Safety probe management method and device for application program

Abstract

The invention provides a security probe management method and device for an application program, and the method comprises the steps: obtaining a first parameter and a second parameter of each hook point of a security probe of a to-be-detected application program, taking the first parameter and the second parameter of each hook point as design variables, so as to construct a multi-target game model, determining an optimal solution of a plurality of objective functions of the multi-objective game model, and calculating a solution of each hook point according to the optimal solution; sorting each hook point according to the sequence of the values of the solutions from small to large; monitoring the load condition of the to-be-detected application program, when the load condition exceeds a first threshold value, sequentially closing the corresponding hook points according to the sequence of the values of the solutions from small to large, and stopping closing the hook points until the load condition of the to-be-detected application program is reduced to be within a second threshold value; wherein the second threshold value is smaller than or equal to the second threshold value, so that the safety of the system is improved on the basis of ensuring the performance of the system.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of security detection technology, and more particularly to a method and device for managing security probes of an application. Background Art

[0002] With the rapid development of information technology, network security issues are becoming increasingly prominent. RASP (Runtime Application Self-Protection) is a new application security protection technology that can detect and block security attacks in real time, enabling applications to have self-protection capabilities. However, while protecting applications, the setting of RASP probes will also introduce certain performance overhead, especially when the CPU (Central Processing Unit) and memory load are high, this overhead may be more obvious and affect the overall system performance.

[0003] In the existing solutions, users are allowed to choose the appropriate protection method through customized protection rules. When the CPU and memory loads are high, the solution often used is to directly uninstall and close all hook (hook, a technical means used to modify, control or monitor the behavior of systems and software) point policies to try to ensure the normal operation of user services, and reload them when the CPU and memory loads are reduced. Although the performance overhead of RASP probes can be reduced by reducing the protection rules, the appropriate rules require professional security personnel to conduct detailed analysis to derive. Most users lack relevant security knowledge and cannot consider multiple goals such as vulnerability hazards, CPU usage, memory usage and running time at the same time. Therefore, how to reduce the performance overhead of RASP probes while ensuring application security has become an urgent problem to be solved. Summary of the invention

[0004] The embodiment of the present application provides a security probe management method and device for an application program to solve the technical problem in the related art that when the CPU and memory load of the system are high, the system security is reduced by directly unloading and closing all HOOK points.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a method for managing a security probe of an application, the method comprising:

[0007] Obtain a first parameter and a second parameter of each hook point of the security probe of the application to be detected, wherein the first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point;

[0008] The first parameter and the second parameter of each hook point are used together as design variables of a multi-objective game model, and a multi-objective game model is constructed based on the design variables. The multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupation and risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment; the game party of the multi-objective game model is each hook point;

[0009] Determining optimal solutions of the multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter;

[0010] According to the optimal solution, the solution of each hook point is calculated; each hook point is sorted in order of the solution value from small to large;

[0011] Monitor the load condition of the application to be detected. When the load condition exceeds a first threshold, close the corresponding hook points in order from small to large in solution value, until the load condition of the application to be detected drops to within a second threshold, and then stop closing the hook points; wherein the second threshold is less than or equal to the second threshold.

[0012] Optionally, determining the optimal solutions of the multiple objective functions includes:

[0013] According to the multiple objective functions and the preset weight values ​​corresponding to each objective function, the multiple objective functions are weighted summed to obtain an evaluation function of the multi-objective game model;

[0014] The solution when the evaluation function takes the minimum value is determined as the optimal solution.

[0015] Optionally, when monitoring the load of the application to be detected, when the load of the application to be detected exceeds a first threshold, closing the corresponding hook points in order of solution values ​​from small to large, until the load of the application to be detected drops to within a second threshold, after stopping closing the hook points, the method further includes:

[0016] Continuously monitor the load condition of the application to be detected. When the load condition is lower than a third threshold, open the closed hook points in order of the solution values ​​of the closed hook points from large to small, until the load condition of the application to be detected reaches a second preset threshold, and then stop opening the closed hook points, wherein the third threshold is smaller than the second threshold.

[0017] Optionally, after obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected, the method further includes:

[0018] Based on the first parameter, the second parameter and the current event, the danger level of the application to be detected is evaluated, wherein the current event includes at least one of the following: abnormal attack behavior on the application to be detected, malicious request behavior on the application to be detected and data leakage of the application to be detected.

