Security protection method and device for application program, equipment and storage medium

Abstract

The invention provides a security protection method and device for an application program, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: collecting a passive traffic log of a function module in a to-be-protected application program, and preprocessing the passive traffic log to obtain the preprocessed passive traffic log and label information of the function module; next, creating a functional module fine-grained view for the to-be-protected application program based on the tag information, and clustering the preprocessed passive traffic logs according to a preset clustering mode to obtain at least one piece of index information; and finally, displaying the fine-grained view of the functional module and the passive traffic log carrying the index information to a user based on a preset display mode. According to the method, surveying and mapping of the function module level of the application program are added, so that a user can fully grasp the number change condition of the function modules of the application program, and risk identification and safety protection are carried out on the application program in time.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, equipment and storage medium for security protection of an application program. Background Art

[0002] In modern enterprises, many key business processes rely on various applications, and their security directly affects the operation of the enterprise. For large-scale, multi-functional and complex applications, real-time monitoring is particularly necessary.

[0003] Currently, when managing applications, most companies usually rely on manual processes and manual operations, such as manually recording and tracking applications, configuration management, updating patches, etc. However, manual management focuses more on the overall operating status of the application and manages the application at the system level, rather than going deep into the functional module level of the application.

[0004] Therefore, the existing technology lacks mapping at the functional module level of the application, and is thus unable to fully grasp the changes in the number of functional modules of the application, and is unable to identify risks and provide security protection for the application in a timely manner. Summary of the invention

[0005] The present application provides a security protection method, device, equipment and storage medium for an application, which is used to solve the technical problems in the prior art that there is a lack of mapping of the functional module level of the application, and thus the inability to fully grasp the changes in the number of functional modules of the application, and the inability to timely identify risks and perform security protection on the application.

[0006] In a first aspect, the present application provides a security protection method for an application program, comprising:

[0007] Collect passive traffic logs of functional modules in the application to be protected;

[0008] Preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs and label information of the functional modules; creating a fine-grained view of the functional modules for the application to be protected based on the label information; wherein the label information represents the quantity change and risk distribution of the functional modules;

[0009] According to a preset clustering method, clustering each of the pre-processed passive traffic logs in the application to be protected to obtain at least one index information; wherein the index information is used to provide a structured view for the clustered passive traffic logs;

[0010] Based on a preset display method, the fine-grained view of the functional module and the passive traffic log carrying index information are displayed to the user.

[0011] In a possible design, preprocessing the collected passive traffic log to obtain the preprocessed passive traffic log and label information of the functional module includes:

[0012] Preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs; wherein the preprocessing includes filtering and deduplication processing;

[0013] Analyze the preprocessed passive traffic log to determine the quantity change and risk distribution of the functional modules corresponding to the preprocessed passive traffic log;

[0014] Based on the quantity change and the risk distribution, corresponding label information is added to the functional module.

[0015] In a possible design, preprocessing the collected passive traffic log to obtain the preprocessed passive traffic log includes:

[0016] Performing integrity check and validity check on the parameter fields of the collected passive traffic logs, and filtering out the passive traffic logs that fail the integrity check and the validity check;

[0017] Selecting a first target parameter field from the parameter fields of the passive traffic log that pass the integrity check and the validity check; performing a hash calculation on the first target parameter field to obtain a hash value corresponding to the passive traffic log;

[0018] All hash values ​​corresponding to all passive traffic logs that have passed the integrity check and the validity check are compared for similarity, and deduplication is performed based on the similarity comparison result to obtain the deduplication-processed passive traffic log.

[0019] In a possible design, analyzing the preprocessed passive traffic log to determine the quantity change and risk distribution of the functional modules corresponding to the preprocessed passive traffic log includes:

[0020] Selecting a second target parameter field from the parameter field of the passive traffic log after the deduplication process;

[0021] Performing address mapping and format conversion on the second target parameter field, and performing combination matching on all the converted second target parameter fields to obtain a corresponding composite identifier; wherein the composite identifier represents a unique identifier after the combination matching of the converted second target parameter fields;

[0022] Obtaining a preset risk function module corresponding to a historical risk vulnerability and / or a newly disclosed risk vulnerability, and a fingerprint feature of the preset risk function module; wherein the fingerprint feature represents an identifier that uniquely identifies the preset risk function module;

[0023] Based on the composite identifier and the fingerprint feature, it is determined whether the functional module corresponding to the passive traffic log after deduplication processing includes the preset risk functional module, so as to determine the risk distribution of the functional module corresponding to the passive traffic log after deduplication processing.

[0024] In a possible design, judging whether the function module corresponding to the passive traffic log after deduplication processing includes the preset risk function module based on the composite identifier and the fingerprint feature, so as to determine the risk distribution of the function module corresponding to the passive traffic log after deduplication processing, includes:

[0025] Based on a preset regular expression, regular calculation is performed on the composite identifier and the fingerprint feature to determine whether the function module corresponding to the passive traffic log after deduplication processing includes the preset risk function module;

[0026] The risk distribution of the functional module corresponding to the passive traffic log after deduplication processing is determined based on the judgment result.

