Automatic RASP method and device based on flow classification and code analysis, equipment and medium

Abstract

The invention relates to an automatic RASP method and device based on traffic classification and code analysis, equipment and a medium, and the method comprises the steps: carrying out the classification of obtained network traffic data through an incremental learning model, and obtaining normal traffic and abnormal traffic; performing static code analysis on the abnormal traffic to obtain a tangency point selection guide; according to tangency point selection guidance and dynamic code analysis, realizing automatic RASP instrumentation to judge whether the abnormal traffic has malicious behaviors or not; and when a malicious behavior exists in the abnormal traffic, blocking the malicious behavior through the RASP, and reporting the malicious behavior. According to the technical scheme, normal traffic and abnormal traffic are effectively distinguished, the influence of RASP on the performance of a network application program is reduced, and resource loss is reduced; and malicious behaviors are blocked through the RASP, the security of the network application program is monitored, the malicious behaviors are responded in time, and potential attacks are effectively prevented.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an automated RASP method, device, equipment and medium based on traffic classification and code analysis. Background Art

[0002] Web applications are Internet-based software systems that provide a variety of online services and functions. While being widely used, web applications also face a variety of security threats, including but not limited to malicious code attacks, vulnerability exploits, etc., which may lead to user privacy leaks and system paralysis.

[0003] RASP (Runtime Application Self-Protection) is a new type of dynamic protection technology that "injects" protection functions into applications, integrates them with applications, and observes the internal situation of the program in real time during operation through a small number of key functions. When an application exhibits suspicious behavior, RASP accurately identifies attack events based on the current context and blocks them in real time, giving the application the ability to protect itself without manual intervention. RASP can perform data introspection and logical intervention on the business without the business system being aware of it, and is widely used in scenarios such as security attack and defense, vulnerability detection, risk perception, privacy protection, and test playback.

[0004] Compared with WAF (Web Application Firewall), RASP has the advantages of low false positive and missed detection rates: Unlike WAF's blind rule matching, RASP can learn about the key functions inside the application and add security checks before the execution of these key functions. The parameters obtained are all real request data after deformation and restoration; it has extremely high coverage and compatibility: RASP security system can be applied to any injectable application and can handle most network protocols, while WAF provides protection by monitoring network traffic and therefore only supports Web applications.

[0005] The working principle of RASP technology is to achieve real-time monitoring and defense by inserting special protection modules at the cutting point in the application. These protection modules can monitor the behavior of the application, identify potential attack behaviors, and take corresponding defensive measures. For example, when a SQL (Structured Query Language) injection attack is detected, RASP technology can immediately prevent the execution of malicious code, thereby protecting the security of the database. Similarly, when malicious file uploads or cross-site scripting attacks are detected, RASP technology can also intercept and defend in time.

[0006] However, since RASP (Runtime application self-protection) requires an in-depth understanding of the internal logic and data structure of network applications, as well as the characteristics and vulnerabilities of various programming languages ​​and frameworks, it requires highly skilled technical personnel to develop and maintain it, and is unable to quickly discover new vulnerabilities and block attacks. In addition, since RASP is directly deployed in the system and detects and intercepts risks in real time, it has a certain impact on business performance, affects the application's processing of high-concurrency businesses, and reduces user experience. Summary of the invention

[0007] In order to solve the above problems existing in the prior art, the present invention provides an automated RASP method, device, equipment and medium based on traffic classification and code analysis.

[0008] According to a first aspect of an embodiment of the present invention, an automated RASP method based on traffic classification and code analysis is provided, the method comprising:

[0009] The acquired network traffic data is classified through the incremental learning model to obtain normal traffic and abnormal traffic;

[0010] Perform static code analysis on the abnormal traffic to obtain a cut-point selection guide;

[0011] According to the cut-point selection guidance and dynamic code analysis, automatic RASP instrumentation is implemented to determine whether the abnormal traffic contains malicious behavior;

[0012] When there is malicious behavior in the abnormal traffic, the malicious behavior is blocked by RASP and reported.