[0019] Optionally, when monitoring the load of the application to be detected, when the load exceeds a first threshold, closing corresponding hook points in order of solution values ​​from small to large, until the load of the application to be detected drops to within a second threshold, after stopping closing the hook points, the method further includes:

[0020] Continue to monitor the load of the application to be detected, and when the load is lower than the third threshold and the danger level of the application to be detected changes, reconstruct a new multi-objective game model based on the first parameter and the second parameter of the currently running hook point and the most recently recorded first parameter and second parameter of the closed hook point before being closed, and determine the evaluation function of the new multi-objective game model based on the new multiple objective functions of the new multi-objective game model;

[0021] Determine the solution when the evaluation function of the new multi-objective game model takes the minimum value as the optimal solution of the new multi-objective game model;

[0022] According to the optimal solution of the new multi-objective game model, the solution of each hook point is re-determined based on the game strategy; and each hook point is newly sorted in the order of the solution value from small to large;

[0023] The closed hook points are opened, and the hook points are closed again in the order of the solution values ​​from small to large in the new sorting, wherein the third threshold is smaller than the second threshold.

[0024] Optionally, the first parameter includes at least one of the following: CPU occupancy, memory occupancy, JVM heap memory occupancy and metaspace occupancy;

[0025] The second parameter includes at least one of the following: the vulnerability risk level of the hook point, the number of calls to the hook, the number of business hits of the hook point, and the spread breadth of the hook point.

[0026] In a second aspect, an embodiment of the present application provides a security probe management device for an application, the device comprising:

[0027] An acquisition module, used to acquire a first parameter and a second parameter of each hook point of the security probe of the application to be detected, wherein the first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point;

[0028] An execution module, used for taking the first parameter and the second parameter of each hook point as design variables of a multi-objective game model, and constructing a multi-objective game model based on the design variables, wherein the multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupancy and risk assessment of the hook point, with the goal of minimizing the resource occupancy and minimizing the risk assessment; the game party of the multi-objective game model is each hook point;

[0029] Determining optimal solutions of the multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter;

[0030] According to the optimal solution, the solution of each hook point is calculated; each hook point is sorted in order of the solution value from small to large;

[0031] Monitor the load condition of the application to be detected. When the load condition exceeds a first threshold, close the corresponding hook points in order from small to large in solution value, until the load condition of the application to be detected drops to within a second threshold, and then stop closing the hook points; wherein the second threshold is less than or equal to the second threshold.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of a security probe management method for an application as described in the first aspect are implemented.

[0033] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of a security probe management method for an application as described in the first aspect are implemented.

[0034] In a fifth aspect, an embodiment of the present application provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of a security probe management method for an application as described in the first aspect.

[0035] Therefore, by monitoring the resource usage and risk assessment of each hook point in the application to be tested, a multi-objective game model is constructed to optimize resource usage and security management. When the system load exceeds the threshold, the hook points with high resource usage and poor risk assessment (higher impact on security) are closed first, and dynamic adjustments are made to improve system performance and stability, thereby achieving an effective balance between resources and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0037] Figure 1 A flowchart of a security probe management method for an application provided in an embodiment of the present application;

[0038] Figure 2 A system architecture block diagram of a RASP provided for the implementation of this application;

[0039] Figure 3 A flowchart of a security probe management method for an application provided in an embodiment of the present application;

[0040] Figure 4 A structural block diagram of a security probe management device for an application provided in an embodiment of the present application;

[0041] Figure 5 A structural block diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0043] Figure 1 A security probe management method for an application program provided in accordance with an embodiment of the present application is shown. Figure 1 As shown, the method includes:

[0044] Step S101, obtaining a first parameter and a second parameter of each hook point of a security probe of an application to be detected;

[0045] The first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point;

[0046] Step S102: taking the first parameter and the second parameter of each hook point as design variables of the multi-objective game model, and constructing the multi-objective game model based on the design variables;

[0047] Among them, the multi-objective game model has multiple objective functions, which are used to comprehensively evaluate the resource occupation and risk assessment of the hook point, with the goal of minimizing the resource occupation and minimizing the risk assessment; the game party of the multi-objective game model is each hook point;