[0027] In a possible design, the analyzing the preprocessed passive traffic log to determine the quantity change and the risk distribution of the functional modules corresponding to the preprocessed passive traffic log further includes:

[0028] Based on the parameter field of the passive traffic log after deduplication processing, the quantity change of the functional modules corresponding to the passive traffic log after deduplication processing is determined.

[0029] In a possible design, creating a fine-grained view of a functional module for the application to be protected based on the tag information includes:

[0030] Obtain domain name information and root directory structure of the application;

[0031] Determine the affiliated branch and generation date of the application based on the domain name information, and determine the affiliated application and function module information of the application based on the root directory structure;

[0032] Determine the affiliated branch, the generation date, the affiliated application, and the functional module information as the asset tag of the application program;

[0033] The tag information of the functional module is added to the asset tag, and a fine-grained view of the functional module is created for the application based on the asset tag.

[0034] In a second aspect, the present application provides a security protection device for an application program, characterized in that it includes:

[0035] A collection module, used to collect passive traffic logs of functional modules in the application to be protected;

[0036] A processing module, used to pre-process the collected passive traffic logs to obtain the pre-processed passive traffic logs and label information of the functional modules; based on the label information, a fine-grained view of the functional modules is created for the application to be protected; wherein the label information represents the quantity change and risk distribution of the functional modules;

[0037] A clustering module, used for clustering the pre-processed passive traffic logs in the application to be protected according to a preset clustering method to obtain at least one index information; wherein the index information is used to provide a structured view for the clustered passive traffic logs;

[0038] The display module is used to display the fine-grained view of the functional module and the passive traffic log carrying index information to the user based on a preset display method.

[0039] In a possible design, the processing module is further used for:

[0040] Preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs; wherein the preprocessing includes filtering and deduplication processing;

[0041] Analyze the preprocessed passive traffic log to determine the quantity change and risk distribution of the functional modules corresponding to the preprocessed passive traffic log;

[0042] Based on the quantity change and the risk distribution, corresponding label information is added to the functional module.

[0043] In a possible design, the processing module further includes: a filtering module, a selection module, a calculation module, a comparison module, and a deduplication module.

[0044] The filtering module is used to perform integrity check and validity check on the parameter fields of the collected passive traffic logs, and filter out the passive traffic logs that fail the integrity check and the validity check;

[0045] The selection module is used to select a first target parameter field from the parameter fields of the passive traffic log that passes the integrity check and the validity check;

[0046] The calculation module is used to perform hash calculation on the first target parameter field to obtain a hash value corresponding to the passive traffic log;

[0047] The comparison module is used to compare the similarity between all hash values ​​corresponding to all passive traffic logs that have passed the integrity check and the validity check;

[0048] The deduplication module is used to perform deduplication processing according to the similarity comparison result to obtain the passive traffic log after the deduplication processing.

[0049] In a possible design, the processing module further includes: an acquisition module and a judgment module.

[0050] The selection module is further used to select a second target parameter field from the parameter field of the passive traffic log after the deduplication process;

[0051] The processing module is further used to perform address mapping and format conversion on the second target parameter field, and perform combination matching on all the converted second target parameter fields to obtain a corresponding composite identifier; wherein the composite identifier represents a unique identifier after the combination matching of the converted second target parameter fields;

[0052] The acquisition module is used to acquire the preset risk function module corresponding to the historical risk vulnerability and / or the newly disclosed risk vulnerability, and the fingerprint feature of the preset risk function module; wherein the fingerprint feature represents an identifier that uniquely identifies the preset risk function module;

[0053] The judgment module is used to judge whether the functional module corresponding to the passive traffic log after deduplication processing includes the preset risk functional module based on the composite identifier and the fingerprint feature, so as to determine the risk distribution of the functional module corresponding to the passive traffic log after deduplication processing.

[0054] In a possible design, the judgment module further includes: a determination module,

[0055] The calculation module is further used to perform regular calculation on the composite identifier and the fingerprint feature based on a preset regular expression to determine whether the function module corresponding to the passive traffic log after deduplication processing includes the preset risk function module;

[0056] The determination module is used to determine the risk distribution of the functional module corresponding to the passive traffic log after deduplication processing based on the judgment result.

[0057] In one possible design, the determination module is further used to determine the change in the number of functional modules corresponding to the passive traffic log after deduplication processing based on the parameter field of the passive traffic log after deduplication processing.

[0058] In a possible design, the processing module further includes: a creation module,

[0059] The acquisition module is further used to acquire the domain name information and root directory structure of the application;

[0060] The determination module is further used to determine the affiliated branch and generation date of the application based on the domain name information, and determine the affiliated application and function module information of the application based on the root directory structure; determine the affiliated branch, the generation date, the affiliated application, and the function module information as the asset tag of the application;

[0061] The creation module is further used to add the tag information of the functional module to the asset tag, and create a fine-grained view of the functional module for the application based on the asset tag.

[0062] In a third aspect, the present application provides an electronic device, including:

[0063] Memory and processor;

[0064] Wherein, the memory stores computer-executable instructions;

[0065] The processor executes the computer-executable instructions stored in the memory to implement the security protection method for the application program as described in the first aspect and various possible implementation methods.

[0066] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement the security protection method for the application program as described in the first aspect and various possible implementation methods.

[0067] In a fifth aspect, the present application provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the security protection method for the application program as described in the first aspect and various possible implementation methods.