[0013] Optionally, before classifying the acquired network traffic data through the incremental learning model to obtain normal traffic and abnormal traffic, the method further includes:

[0014] Get http or https traffic;

[0015] The network traffic data is obtained by extracting features of the http or https traffic through a network application collection terminal.

[0016] Optionally, the performing static code analysis on the abnormal traffic to obtain a cut-point selection guide includes:

[0017] Obtain the system server source code and the URL of the abnormal traffic;

[0018] Obtaining the code position corresponding to the URL of the abnormal traffic in the source code of the system server through string matching;

[0019] Static code analysis is performed on the abstract syntax tree of the code position to obtain the pointcut selection guide.

[0020] Optionally, the step of implementing automated RASP instrumentation based on the cut-point selection guide and dynamic code analysis to determine whether the abnormal traffic contains malicious behavior includes:

[0021] According to the cut-point selection guidance and dynamic code analysis, automatic RASP instrumentation is implemented to obtain the call link and parameters of the abnormal traffic;

[0022] Determine whether the abnormal traffic has malicious behavior based on the call link and parameters of the abnormal traffic.

[0023] Optionally, judging whether the abnormal traffic contains malicious behavior according to the call link and parameters of the abnormal traffic includes:

[0024] Obtain the function relationship call subgraph of the system server based on dynamic code analysis;

[0025] Matching the call link and parameters of the abnormal traffic with the function relationship call subgraph in the malicious behavior library of the system server;

[0026] When a match is successful, it is determined that the abnormal traffic contains malicious behavior.

[0027] Optionally, when the abnormal traffic contains malicious behavior, blocking the malicious behavior by RASP and reporting the malicious behavior includes:

[0028] When there is malicious behavior in the abnormal traffic, RASP is used to block the malicious behavior in the abnormal traffic;

[0029] The malicious behavior is reported and used to train the incremental learning model of the system server.

[0030] According to a second aspect of an embodiment of the present invention, there is provided an automated RASP device based on traffic classification and code analysis, the device comprising:

[0031] The classification module is used to classify the acquired network traffic data through the incremental learning model to obtain normal traffic and abnormal traffic;

[0032] A first analysis module is used to perform static code analysis on the abnormal traffic to obtain a cut-point selection guide;

[0033] A second analysis module is used to implement automated RASP instrumentation based on the cut point selection guidance and dynamic code analysis to determine whether the abnormal traffic contains malicious behavior;

[0034] The blocking module is used to block malicious behavior through RASP when the abnormal traffic contains malicious behavior, and report the malicious behavior.

[0035] According to a third aspect of an embodiment of the present disclosure, there is provided an Internet threat detection and backtracking device based on adaptive abnormal behavior analysis, comprising: a processor; a memory for storing instructions executable by the processor;

[0036] The processor is configured to: execute the executable instructions to implement the steps of the automated RASP method based on traffic classification and code analysis described in any one of the embodiments of the first aspect above.

[0037] According to a fourth aspect of an embodiment of the present invention, there is provided a computer-readable storage medium having computer program instructions stored thereon, wherein the program instructions, when executed by a processor, implement the steps of the automated RASP method based on traffic classification and code analysis described in the first aspect of the present invention.

[0038] The technical solution provided by the present invention may include the following beneficial effects:

[0039] Through the above technical solution, network traffic is classified and marked in real time through an incremental learning model, which effectively distinguishes normal traffic from abnormal traffic, reduces the performance impact of RASP on network applications, and reduces resource loss; by automatically inserting RASP cut-off points into the business code associated with abnormal traffic, dynamic execution and analysis are performed to determine whether it involves malicious behavior that can affect the system; and malicious behavior is blocked through RASP, the security of network applications is monitored, malicious behavior is responded to in a timely manner, and potential attacks are effectively prevented.

[0040] Other features and advantages of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present invention but do not constitute a limitation of the present invention. In the accompanying drawings:

[0042] Figure 1 The invention is a flowchart of an automated RASP method based on traffic classification and code analysis according to an exemplary embodiment.

[0043] Figure 2 is a schematic diagram showing subgraph matching according to an exemplary embodiment.

