a preset performance threshold, security protection is performed on other objects through the security product to be evaluated.
[0138] Other embodiments of the security product capability assessment control device or implementation methods of the present invention can refer to the above-mentioned method embodiments, which will not be repeated here.
[0139] The present invention discloses A1, a method for evaluating the capability of a security product, the method for evaluating the capability of a security product comprising the following steps:
[0140] Acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information;
[0141] When receiving an attack request sent by an intrusion device, generating a corresponding request response according to the attack request;
[0142] The application self-protection proxy object is evaluated according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0143] A2. The method for evaluating the security product capability as described in A1, wherein upon receiving an attack request sent by an intrusion device, generating a corresponding request response according to the attack request comprises:
[0144] Get the attack request whitelist;
[0145] When receiving an attack request sent by an intrusion device, matching the attack request with the attack requests in the attack request whitelist to obtain an attack request matching result;
[0146] Filtering the unmatched attack requests in the attack request matching results through a Servlet Filter to obtain the matched attack requests;
[0147] A corresponding request response is generated according to the successfully matched attack request.
[0148] A3. The method for evaluating the security product capability as described in A2, wherein the generating a corresponding request response according to the successfully matched attack request comprises:
[0149] Get the type of Servlet Filter;
[0150] Determine the target security scenario execution environment according to the type of the Servlet Filter;
[0151] The successfully matched attack request is executed through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
[0152] A4. The method for evaluating the security product capability as described in A3, wherein the successfully matched attack request is executed by the Servlet Filter in the target security scenario execution environment to generate a corresponding request response, including:
[0153] Executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment;
[0154] After the execution is completed, a request response corresponding to the successfully matched attack request is generated through the Servlet.
[0155] A5. The method for evaluating the security product capability as described in A1, wherein after receiving an attack request sent by an intrusion device and generating a corresponding request response according to the attack request, the method further comprises:
[0156] Detect whether the attack payload module is triggered;
[0157] When a triggering attack payload module is detected, obtaining a target control strategy of the attack payload module;
[0158] The attack payload module is controlled according to the target control strategy.
[0159] A6. The method for evaluating the capability of a security product as described in A1, wherein the application self-protection proxy object is evaluated according to the request response to obtain the capability evaluation result of the security product to be evaluated, including:
[0160] Querying the target attack result data in a preset query database according to the request response;
[0161] Generate a target capability assessment strategy based on the target attack result data;
[0162] The application self-protection agent object is evaluated according to the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0163] A7. The method for evaluating the security product capability as described in A6, wherein the application self-protection agent object is evaluated according to the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated, including:
[0164] Obtain the host security protection system of the security product to be evaluated;
[0165] Obtaining a corresponding security protection process according to the host security protection system;
[0166] Determining the capability assessment dimension of the application self-protection agent object according to the security protection process;
[0167] The application self-protection agent object is evaluated according to the capability evaluation dimension and the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0168] A8. The method for evaluating the security product capability as described in A7, wherein the corresponding security protection process is obtained according to the host security protection system, including:
[0169] Determine the target attack object according to the host security protection system;
[0170] Obtaining a command action that triggers the host security protection system to perform protection;
[0171] A corresponding security protection process is generated according to the target attack object and the command action.
[0172] A9. The method for evaluating the security product capability as described in A1, wherein the step of obtaining attribute information of the security product to be evaluated and obtaining an application self-protection proxy object according to the attribute information comprises:
[0173] Obtaining attribute information of the security product to be evaluated;
[0174] Determine a target Java container of the host security protection system according to the attribute information;
[0175] Obtaining actual attack data in the target Java container;
[0176] An application self-protection proxy object is obtained according to the actual attack data.
[0177] A10. The method for evaluating the capability of a security product as described in any one of A1 to A9, wherein after evaluating the application self-protection agent object according to the request response and obtaining the capability evaluation result of the security product to be evaluated, the method further comprises:
[0178] Determine the security protection performance of the security product to be evaluated according to the capability evaluation result;
[0179] When the value corresponding to the security protection performance is greater than a preset performance threshold, security protection is performed on other objects through the security product to be evaluated.
[0180] The present invention discloses B11, a device for evaluating the capability of a security product, the device for evaluating the capability of a security product comprising:
[0181] An acquisition module, used to acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information;
[0182] A generating module, configured to generate a corresponding request response according to the attack request when receiving an attack request sent by the intrusion device;
[0183] An evaluation module is used to evaluate the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated.
[0184] B12. The device for evaluating the capability of a security product as described in B11, wherein the acquisition module is further used to obtain attribute information of the security product to be evaluated; determine a target Java container of the host security protection system based on the attribute information; obtain actual attack data in the target Java container; and obtain an application self-protection proxy object based on the actual attack data.
[0185] B13. The security product capability evaluation device as described in B11, wherein the generation module is further used to obtain an attack request whitelist; upon receiving an attack request sent by an intrusion device, the attack request is matched with the attack requests in the attack request whitelist to obtain an attack request matching result; the unsuccessfully matched attack requests in the attack request matching result are filtered through a Servlet Filter to obtain a successfully matched attack request; and a corresponding request response is generated according to the successfully matched attack request.