[0068] The security protection method, device, equipment and storage medium of the application provided by the present application collect the passive traffic logs of the functional modules in the application to be protected, and pre-process the collected passive traffic logs to obtain the pre-processed passive traffic logs, as well as label information that characterizes the quantity changes and risk distribution of the functional modules. Further, based on the label information, a fine-grained view of the functional module is created for the application to be protected, thereby realizing the refined collection and monitoring of the application at the functional module level. Next, according to the preset clustering method, the pre-processed passive traffic logs in the application to be protected are clustered to obtain at least one index information for providing a structured view for the clustered passive traffic logs. Finally, based on the preset display method, the fine-grained view of the functional module and the passive traffic log carrying the index information are displayed to the user, so that the user can analyze the passive traffic log of the functional module in combination with the fine-grained view of the functional module, and timely discover the changes in the number of new additions and exits of the functional module. In addition, the user can also focus on the risk issues of the new functional modules and the existing functional modules in the application according to the fine-grained view of the functional module, so as to be able to perform security protection in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0070] Figure 1 A system architecture diagram of a security protection method for an application program applicable to an embodiment of the present application;

[0071] Figure 2 A flowchart of a security protection method for an application program provided in an embodiment of the present application;

[0072] Figure 3 A functional structure diagram of a security protection method for an application provided in an embodiment of the present application;

[0073] Figure 4 A schematic diagram of the structure of a security protection device for an application provided in an embodiment of the present application;

[0074] Figure 5 A hardware structure diagram of an electronic device provided in an embodiment of the present application.

[0075] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0076] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0077] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in sequences other than those illustrated or described herein, for example.

[0078] In the embodiments of the present application, the words "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0079] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0080] First, the terms involved in this application are explained:

[0081] Passive traffic: refers to the network traffic collected by monitoring and recording the existing data flows in the network, without actively sending data packets to the network during network monitoring and analysis.

[0082] Functional module: refers to an independent component or part in an application that implements a specific function. Each functional module is usually responsible for handling specific tasks or functions so that the entire application can run more efficiently.

[0083] Many critical business processes in modern enterprises rely on various applications, which means that applications are not just supporting tools, but also a core component of enterprise operations.

[0084] Since applications directly affect the operation of an enterprise, their security becomes a crucial factor. Any security vulnerability or failure may lead to business interruption, data leakage or other serious consequences, thereby damaging the reputation or finances of the enterprise.

[0085] For large-scale, multi-functional and complex applications, management and maintenance are more difficult because these applications are composed of multiple interdependent functional modules, each of which has its own specific functions and potential security risks. In order to ensure the security and normal operation of these complex applications, enterprises need to conduct real-time monitoring to promptly discover and respond to potential security threats or performance issues to prevent the problem from escalating.

[0086] Currently, most enterprises rely mainly on manual processes and manual operations when managing applications, including manually recording and tracking application usage, performing configuration management, and updating security patches. It should be understood that manual management usually focuses on the overall operating status of the application, that is, system-level management. This means that managers may be more concerned about whether the application is running normally, rather than going deep into the specific operation and status of each functional module.

[0087] Since management is mainly concentrated at the system level, existing technologies lack detailed mapping of each functional module within the application, which refers to a detailed understanding of the internal structure of the application and the relationship between functional modules. Further, it makes it difficult for enterprises to grasp the quantity changes and development trends of each functional module within the application, which may lead to the inability to effectively manage and optimize resources when the application is updated or expanded.

[0088] In addition, due to the lack of detailed understanding and monitoring of functional modules, enterprises may not be timely and comprehensive when identifying potential risks and implementing security protection measures, which may result in security vulnerabilities not being discovered and repaired in a timely manner, thereby increasing security risks.

[0089] In response to the above technical problems, the inventors found that it is impossible to understand and monitor the changes and risk distribution of the functional modules inside the application in detail by relying solely on manual management at the system level in the study of the management process of the application. Based on this, the inventors use automated technical means to map the functional modules inside the application through the collected passive traffic logs, and pay attention to the changes in the functional modules at the micro level. At the same time, by matching with the preset risk functional modules of historical risk vulnerabilities and / or newly disclosed risk vulnerabilities, functional modules with potential risk vulnerabilities are discovered, so as to quickly and accurately locate the functional modules with risks.

[0090] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0091] In one possible implementation, Figure 1 1 is a system architecture diagram of a security protection method for an application program in accordance with an embodiment of the present application. Figure 1 As shown, the system for executing the security protection method of the application can be divided into four units according to specific functions, namely, a data acquisition unit, a rule engine unit, a data storage unit, and a data display unit.

[0092] Specifically, the data collection unit continuously and automatically reads the passive traffic data interface, processes the read passive traffic data into a passive traffic log in a fixed format, and sends the passive traffic log to the rule engine unit through a lightweight log collector component.

[0093] It should be noted that the passive traffic logs in the data collection unit are mainly passive traffic logs of functional modules in the application to be protected, supplemented by passive traffic logs from other sources. Among them, passive traffic logs from other sources are divided into two forms: one is direct connection with passive traffic logs of other platforms, and the other is data landing as other local files. If the passive traffic data from other sources is other local files, it is also necessary to convert the file format data into the corresponding log format first.