[0048] Step S103, determining the optimal solutions of multiple objective functions;

[0049] Wherein, the optimal solution is a combination of the first parameter and the second parameter;

[0050] Step S104: Calculate the solution of each hook point according to the optimal solution; sort each hook point in order of the solution value from small to large;

[0051] Step S105, monitoring the load of the application to be detected, when the load exceeds the first threshold, closing the corresponding hook points in order of the solution values ​​from small to large, until the load of the application to be detected drops to within the second threshold, then stop closing the hook points;

[0052] The second threshold is less than or equal to the second threshold.

[0053] It should be noted that the first parameter includes at least one of the following: CPU occupancy, memory occupancy, JVM heap memory occupancy and metaspace occupancy; the second parameter includes at least one of the following: the vulnerability risk level of the hook point, the number of hook calls, the number of business hits at the hook point, and the spread of the hook point.

[0054] In one possible implementation, step S103, determining the optimal solution of multiple objective functions includes: performing weighted sum calculation on the multiple objective functions according to the weight values ​​corresponding to each objective function in the multiple objective functions and the preset multiple objective functions, to obtain an evaluation function of the multi-objective game model; and determining the solution when the evaluation function takes the minimum value as the optimal solution.

[0055] In one possible implementation, in step S105, while monitoring the load of the application to be detected, when the load of the application to be detected exceeds a first threshold, the corresponding hook points are closed in order of solution values ​​from small to large, until the load of the application to be detected drops to within a second threshold, and the hook points are stopped from being closed. The method also includes: continuously monitoring the load of the application to be detected, and when the load is lower than a third threshold, the closed hook points are opened in order of solution values ​​of the closed hook points from large to small, until the load of the application to be detected reaches a second preset threshold, and the closed hook points are stopped from being opened, wherein the third threshold is smaller than the second threshold.

[0056] In one possible implementation, after obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected in step S101, the method further includes: evaluating the danger level of the application to be detected based on the first parameter, the second parameter and the current event, wherein the current event includes at least one of the following: abnormal attack behavior on the application to be detected, malicious request behavior on the application to be detected and data leakage of the application to be detected.

[0057] In a possible implementation, in step S105, the load of the application to be detected is monitored, and when the load exceeds the first threshold, the corresponding hook points are closed in order from small to large in the order of the solution value, until the load of the application to be detected is reduced to within the second threshold, and the closing of the hook points is stopped. The method also includes: continuing to monitor the load of the application to be detected, when the load is lower than the third threshold and the danger level of the application to be detected changes, based on the first parameter and the second parameter of the currently running hook point and the first parameter of the closed hook point before being closed, the most recent recorded The method comprises the following steps: reconstructing a new multi-objective game model by using the first parameter and the second parameter, determining an evaluation function of the new multi-objective game model based on the new multiple objective functions of the new multi-objective game model; determining a solution when the evaluation function of the new multi-objective game model takes the minimum value as the optimal solution of the new multi-objective game model; re-determining the solution of each hook point based on the game strategy according to the optimal solution of the new multi-objective game model; and re-sorting each hook point in ascending order of the solution value; opening the closed hook point, and re-closing the hook point in ascending order of the solution value in the new sorting, wherein the third threshold value is smaller than the second threshold value.

[0058] It should be noted that based on Figure 1The method shown can dynamically evaluate the impact of each hook point on application performance and their importance to security protection. Different hook points may target different security threats or vulnerabilities, so their importance is not the same. Based on these evaluations, the probe can selectively close those hook points that have a greater impact on performance or have relatively low current security protection requirements. In order to adaptively adjust the state of the hook point, the application load, attack threat level and performance overhead of the RASP probe can be monitored in real time. Based on these real-time monitoring data, the probe can automatically adjust which hook points should be activated or closed. When closing some hook points, it is necessary to ensure that the security of the application will not be seriously affected. This requires finding a balance between security and performance to ensure that the security protection capabilities of the probe are not excessively weakened while reducing performance overhead. Once the probe detects an upgrade in security threats or an improvement in load conditions, based on the above method, the previously closed hook points can be quickly reactivated to ensure that the security protection capabilities of the probe are restored in a timely manner.