[0044] Figure 3It is a block diagram of an automated RASP device based on traffic classification and code analysis according to an exemplary embodiment.

[0045] Figure 4 The invention is a block diagram of an electronic device for an automated RASP method based on traffic classification and code analysis according to an exemplary embodiment. DETAILED DESCRIPTION

[0046] In order to facilitate the understanding of the scheme of the present invention, the relevant state of the prior art and the inventive concept of the present invention are first briefly described.

[0047] Existing RASP technology has great advantages over traditional methods, but it also has some limitations and challenges, such as:

[0048] (1) Impact on application performance: Since RASP is directly deployed in the system middleware and detects and intercepts risks in real time, it has a certain impact on business performance. When RASP is started, a large number of requests enter the detection process. At this time, the RASP detection code has not completed preheating, and the detection method is in the bytecode interpretation operation mode, with low execution efficiency, resulting in high processor occupancy at startup. If normal request detection takes too long, it will seriously affect the response speed of the business and even cause request timeouts. During the operation of RASP, because the detection engine takes a long time to execute, it will also cause business timeouts or affect the application's processing of high-concurrency businesses, reducing user experience. Therefore, it is necessary to design a more accurate RASP cut-point location selection method to avoid a large number of redundant cut-points and only cut in at key locations.

[0049] (2) Technical complexity: Since RASP requires an in-depth understanding of the internal logic and data structure of the application, as well as the characteristics and vulnerabilities of various programming languages ​​and frameworks, it requires highly skilled technical personnel to develop and maintain it, and is unable to quickly discover new vulnerabilities and block attacks.

[0050] The present invention proposes an automated RASP method based on traffic classification and code analysis to solve the above technical problems.

[0051] Figure 1 is a flow chart of an automated RASP method based on traffic classification and code analysis according to an exemplary embodiment. Figure 1 As shown, the method comprises the following steps:

[0052] S101. Classify the acquired network traffic data through an incremental learning model to obtain normal traffic and abnormal traffic.

[0053] It is understandable that using the incremental learning model to classify network traffic data as normal or abnormal is, on the one hand, convenient for accepting new training sets in the future, and on the other hand, the incremental learning model can obtain RASP's label judgment on new traffic, and feed RASP's output back to the incremental learning model to continuously improve the model's subsequent judgment effect on network traffic data. After classification, the classification module does not intervene in normal traffic. Once abnormal traffic is identified, it is separated and subsequently analyzed.

[0054] It is worth mentioning that the present invention is not limited to the incremental learning model, but can also be replaced by Incremental Decision Trees: an incremental version of C4.5 and ID3, which can update the decision tree when new data is received without rebuilding the entire tree; Incremental k-Nearest Neighbors (iKNN): when receiving new data, only the nearest neighbor list is updated instead of recalculating the distance of all data points; Incremental Neural Networks: such as Elastic Weight Consolidation (EWC) and Elastic Neural Networks, which can adjust weights when new tasks or data are added to reduce catastrophic forgetting; Incremental Support Vector Machines (iSVM): an incremental version of the support vector machine, which can update the support vector and decision boundary when new data arrives.

[0055] Optionally, before S101, the method may further include:

[0056] Get http or https traffic;

[0057] The network application collection terminal extracts features of http or https traffic to obtain network traffic data.

[0058] It can be understood that the traffic acquisition operation is performed by the network application collection end, which is placed in front of the application business code processing logic. The thread within the collection end extracts features from the unpacked https or http traffic to capture network traffic data in real time.

[0059] S102: Perform static code analysis on abnormal traffic to obtain cut-point selection guidance.

[0060] It is understood that S102 includes:

[0061] Obtain the system server source code and the URL of abnormal traffic;

[0062] Obtain the corresponding code location of the URL of abnormal traffic in the source code of the system server through string matching;

[0063] Perform static code analysis on the abstract syntax tree of the code location to obtain pointcut selection guidance.