[0094] The rule engine unit flexibly utilizes various plug-ins in the data processing pipeline to implement operations such as filtering, deduplication, analysis, and marking of passive traffic logs.

[0095] After the passive traffic log is processed by the rule engine unit, it is aggregated to form an index according to a certain rule and stored in the distributed database of the data storage unit in an indexed grouping manner for further search, analysis and display by the subsequent data display unit as needed.

[0096] The data display unit can provide users with a flexible visual analysis platform, which can display the passive traffic logs stored in the data storage unit in an indexed form in a way that is more in line with human reading habits. In addition, it is also possible to implement secondary analysis of functional modules through custom query languages, and to observe the risk distribution and change trends of functional modules by creating visual charts.

[0097] based on Figure 1 In addition to the architecture shown, an embodiment of the present application also provides a method for protecting the security of an application. Figure 2A flowchart of a security protection method for an application provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the security protection methods of this application include:

[0098] S201. Collect passive traffic logs of functional modules in the application to be protected.

[0099] In one possible implementation, a mirror device can be deployed as a probe in a network device that interacts with the application and / or functional module to be protected, continuously monitoring data packets that generate access behaviors through the network, and obtaining passive traffic data passing through the network device.

[0100] Among them, a mirror device is a tool used for network monitoring that can copy network traffic and send it to another device for analysis. A probe refers to a device or software used to monitor and analyze network traffic, which can capture all data packets passing through a network device for further analysis.

[0101] Furthermore, the acquired passive traffic data is converted into a passive traffic log in a fixed format, and the passive traffic log of the functional module in the application to be protected is extracted.

[0102] It can be understood that the above passive traffic data acquisition process and passive traffic log conversion process can be done in Figure 1 The data acquisition unit shown is implemented in the figure.

[0103] S202, preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs and label information of the functional modules; and creating a fine-grained view of the functional modules for the application to be protected based on the label information.

[0104] Specifically, firstly, the collected passive traffic logs are preprocessed to obtain preprocessed passive traffic logs. Then, the preprocessed passive traffic logs are analyzed to determine the quantity changes and risk distribution of the functional modules corresponding to the preprocessed passive traffic logs. Secondly, based on the quantity changes and risk distribution of the functional modules, corresponding label information is added to the functional modules, and finally, a fine-grained view of the functional modules is created for the application to be protected based on the label information. Among them, the functional information represents the quantity changes and risk distribution of the functional modules.

[0105] In a possible implementation, creating a fine-grained view of a functional module for an application to be protected based on tag information specifically includes the following steps:

[0106] Step a1: Get the domain name information and root directory structure of the application.

[0107] Domain name information is usually used to identify and access applications. By analyzing domain name information, we can understand the source of the application and related organizational information. The root directory structure refers to the organization of application files and directories. By analyzing the root directory structure, we can identify the components and functional modules of the application.

[0108] Step a2: determine the branch organization and generation date of the application based on the domain name information, and determine the application and function module information of the application based on the root directory.

[0109] Step a3: determine the affiliated branch, generation date, application, and function module information as the asset tag of the application.

[0110] Step a4: Add the tag information of the functional module to the asset tag, and create a fine-grained view of the functional module for the application based on the asset tag.

[0111] It should be understood that labeling helps to systematically manage and track applications, and the fine-grained view of functional modules helps to gain a deeper understanding of the structure and functionality of applications.

[0112] Specifically, the preprocessing process of the passive traffic log, the analysis process of the preprocessed passive traffic log, and the creation process of the fine-grained view of the functional module can all be described in Figure 1 The rule engine unit is implemented as shown.

[0113] Among them, preprocessing includes filtering and deduplication processing.

[0114] Specifically, the implementation process of the filtering process is: performing integrity check and validity check on the parameter fields of the collected passive traffic logs, and filtering out the passive traffic logs that fail the integrity check and validity check.

[0115] It should be understood that before deduplication processing is performed, the passive traffic log should first be subjected to an integrity check and a validity check to ensure that the passive traffic log is complete and valid, ie, there are no damaged or invalid records.

[0116] The implementation process of deduplication is as follows:

[0117] Step b1: Select a first target parameter field from the parameter fields of the passive traffic log that pass the integrity check and the validity check.

[0118] Among them, the first target field is a key field used for deduplication processing, which is usually a parameter field that can uniquely identify the passive traffic log, such as an Internet Protocol (IP) address, a timestamp, etc.

[0119] Step b2: Perform a hash calculation on the first target parameter field to obtain a hash value corresponding to the passive traffic log.

[0120] Among them, hash calculation is a process of converting input data (first target parameter field) into a fixed-length string (hash value), and the hash value can be used to quickly compare the similarity of data.

[0121] Step b3: perform a similarity comparison between all hash values ​​corresponding to all passive traffic logs that have passed the integrity check and validity check.

[0122] Step b4: perform deduplication processing based on the similarity comparison result to obtain a passive traffic log after deduplication processing.

[0123] It should be understood that the purpose of deduplication is to delete or merge passive traffic logs with high similarity and retain unique records.

[0124] Furthermore, after completing the deduplication processing of the passive traffic log, it is necessary to analyze the pre-processed passive traffic log, which specifically includes the following steps:

[0125] Step c1: Select a second target parameter field from the parameter fields of the passive traffic log after deduplication processing.