[0059] It should be noted that the system architecture of RASP can be Figure 2 As shown, RASP can implement intrusion detection and protection in the running state of the application by injecting protection code into the key functions of the application, and monitor and analyze the runtime behavior of the application in real time, including request parameters, file reading and writing, database operations, etc.

[0060] The method shown in the embodiment of this application (see Figure 3 ) can continuously monitor the application load status, the real-time level of attack threats, and the performance overhead of the RASP probe during operation through the rasp agent probe. Based on these real-time feedback data, this method can intelligently and automatically decide to scale the protection of the hook point. This adaptive method ensures that the system can maintain efficient operation and effectively respond to potential security threats. The specific steps are:

[0061] 1. The CPU usage, memory usage, JVM heap memory usage and metaspace usage of each HOOK point of the application are collected through the rasp agent;

[0062] 2. Set the evaluation scores of the vulnerability risk level corresponding to the hook point, the number of hook calls, the number of business hits and the spread breadth in the application security risk level;

[0063] 3. Based on data collection over a period of time, obtain the weighted sum of CPU, memory, JVM memory and metaspace occupancy of multiple application corresponding hook points;

[0064] 4. Build a multi-objective game model, which takes the CPU, memory, JVM memory and metaspace occupancy of the hook point as the target, and predicts the hook points that need to be closed under the current system state through game theory methods.

[0065] 5. Release each HOOK point into the HOOK point array: Z[];

[0066] 6. Sort the values ​​from small to large: Z = sort(Z[]);

[0067] 7. Monitor the application load in real time. When the CPU and memory loads are detected to be high, the HOOK points are closed in sequence according to the sorting until the load is balanced and recorded. When the CPU and memory loads are detected to be reduced, if a change in the danger level is detected, the array Y needs to be recalculated based on the closed records, and the corresponding HOOK points are activated in sequence. This can effectively reduce the performance overhead of the RASP probe and improve the overall performance of the system while ensuring application security.

[0068] In the refinement of step 4, it should be noted that game theory, also known as game theory, is a mathematical model for studying strategic interactions between rational decision makers. It has applications in various fields of social science, logic, and computer science. Initially, it discussed zero-sum games, where one person's gain leads to losses for other participants. Today, game theory applies to a wide range of behavioral relationships and is now a general term for the logical decision science of humans, animals, and computers. In many real-world decision problems, multi-objective problems are more extensive than single-objective problems, and decision makers often need to consider multiple objectives to make decisions more realistically. Multi-objective games are a scientific and effective way to solve multi-objective problems. Multi-objective problems can be converted into solving the minimum value of F(X).

[0069] The objective function is:

[0070] F(X)={f1(X),f2(X),...,f m (X)}

[0071] The design variables are:

[0072] X={x1,x2,...,x m}

[0073] The above formula must satisfy the constraint condition a i ≤x i ≤ b i ;h l (X) = 0; g k (X)≤0; i=(1,2,...,n); l=(1,2,...,p); k=(1,2,...,q).i , b i x i The upper and lower limits ai, m is the number of design variables, h l (X) is the lth equality constraint, g k (X) is the kth inequality constraint, p is the number of non-upper and lower bound equality constraints, and q is the number of non-upper and lower bound inequality constraints.

[0074] According to the game theory model, G represents a game with n players, and each player i has S i strategy space, storing all possible strategies, S ij represents the jth strategy of player i. The possible payoff of player i is U i , U ij represents the profit obtained by player i adopting the jth strategy. The game played by N players is: G = {S1, S2, ..., S n ; U1, U2, ..., U m}

[0075] To solve multi-objective problems using game theory, we first need to transform multi-objective problems into game problems. The n design objectives in the multi-objective problem correspond to the n players in the game, the design variable X corresponds to the strategy space S, the objective function corresponds to the game payoff, and the constraints in the multi-objective problem can be regarded as the constraints of the optional strategies.