[0064] It is understandable that by performing link analysis on abnormal traffic, the system server source code can be obtained, the server code package can be parsed, and the URL (Uniform Resource Locator) obtained from the request header of the abnormal traffic can be used to find the Java code location corresponding to the URL from the source code using string matching. Then, the abstract syntax tree (AST) of the program with the code location as the entry point can be obtained through static code analysis. The specific process is as follows:

[0065] a. Lexical analysis: First, perform lexical analysis on the source code and decompose it into a series of tokens. A token is the smallest grammatical unit in the source code, such as keywords, identifiers, operators, literals, etc.

[0066] b. Syntax Analysis: Next, the tokens are parsed and combined into higher-level structures such as expressions, declarations, and control structures according to the grammatical rules of the programming language.

[0067] c. Build AST: Create AST nodes during syntax analysis and gradually establish the relationship between nodes. Each node represents a syntax structure, such as function definition, variable declaration, assignment statement, etc. The root node of the tree usually represents the entire source code file, while the child nodes represent specific syntax elements and their relationships.

[0068] Based on AST, we can obtain the possible call relationship tree between functions and provide guidance for RASP in selecting cut points.

[0069] S103. Implement automated RASP instrumentation based on point selection guidance and dynamic code analysis to determine whether abnormal traffic contains malicious behavior.

[0070] Optionally, S103 may include:

[0071] According to the cut-point selection guidance and dynamic code analysis, automatic RASP instrumentation is implemented to obtain the call link and parameters of abnormal traffic;

[0072] Determine whether the abnormal traffic has malicious behavior based on the call link and parameters of the abnormal traffic.

[0073] It can be understood that by inserting stubs at the branch joints of the call relationship tree and using the data introspection function of RASP, the function call process and parameters of the abnormal traffic in the network application are obtained. Determine the execution status of program statements such as conditional judgments and loops in the possible call relationship tree to obtain the call link. The function call relationship is defined as: {calling class fully qualified name + method signature, parameters, called class fully qualified name + method signature}, and generate the actual call subgraph of the function relationship according to the call link. For example, the fully qualified name is the package name + class name, such as: com.alibaba.fastjson.JSON, and the function signature refers to the combination of the function name and its parameter type. Then, based on the call link and parameters of the abnormal traffic, determine whether the abnormal traffic has malicious behavior.

[0074] Optionally, judging whether the abnormal traffic contains malicious behavior according to the call link and parameters of the abnormal traffic may include:

[0075] Obtain the function relationship call subgraph of the system server based on dynamic code analysis;

[0076] Match the call subgraph of the abnormal traffic call link and parameters with the function relationship call subgraph in the malicious behavior library of the system server;

[0077] When a match is successful, it is determined that the abnormal traffic contains malicious behavior.

[0078] It is understandable that after obtaining the call link of abnormal traffic, it is necessary to judge the behavior based on the call link and parameters. The dynamic code analysis component generates a function relationship call subgraph in the system. A large web service application is defined as G = (V, E), where each node vi belongs to V, representing a method signature in the system, and the edge (vi, vj) indicates that there is a call relationship between two nodes vi and vj. If the two nodes are linked together, the attacker can call vj through vi. Usually, an attack triggers a function call chain. Assume that the function call chain triggered by a network request on the system G is represented as S = {v1, v2..., vn}, and each function vi (i∈[1, n]) is regarded as a possible attack step, such as remote call, SQL injection, etc.

[0079] Figure 2 is a schematic diagram of subgraph matching according to an exemplary embodiment. Figure 2 As shown in the figure, the call link of a certain abnormal traffic is matched with the function relationship call subgraph in the malicious behavior library of the system server, and the result is used to determine whether the request triggered by the abnormal traffic has generated malicious behavior in the system. If there is malicious behavior, it is handed over to RASP to insert a pile and block the attack call link.

[0080] For example, when performing subgraph matching, the following algorithms can be used: VF2 algorithm: an algorithm based on depth-first search, which improves efficiency by using pruning strategies in the search process. The VF2 algorithm is applicable to the subgraph isomorphism problem of undirected graphs; ISO algorithm (Isomorphism): focuses on finding subgraph matching of graph isomorphism, and uses heuristic search and pruning strategies to optimize the matching process; Subgraph Isomorphism algorithm: solves the subgraph isomorphism problem, checks whether a graph contains another graph as a subgraph, etc.