[0126] The second target parameter field may be the same as or different from the first target parameter field, and no specific limitation is made here.

[0127] Step c2: performing address mapping and format conversion on the second target parameter field, and performing combination matching on all converted second target parameter fields to obtain a corresponding composite identifier.

[0128] Among them, address mapping and format conversion may involve converting IP addresses into a format that is easier to process, or standardizing data in different formats. The composite identifier represents a unique identifier after the converted second target parameter field combination is matched, and is used to identify a specific combination in the passive traffic log.

[0129] Step c3: obtaining preset risk function modules corresponding to historical risk vulnerabilities and / or newly disclosed risk vulnerabilities, and fingerprint features of the preset risk function modules.

[0130] Fingerprints are unique patterns or features used to identify specific vulnerabilities or risks.

[0131] Step c4: Based on the composite identifier and the fingerprint feature, determine whether the functional modules corresponding to the passive traffic log after deduplication processing include preset risk functional modules to determine the risk distribution of the functional modules corresponding to the passive traffic log after deduplication processing.

[0132] It should be understood that the method of analyzing risky functional modules in passive traffic logs by matching known risk signatures helps to identify potential security threats and evaluate the risk distribution of functional modules in the application.

[0133] In one possible implementation, functional modules and known risk features can be matched in the following manner:

[0134] Step d1: Based on a preset regular expression, regular calculation is performed on the composite identifier and the fingerprint feature to determine whether the function module corresponding to the passive traffic log after deduplication processing includes a preset risk function module.

[0135] Among them, regular expression is a powerful tool for matching string patterns. In step d1, regular expression is used to check whether the composite identifier conforms to certain known risk feature patterns to help identify whether the passive traffic log contains any features related to the preset risk function module.

[0136] Step d2: determine the risk distribution of the functional modules corresponding to the passive traffic log after deduplication processing based on the judgment result.

[0137] It should be understood that according to the matching result of the regular calculation, if the match is successful, it means that the application may contain a preset risk function module, which requires further attention or measures.

[0138] In addition to the risk distribution of functional modules, the process of creating a fine-grained view of functional modules for an application also needs to be combined with the changes in the number of functional modules. Specifically, the changes in the number of functional modules corresponding to the deduplicated passive traffic log can be determined based on the parameter fields of the deduplicated passive traffic log. These parameter fields may include the identifier of the functional module, the number of calls, timestamps, etc. The changes in the number of functional modules reflect the update, expansion, or reduction of the application. The newly added functional modules may be due to the introduction of new functions, while the reduced functional modules may be due to the merger or removal of functions.

[0139] S203: Cluster the pre-processed passive traffic logs in the application to be protected according to a preset clustering method to obtain at least one index information.

[0140] Exemplarily, after the passive traffic log is processed by the rule engine unit, it can be aggregated into an index according to a certain rule based on the affiliated branch, generation date and other specified aggregation conditions, and stored in the distributed database of the data storage unit in an indexed grouping manner for subsequent data display units to further search, analyze and display as needed.

[0141] At this time, the functional modules corresponding to the passive traffic log not only include parameter fields of inherent attributes such as Uniform Resource Locator (URL), request message, response message, server address, IP address, timestamp, etc., but also include label information added by the rule engine unit to characterize the changes in the number of functional modules and the risk distribution.

[0142] S204: Based on a preset display method, the fine-grained view of the functional module and the passive traffic log carrying index information are displayed to the user.

[0143] It can be understood that the fine-grained view of the functional modules and the display process of the passive traffic log in this step can be found in Figure 1 The data display unit shown in the figure is implemented. Based on a flexible visual analysis platform, the fine-grained view of the functional module and the passive traffic log with index information are displayed in a way that is more in line with human reading habits. In addition, the secondary analysis of the functional module is achieved by setting a custom query language, and the risk distribution and change trend of the functional module are observed by creating a visual chart.

[0144] In summary, based on Figure 1 The architecture shown and Figure 2 In the process shown, the four units (data collection unit, rule engine unit, data storage unit, and data display unit) in the system for executing the security protection method for application programs respectively provide different data processing functions. Figure 3 The functional structure diagram of the security protection method for the application provided in the embodiment of the present application is as follows: Figure 3 As shown, the data collection unit provides four functions: interface reading, file parsing, standard format, and real-time transmission. The rule engine unit provides filtering processing, deduplication processing, data analysis, and tagging processing. The data storage unit provides data aggregation and index storage functions. In the data storage unit, the functional module corresponding to the passive traffic log includes not only the parameter fields of inherent attributes, but also the newly added label information. In addition to being able to display the quantity changes and risk distribution of functional modules, the data display unit also provides visual analysis, custom query, and chart trend observation functions.

[0145] For example, by creating a fine-grained view of the functional modules, it is possible to timely detect the existing, newly added, and changed functional modules, meeting the needs of risk discovery and monitoring and early warning under the rapid iteration of applications. On this basis, a variety of deduplication rules can be constructed according to the path structure and parameter fields of the functional modules, and accurate deduplication can be achieved through similarity calculation and aggregation to identify the unique access URL of the functional module and its corresponding passive traffic log. In addition, the functional modules can be marked according to the root directory structure and access entry of the application. By building a set of "organization-application-functional module" rule feature system, feature detection of the passive traffic log of the functional module can be achieved, and the full amount of functional points contained in each application and its corresponding access URL can be accurately grasped. For example, for the file upload function, multiple types of rules covering URL, request header field, request package content, and response package content are constructed to identify the file upload function.