[0076] The key to transforming multi-objective problems into game problems is to map the design variables to the strategy space S1, S2, .., S n First, we should determine the degree of influence of the design variables on the benefits of the game players, and perform fuzzy clustering on them, so as to obtain the strategy space S1, S2, ..., S corresponding to each game player. n , the main steps are as follows:

[0077] (1) Perform single-objective optimization on each of the n objectives, and obtain the corresponding optimization solution:

[0078]

[0079] in

[0080] (2) According to the step size Δx j The design variable x j Divide into T segments, then the design variable x j The payoff to the i-th player is f i The impact factor Δ fi for

[0081]

[0082] (3) Let the classification sample be Δ j ={Δ j1 , Δ j2 , ..., Δ jn}(j=1, 2, ..., m), Δ j represents the set of factors affecting the j-th design variable on all n objectives. The classification samples include Perform fuzzy clustering on all samples and classify all design variables X into the strategy space S1, S2, ..., S n middle.

[0083] The tidal adaptive scaling of hook points is a typical multi-objective problem, which requires considering the risk level of the vulnerability corresponding to each hook point, the number of hook calls, the number of business hits, the dimension of the breadth of propagation, and the CPU usage, memory usage, JVM heap memory usage, and metaspace usage released after closure. In response to this type of problem, a multi-objective game problem is proposed.

[0084] The objective function is: F(x) = {f1(X), f2(X), f3(X), f4(X), f5(X)} → min

[0085] The design variables are: X = {C1, λ1, u1, C2, λ2, u2, m, C3, λ3, u3, C4, λ4, u4, k}

[0086] The constraints are: C1≥0, C2≥0, C3≥0, C4≥0

[0087] in:

[0088] f1(X)=(λ1u1+λ2u2+λ3u3+λ4u4)C1

[0089]

[0090] f4(X)=(λ1u1+λ2u2+λ3u3+λ4u4)C3

[0091] f5(X)=(λ1u1+λ2u2+λ3u3+λ4u4)C4

[0092] λ1 is the vulnerability risk rate, which refers to the risk rate corresponding to high risk, medium risk, and low risk according to the vulnerability risk level;

[0093] u1 is the evaluation score of the hazard rate in the entire impact dimension;

[0094] λ2 is the service hit rate, which refers to the frequency of this application hook service entering the detection per unit time;

[0095] u2 is the evaluation score of the business hit rate in the entire impact dimension;

[0096] λ3 is the exploitability, which refers to the scope of spread and exploitability of this vulnerability;

[0097] u3 is the evaluation score of the availability ratio in the entire impact dimension;

[0098] λ4 is the hit rate of this hook, which refers to the hit rate of this service entering this business and being detected as a security risk;

[0099] u4 is the evaluation score of the hook hit rate in the entire impact dimension;

[0100] m is the weighted sum of the CPU, memory, JVM memory usage, and metaspace usage of a single application HOOK point;

[0101] k is the number of applications collected;

[0102] C1 is the CPU usage of this application HOOK point;

[0103] C2 is the memory usage of the HOOK point for this application;

[0104] C3 is the JVM memory usage of this application hook point.

[0105] C4 uses the metaspace occupied by the hook point for this application.

[0106] For the multi-objective game problem in the adaptive telescopic hook point, the linear weighted method is used to transform the multi-objective problem into a single-objective problem for solution.

[0107] Each single objective function fi(X) in F(x)={f1(X), f2(X), f3(X), f4(X), f5(X)}→min is multiplied by the corresponding weight wi and then summed to obtain the evaluation function E(X):

[0108]

[0109] In this way, the multi-objective optimization problem is transformed into a single-objective optimization problem, that is, finding the minimum value of E(X).

[0110] The constraints are: C1≥0, C2≥0, C3≥0, C4≥0, find The optimal solution This is the solution to the original multi-objective problem.

[0111] In summary, the embodiment of the present application provides an adaptive RASP probe optimization method based on a multi-objective game model, which aims to adaptively scale the hook points of RASP in a tidal manner when the CPU and memory loads are high. From the two aspects of resource occupancy of the hook points (such as: CPU occupancy, memory occupancy, JVM heap memory occupancy, etc.) and risk assessment (such as: vulnerability risk level, number of HOOK calls, number of business hits, propagation breadth, etc.), based on the multi-objective game model, the minimum value of each hook point is solved, and the corresponding hook points are reduced and expanded in sequence through sorting.