[0186] B14. In the security product capability evaluation device as described in B13, the generation module is further used to obtain the type of ServletFilter; determine the target security scenario execution environment according to the type of ServletFilter; and execute the successfully matched attack request through the ServletFilter in the target security scenario execution environment to generate a corresponding request response.
[0187] B15. In the security product capability evaluation device as described in B11, the generation module is further used to detect whether the attack payload module is triggered; when the triggering of the attack payload module is detected, the target control strategy of the attack payload module is obtained; and the attack payload module is controlled according to the target control strategy.
[0188] B16. The device for evaluating the capability of a security product as described in B11, wherein the evaluation module is further used to query target attack result data in a preset query database according to the request response; generate a target capability evaluation strategy according to the target attack result data; and evaluate the application self-protection agent object according to the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
[0189] B17. The device for evaluating the capability of a security product as described in B16, wherein the evaluation module is further used to obtain the host security protection system of the security product to be evaluated; obtain the corresponding security protection process based on the host security protection system; determine the capability evaluation dimension of the application self-protection agent object based on the security protection process; evaluate the application self-protection agent object according to the capability evaluation dimension and the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated.
[0190] B18. The security product capability evaluation device as described in B17, wherein the evaluation module is further used to determine the target attack object based on the host security protection system; obtain the command action that triggers the host security protection system to perform protection; and generate a corresponding security protection process based on the target attack object and the command action.
[0191] In addition, it should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.
[0192] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.
[0193] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, an integrated platform workstation, or a network device, etc.) to execute the methods described in each embodiment of the present invention.
[0194] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.
Claims
1. A method for evaluating security product capabilities, characterized in that: The method for evaluating the security product capability comprises the following steps: Acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information; When receiving an attack request sent by an intrusion device, generating a corresponding request response according to the attack request; The application self-protection proxy object is evaluated according to the request response to obtain a capability evaluation result of the security product to be evaluated.
2. The method for evaluating security product capabilities according to claim 1, wherein: When receiving the attack request sent by the intrusion device, generating a corresponding request response according to the attack request includes: Get the attack request whitelist; When receiving an attack request sent by an intrusion device, matching the attack request with the attack requests in the attack request whitelist to obtain an attack request matching result; Filtering the unmatched attack requests in the attack request matching results through a Servlet Filter to obtain the matched attack requests; A corresponding request response is generated according to the successfully matched attack request.
3. The method for evaluating security product capabilities according to claim 2, wherein: The generating a corresponding request response according to the successfully matched attack request includes: Get the type of Servlet Filter; Determine the target security scenario execution environment according to the type of the Servlet Filter; The successfully matched attack request is executed through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response.
4. The method for evaluating security product capabilities according to claim 3, wherein: The executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment to generate a corresponding request response includes: Executing the successfully matched attack request through the Servlet Filter in the target security scenario execution environment; After the execution is completed, a request response corresponding to the successfully matched attack request is generated through the Servlet.
5. The method for evaluating security product capabilities according to claim 1, wherein: When receiving the attack request sent by the intrusion device, after generating a corresponding request response according to the attack request, the method further includes: Detect whether the attack payload module is triggered; When a triggering attack payload module is detected, obtaining a target control strategy of the attack payload module; The attack payload module is controlled according to the target control strategy.
6. The method for evaluating security product capabilities according to claim 1, wherein: The step of evaluating the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated includes: Querying the target attack result data in a preset query database according to the request response; Generate a target capability assessment strategy based on the target attack result data; The application self-protection agent object is evaluated according to the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
7. The method for evaluating security product capabilities according to claim 6, wherein: The step of evaluating the application self-protection agent object according to the target capability evaluation strategy to obtain the capability evaluation result of the security product to be evaluated includes: Obtain the host security protection system of the security product to be evaluated; Obtaining a corresponding security protection process according to the host security protection system; Determining the capability assessment dimension of the application self-protection agent object according to the security protection process; The application self-protection agent object is evaluated according to the capability evaluation dimension and the target capability evaluation strategy to obtain a capability evaluation result of the security product to be evaluated.
8. A device for evaluating the capability of a security product, characterized in that: The security product capability evaluation device comprises: An acquisition module, used to acquire attribute information of the security product to be evaluated, and obtain an application self-protection proxy object according to the attribute information; A generating module, configured to generate a corresponding request response according to the attack request when receiving an attack request sent by the intrusion device; An evaluation module is used to evaluate the application self-protection proxy object according to the request response to obtain a capability evaluation result of the security product to be evaluated.
9. A device for evaluating the capability of a security product, characterized in that: The security product capability evaluation device includes: a memory, a processor, and a security product capability evaluation program stored in the memory and executable on the processor, wherein the security product capability evaluation program is configured to implement the security product capability evaluation method according to any one of claims 1 to 7.
10. A storage medium, characterized in that: The storage medium stores a security product capability evaluation program, and when the security product capability evaluation program is executed by the processor, the security product capability evaluation method according to any one of claims 1 to 7 is implemented.