[0081] S104. When there is malicious behavior in the abnormal traffic, the malicious behavior is blocked by RASP and reported.

[0082] It is understandable that after the real-time attack graph and detection subgraph are generated, RASP technology is used to block malicious behavior at key function call points. For example, when the RASP probe finds that the program calls the "encryption" function with parameters val=18 and key=0xffe03208, it automatically throws an exception. RASP can embed security defense capabilities into the application itself through bytecode injection, so that no matter where the program is executed, it will be fully protected. This feature allows programmers to no longer consider the complicated deployment of application security products, and there is no need to change the firewall rule configuration, so as to provide flexible and changeable protection.

[0083] Optionally, S104 may include:

[0084] When there is malicious behavior in abnormal traffic, RASP is used to block the malicious behavior in the abnormal traffic;

[0085] Report malicious behavior to train the incremental learning model on the system server.

[0086] It is understandable that in addition to blocking malicious behavior, when dynamic code analysis and RASP perform behavioral analysis on abnormal traffic, they will add them to the training set, and the dynamic incremental learning algorithm will integrate these new samples into the current model without the need for retraining. The incremental learning method is used to quickly adapt to changes in the network environment and keep the model fresh through incremental updates, ensuring that the learning process does not lead to overfitting or performance degradation.

[0087] In one embodiment, the present invention is compared with the existing method, and the comparison results are shown in Table 1:

[0088] Table 1

[0089]

[0090] According to the above technical solution, compared with the existing RASP method, the original mode of security personnel manually writing RASP code to insert piles for data introspection and logic intervention has been changed to use traffic diagnosis as a pre-guidance, lock the code location that needs to be inserted according to the current attack situation, and automatically perform dynamic code analysis on this part of the code. The mode improves the automation capability, avoids the performance loss of redundant RASP code to the business code, and greatly expands the application scenarios and usage efficiency of RASP. And by adding the RASP mechanism, its data introspection ability can be used to determine whether there is an attack on the system, greatly reducing the amount of false alarms. And through incremental learning feedback to the model, the traffic classification effect is further improved to form a virtuous circle. A network security in-depth defense system that can continuously optimize itself has been built to provide network applications with more powerful real-time perception and active defense capabilities.

[0091] Figure 3 is a block diagram of an automated RASP device based on traffic classification and code analysis according to an exemplary embodiment. Figure 3 , the automated RASP device 300 based on traffic classification and code analysis may include.

[0092] The classification module 301 is used to classify the acquired network traffic data through the incremental learning model to obtain normal traffic and abnormal traffic;

[0093] The first analysis module 302 is used to perform static code analysis on abnormal traffic to obtain a cut-point selection guide;

[0094] The second analysis module 303 is used to implement automatic RASP instrumentation based on the cut point selection guidance and dynamic code analysis to determine whether the abnormal traffic has malicious behavior;

[0095] The blocking module 304 is used to block the malicious behavior through RASP when there is malicious behavior in the abnormal traffic, and report the malicious behavior.

[0096] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0097] Figure 4 is a block diagram of an electronic device for an automated RASP method based on traffic classification and code analysis according to an exemplary embodiment. Figure 4 As shown, the electronic device 400 may include: a processor 401 and a memory 402 .

[0098] The processor 401 is used to control the overall operation of the electronic device 400 to complete all or part of the steps in the above-mentioned automated RASP method based on traffic classification and code analysis. The memory 402 is used to store various types of data to support the operation of the electronic device 400, and these data may include, for example, instructions for any application or method used to operate on the electronic device 400, and application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, disk or optical disk.

[0099] In an exemplary embodiment, the electronic device 400 can be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned automated RASP method based on traffic classification and code analysis.

[0100] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned automated RASP method based on traffic classification and code analysis are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 402 including program instructions, and the above-mentioned program instructions can be executed by the processor 401 of the electronic device 400 to complete the above-mentioned automated RASP method based on traffic classification and code analysis.