[0146] In another possible example, since there is a large amount of information related to applications in passive traffic logs, by formulating feature rules to perform feature detection on passive traffic logs, full coverage of fingerprint, risk, and vulnerability identification can be achieved, such as fingerprint identification of multiple types of high-risk components, identification of multiple types of risks, and detection of multiple types of exploitable vulnerabilities. In addition, it can also solve the pain point that penetration testing is limited by the login environment and achieve risk analysis coverage of the login status.

[0147] It can be seen that the present application can determine the addition and disappearance of functional modules according to the first appearance time or the final appearance time of the functional modules. It can also be aggregated into different index storages according to the affiliated branch and the generation date, and the URL and the application name are matched and marked through the rule engine unit, so as to accurately monitor and discover the changes in the number of functional modules of specific applications of specific institutions. The rule engine unit can also be used to identify application fingerprints and risk markings, such as discovering vulnerabilities that lead to the leakage of user identity information through the rule engine unit.

[0148] The security protection method for applications provided by the present application collects passive traffic logs of functional modules in the application to be protected, performs preprocessing including filtering and deduplication processing on the collected passive traffic logs, and obtains the preprocessed passive traffic logs. Then the preprocessed passive traffic logs are analyzed, and the number of functional modules corresponding to the passive traffic logs after deduplication processing is determined according to the parameter fields of the passive traffic logs. Further, through regular calculation, the functional modules in the application to be protected are matched with the preset risk vulnerabilities corresponding to the historical risk vulnerabilities and / or the newly disclosed risk vulnerabilities to confirm whether the functional modules in the application to be protected include the preset risk functional modules, and then determine the risk distribution of the functional modules. Combined with the number changes and risk distribution of the functional modules, the corresponding label information is added to the functional modules. In addition, the asset tags including the affiliated branch, generation date, affiliated application and functional module information are determined through the domain name information and root directory structure of the application to be protected, and the asset tags and the label information of the functional modules are combined to create a fine-grained view of the functional modules for the application, thereby realizing the refined collection and monitoring of the application at the functional module level. Next, according to the preset clustering method, the pre-processed passive traffic logs in the application to be protected are clustered to obtain at least one index information for providing a structured view for the clustered passive traffic logs. Finally, based on the preset display method, the fine-grained view of the functional module and the passive traffic logs carrying the index information are displayed to the user, so that the user can analyze the passive traffic logs of the functional module in combination with the fine-grained view of the functional module, and timely discover the changes in the number of new functional modules, such as the withdrawal and removal of functional modules. In addition, the user can also focus on the risk issues of new functional modules and existing functional modules in the application according to the fine-grained view of the functional module, so as to be able to carry out security protection in a timely manner.

[0149] Figure 4 A schematic diagram of the structure of the security protection device for the application provided in the embodiment of the present application, such as Figure 4 As shown, the security protection device 400 of the application includes: a collection module 401, a processing module 402, a clustering module 403, and a display module 404;

[0150] Wherein, the collection module 401 is used to collect the passive traffic logs of the functional modules in the application to be protected;

[0151] The processing module 402 is used to pre-process the collected passive traffic logs to obtain the pre-processed passive traffic logs and label information of the functional modules; based on the label information, a fine-grained view of the functional modules is created for the application to be protected; wherein the label information represents the quantity change and risk distribution of the functional modules;

[0152] The clustering module 403 is used to cluster the pre-processed passive traffic logs in the application to be protected according to a preset clustering method to obtain at least one index information; wherein the index information is used to provide a structured view for the clustered passive traffic logs;

[0153] The display module 404 is used to display the fine-grained view of the functional module and the passive traffic log carrying index information to the user based on a preset display method.

[0154] In one possible design, the processing module 402 is further configured to:

[0155] Preprocessing the collected passive traffic logs to obtain preprocessed passive traffic logs; wherein the preprocessing includes filtering processing and deduplication processing;

[0156] Analyze the pre-processed passive traffic logs to determine the quantity changes and risk distribution of the functional modules corresponding to the pre-processed passive traffic logs;

[0157] Based on quantity changes and risk distribution, add corresponding label information to the functional modules.

[0158] In a possible design, the processing module 402 further includes: a filtering module 405, a selecting module 406, a calculating module 407, a comparing module 408, and a deduplication module 409.

[0159] The filtering module 405 is used to perform integrity check and validity check on the parameter fields of the collected passive traffic logs, and filter out the passive traffic logs that fail the integrity check and validity check;

[0160] A selection module 406, configured to select a first target parameter field from the parameter fields of the passive traffic log that pass the integrity check and the validity check;

[0161] A calculation module 407, configured to perform a hash calculation on the first target parameter field to obtain a hash value corresponding to the passive traffic log;

[0162] A comparison module 408 is used to compare the similarity between all hash values ​​corresponding to all passive traffic logs that have passed the integrity check and the validity check;

[0163] The deduplication module 409 is used to perform deduplication processing according to the similarity comparison result to obtain the passive traffic log after deduplication processing.