[0101] In another exemplary embodiment, a computer program product is also provided. The computer program product includes a computer program executable by a programmable device, and the computer program has a code portion for executing the above-mentioned automated RASP method based on traffic classification and code analysis when executed by the programmable device.

[0102] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, a variety of simple modifications can be made to the technical solution of the present invention, and these simple modifications all belong to the protection scope of the present invention.

[0103] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations.

[0104] In addition, various embodiments of the present invention may be arbitrarily combined, and as long as they do not violate the concept of the present invention, they should also be regarded as the contents disclosed by the present invention.

Claims

1. An automated RASP method based on traffic classification and code analysis, characterized in that: The method comprises: The acquired network traffic data is classified through the incremental learning model to obtain normal traffic and abnormal traffic; Perform static code analysis on the abnormal traffic to obtain a cut-point selection guide; According to the cut-point selection guidance and dynamic code analysis, automatic RASP instrumentation is implemented to determine whether the abnormal traffic contains malicious behavior; When there is malicious behavior in the abnormal traffic, the malicious behavior is blocked by RASP and reported.

2. The automated RASP method based on traffic classification and code analysis according to claim 1, characterized in that: Before classifying the acquired network traffic data through the incremental learning model to obtain normal traffic and abnormal traffic, the method further includes: Get http or https traffic; The network traffic data is obtained by extracting features of the http or https traffic through a network application collection terminal.

3. The automated RASP method based on traffic classification and code analysis according to claim 1, characterized in that: The performing static code analysis on the abnormal traffic to obtain a cut-point selection guide includes: Obtain the system server source code and the URL of the abnormal traffic; Obtaining the code position corresponding to the URL of the abnormal traffic in the source code of the system server through string matching; Static code analysis is performed on the abstract syntax tree of the code position to obtain the pointcut selection guide.

4. The automated RASP method based on traffic classification and code analysis according to claim 1, characterized in that: The automatic RASP instrumentation is implemented according to the cut-point selection guidance and dynamic code analysis to determine whether the abnormal traffic has malicious behavior, including: According to the cut-point selection guidance and dynamic code analysis, automatic RASP instrumentation is implemented to obtain the call link and parameters of the abnormal traffic; Determine whether the abnormal traffic has malicious behavior based on the call link and parameters of the abnormal traffic.

5. The automated RASP method based on traffic classification and code analysis according to claim 4, characterized in that: The determining, according to the call link and parameters of the abnormal traffic, whether the abnormal traffic has malicious behavior includes: Obtain the function relationship call subgraph of the system server based on dynamic code analysis; Matching the call link and parameters of the abnormal traffic with the function relationship call subgraph in the malicious behavior library of the system server; When a match is successful, it is determined that the abnormal traffic contains malicious behavior.

6. The automated RASP method based on traffic classification and code analysis according to claim 1, characterized in that: When the abnormal traffic contains malicious behavior, blocking the malicious behavior through RASP and reporting the malicious behavior includes: When there is malicious behavior in the abnormal traffic, RASP is used to block the malicious behavior in the abnormal traffic; The malicious behavior is reported and used to train the incremental learning model of the system server.

7. An automated RASP device based on traffic classification and code analysis, characterized in that: The device comprises: The classification module is used to classify the acquired network traffic data through the incremental learning model to obtain normal traffic and abnormal traffic; A first analysis module is used to perform static code analysis on the abnormal traffic to obtain a cut-point selection guide; A second analysis module is used to implement automated RASP instrumentation based on the cut point selection guidance and dynamic code analysis to determine whether the abnormal traffic contains malicious behavior; The blocking module is used to block malicious behavior through RASP when the abnormal traffic contains malicious behavior, and report the malicious behavior.

8. An electronic device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to: execute the executable instructions to implement the steps of the automated RASP method based on traffic classification and code analysis as described in any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the steps of the automated RASP method based on traffic classification and code analysis according to any one of claims 1 to 6 are implemented.

Images