[0164] In a possible design, the processing module 402 further includes: an acquisition module 410, a determination module 411,

[0165] The selection module 406 is further used to select a second target parameter field from the parameter field of the passive traffic log after deduplication processing;

[0166] The processing module 402 is further used to perform address mapping and format conversion on the second target parameter field, and perform combination matching on all the converted second target parameter fields to obtain a corresponding composite identifier; wherein the composite identifier represents a unique identifier after the combination matching of the converted second target parameter fields;

[0167] The acquisition module 410 is used to acquire the preset risk function module corresponding to the historical risk vulnerability and / or the newly disclosed risk vulnerability, and the fingerprint feature of the preset risk function module; wherein the fingerprint feature represents an identifier that uniquely identifies the preset risk function module;

[0168] The judgment module 411 is used to judge whether the functional modules corresponding to the passive traffic log after deduplication processing include preset risk functional modules based on the composite identifier and fingerprint features, so as to determine the risk distribution of the functional modules corresponding to the passive traffic log after deduplication processing.

[0169] In a possible design, the judging module 411 further includes: a determining module 412,

[0170] The calculation module 407 is further used to perform regular calculation on the composite identifier and the fingerprint feature based on a preset regular expression to determine whether the function module corresponding to the passive traffic log after deduplication processing includes a preset risk function module;

[0171] The determination module 412 is used to determine the risk distribution of the functional modules corresponding to the passive traffic log after deduplication processing based on the judgment result.

[0172] In one possible design, the determination module 412 is further used to determine the change in the number of functional modules corresponding to the passive traffic log after deduplication processing based on the parameter field of the passive traffic log after deduplication processing.

[0173] In a possible design, the processing module 402 further includes: a creating module 413,

[0174] The acquisition module 410 is also used to obtain the domain name information and root directory structure of the application;

[0175] The determination module 412 is further used to determine the affiliated branch and generation date of the application based on the domain name information, and determine the affiliated application and functional module information of the application based on the root directory structure; and determine the affiliated branch, generation date, affiliated application, and functional module information as the asset tag of the application;

[0176] The creation module 413 is further used to add the tag information of the functional module to the asset tag, and to create a fine-grained view of the functional module for the application based on the asset tag.

[0177] The security protection device for an application provided in an embodiment of the present application may be used to execute the security protection method for an application in any of the above embodiments. The implementation principle and technical effects thereof are similar and will not be described in detail here.

[0178] It should be noted that it should be understood that the division of the various modules of the above device is only a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. And these modules can all be implemented in the form of software calling through processing elements; they can also be all implemented in the form of hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in the form of hardware. In addition, all or part of these modules can be integrated together, or they can be implemented independently. The processing element described here can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each module above can be completed by an integrated logic circuit of hardware in the processor element or instructions in the form of software.

[0179] Figure 5 The hardware structure diagram of the electronic device provided in this application. Figure 5 As shown, the electronic device 500 includes:

[0180] Processor 501 and memory 502;

[0181] Memory stores computer-executable instructions;

[0182] The processor executes the computer execution instructions stored in the memory 502, so that the electronic device executes the security protection method for the application program as described above.

[0183] It should be understood that the processor 501 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), or application-specific integrated circuits (ASIC). A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor. The memory 502 may include a high-speed random access memory (RAM), or may also include a non-volatile memory (NVM), such as at least one disk memory, or may be a USB flash drive, a mobile hard disk, a read-only memory, a disk, or an optical disk.

[0184] The electronic device provided in the embodiment of the present application can be used to execute the security protection method for the application provided in any of the above method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0185] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the security protection method for the application program as described above.

[0186] The embodiment of the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it is used to implement the security protection method for the application program as described above.

[0187] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present application.

[0188] It should be further noted that, although the various steps in the flowchart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless there is a clear description in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowchart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0189] It should be understood that the above-mentioned device embodiments are only illustrative, and the device of the present application can also be implemented in other ways. For example, the division of units / modules in the above-mentioned embodiments is only a logical function division, and there may be other division methods in actual implementation. For example, multiple units, modules or components can be combined, or can be integrated into another system, or some features can be ignored or not executed.

[0190] In addition, unless otherwise specified, each functional unit / module in each embodiment of the present application may be integrated into one unit / module, each unit / module may exist physically separately, or two or more units / modules may be integrated together. The above-mentioned integrated unit / module may be implemented in the form of hardware or in the form of a software program module.

[0191] If the integrated unit / module is implemented in the form of hardware, the hardware may be a digital circuit, an analog circuit, etc. The physical implementation of the hardware structure includes but is not limited to transistors, memristors, etc. If not specifically stated, the processor may be any appropriate hardware processor, such as a CPU, a GPU, an FPGA, a DSP, an ASIC, etc. If not specifically stated, the storage unit may be any appropriate magnetic storage medium or magneto-optical storage medium, such as a resistive random access memory RRAM (Resistive Random Access Memory), a dynamic random access memory DRAM (Dynamic Random Access Memory), a static random access memory SRAM (Static Random-Access Memory), an enhanced dynamic random access memory EDRAM (Enhanced Dynamic Random Access Memory), a high-bandwidth memory HBM (High-Bandwidth Memory), a hybrid memory cube HMC (Hybrid Memory Cube), etc.

[0192] If the integrated unit / module is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0193] In the above embodiments, the description of each embodiment has its own emphasis. For the part not described in detail in a certain embodiment, please refer to the relevant description of other embodiments. The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0194] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0195] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A security protection method for an application, characterized in that: include: Collect passive traffic logs of functional modules in the application to be protected; Preprocessing the collected passive traffic log to obtain the preprocessed passive traffic log and label information of the functional module; Creating a fine-grained view of functional modules for the application to be protected based on the label information; wherein the label information represents the quantity change and risk distribution of the functional modules; According to a preset clustering method, clustering each of the pre-processed passive traffic logs in the application to be protected to obtain at least one index information; wherein the index information is used to provide a structured view for the clustered passive traffic logs; Based on a preset display method, the fine-grained view of the functional module and the passive traffic log carrying index information are displayed to the user.

2. The method according to claim 1, characterized in that The preprocessing of the collected passive traffic log to obtain the preprocessed passive traffic log and the label information of the functional module includes: Preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs; wherein the preprocessing includes filtering and deduplication processing; Analyze the preprocessed passive traffic log to determine the quantity change and risk distribution of the functional modules corresponding to the preprocessed passive traffic log; Based on the quantity change and the risk distribution, corresponding label information is added to the functional module.

3. The method according to claim 2, characterized in that The preprocessing of the collected passive traffic log to obtain the preprocessed passive traffic log includes: Performing integrity check and validity check on the parameter fields of the collected passive traffic logs, and filtering out the passive traffic logs that fail the integrity check and the validity check; Selecting a first target parameter field from the parameter fields of the passive traffic log that pass the integrity check and the validity check; performing a hash calculation on the first target parameter field to obtain a hash value corresponding to the passive traffic log; All hash values ​​corresponding to all passive traffic logs that have passed the integrity check and the validity check are compared for similarity, and deduplication is performed based on the similarity comparison result to obtain the deduplication-processed passive traffic log.

4. The method according to claim 3, characterized in that The analyzing the pre-processed passive traffic log to determine the quantity change and risk distribution of the functional modules corresponding to the pre-processed passive traffic log includes: Selecting a second target parameter field from the parameter field of the passive traffic log after the deduplication process; Performing address mapping and format conversion on the second target parameter field, and performing combination matching on all the converted second target parameter fields to obtain a corresponding composite identifier; wherein the composite identifier represents a unique identifier after the combination matching of the converted second target parameter fields; Obtaining a preset risk function module corresponding to a historical risk vulnerability and / or a newly disclosed risk vulnerability, and a fingerprint feature of the preset risk function module; wherein the fingerprint feature represents an identifier that uniquely identifies the preset risk function module; Based on the composite identifier and the fingerprint feature, it is determined whether the functional module corresponding to the passive traffic log after deduplication processing includes the preset risk functional module, so as to determine the risk distribution of the functional module corresponding to the passive traffic log after deduplication processing.

5. The method according to claim 4, characterized in that The determining, based on the composite identifier and the fingerprint feature, whether the function module corresponding to the passive traffic log after the deduplication processing includes the preset risk function module to determine the risk distribution of the function module corresponding to the passive traffic log after the deduplication processing, includes: Based on a preset regular expression, regular calculation is performed on the composite identifier and the fingerprint feature to determine whether the function module corresponding to the passive traffic log after deduplication processing includes the preset risk function module; The risk distribution of the functional module corresponding to the passive traffic log after deduplication processing is determined based on the judgment result.

6. The method according to claim 3, characterized in that: The analyzing the pre-processed passive traffic log to determine the quantity change and the risk distribution of the functional modules corresponding to the pre-processed passive traffic log further includes: Based on the parameter field of the passive traffic log after deduplication processing, the quantity change of the functional modules corresponding to the passive traffic log after deduplication processing is determined.

7. The method according to any one of claims 1 to 6, characterized in that The creating a fine-grained view of a functional module for the application to be protected based on the tag information includes: Obtain domain name information and root directory structure of the application; Determine the affiliated branch and generation date of the application based on the domain name information, and determine the affiliated application and function module information of the application based on the root directory structure; Determine the affiliated branch, the generation date, the affiliated application, and the functional module information as the asset tag of the application program; The tag information of the functional module is added to the asset tag, and a fine-grained view of the functional module is created for the application based on the asset tag.

8. A security protection device for an application, characterized in that: include: A collection module, used to collect passive traffic logs of functional modules in the application to be protected; A processing module, used for preprocessing the collected passive traffic logs to obtain the preprocessed passive traffic logs and label information of the functional modules; Creating a fine-grained view of functional modules for the application to be protected based on the label information; wherein the label information represents the quantity change and risk distribution of the functional modules; A clustering module, used for clustering the pre-processed passive traffic logs in the application to be protected according to a preset clustering method to obtain at least one index information; wherein the index information is used to provide a structured view for the clustered passive traffic logs; The display module is used to display the fine-grained view of the functional module and the passive traffic log carrying index information to the user based on a preset display method.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the security protection method for the application program according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the security protection method for an application program according to any one of claims 1 to 7.

Images