[0112] The method shown in the embodiment of the present application also has the following technical effects:

[0113] Intelligent evaluation and decision-making: Through real-time monitoring of the performance overhead of RASP probes, including CPU usage, memory usage, etc. Based on the multi-objective game model, the specific impact of each HOOK point on performance is analyzed according to the vulnerability risk level of each HOOK point, the number of HOOK calls, the number of business hits, the breadth of propagation, etc., performance bottlenecks are identified, priority rules are formulated, and algorithms are used to dynamically evaluate and select the security risks and performance requirements of the current application. According to the output results of the algorithm, the HOOK points that need to be closed or activated are intelligently selected.

[0114] Adaptive management: In order to adaptively manage the status of HOOK points, the necessity of real-time monitoring is emphasized. Specifically, the probe needs to continuously monitor the load status, the real-time level of attack threats, and the performance overhead of the RASP probe during operation. Based on these real-time feedback data, the probe can intelligently and automatically decide which HOOK points should be activated to enhance protection and which HOOK points can be closed in specific circumstances to optimize performance. This dynamic management strategy ensures that the application can maintain efficient operation while effectively responding to potential security threats.

[0115] Balance between security and performance: While closing some HOOK points to reduce performance overhead, always adhere to the bottom line of application security. The core of this strategy is to find the best balance between security and performance, which not only optimizes system operation efficiency but also ensures sufficient security protection capabilities. Once the probe senses that the security threat has been upgraded or the load situation has been optimized, it can respond quickly and automatically reactivate the previously closed HOOK points to ensure that the security protection capabilities are restored in time. Through this dynamic adjustment mechanism, application performance can be maximized without sacrificing security, providing users with a safe and efficient operating environment.

[0116] like Figure 4 As shown, the embodiment of the present application also provides a security probe management device for an application program, such as Figure 4 As shown, the device 40 includes:

[0117] The acquisition module 401 is used to acquire the first parameter and the second parameter of each hook point of the security probe of the application to be detected, wherein the first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point;

[0118] The execution module 402 is used to use the first parameter and the second parameter of each hook point as the design variables of the multi-objective game model, and to construct the multi-objective game model based on the design variables. The multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupation and risk assessment of the hook points, with the goal of minimizing the resource occupation and minimizing the risk assessment. The game party of the multi-objective game model is each hook point;

[0119] Determining optimal solutions of multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter;

[0120] According to the optimal solution, calculate the solution of each hook point; sort each hook point in order of solution value from small to large;

[0121] Monitor the load of the application to be detected. When the load exceeds a first threshold, close the corresponding hook points in order from small to large in solution value, until the load of the application to be detected drops to within a second threshold, and then stop closing the hook points; wherein the second threshold is less than or equal to the second threshold.

[0122] In a possible implementation, the execution module 402 for determining the optimal solutions of the multiple objective functions includes:

[0123] According to the weight values ​​corresponding to each objective function in the multiple objective functions and the preset multiple objective functions, a weighted sum calculation is performed on the multiple objective functions to obtain an evaluation function of the multi-objective game model;

[0124] The solution when the evaluation function takes the minimum value is determined as the optimal solution.

[0125] In a possible implementation, the execution module 402 is used to monitor the load of the application to be detected, and when the load of the application to be detected exceeds the first threshold, close the corresponding hook points in order from small to large solution values, until the load of the application to be detected is reduced to within the second threshold, and then stop closing the hook points.

[0126] Continuously monitor the load of the application to be detected. When the load is lower than the third threshold, open the closed hook points in order from large to small according to the solution values ​​of the closed hook points, until the load of the application to be detected reaches the second preset threshold, and then stop opening the closed hook points, wherein the third threshold is smaller than the second threshold.

[0127] In one possible implementation, the execution module 402 is used to evaluate the danger level of the application to be detected based on the first parameter, the second parameter and the current event after obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected, wherein the current event includes at least one of the following: abnormal attack behavior on the application to be detected, malicious request behavior on the application to be detected and data leakage of the application to be detected.

[0128] In a possible implementation, the execution module 402 is used to monitor the load of the application to be detected, and when the load exceeds the first threshold, close the corresponding hook points in order of the solution values ​​from small to large, until the load of the application to be detected is reduced to within the second threshold, and then stop closing the hook points.

[0129] Continue to monitor the load of the application to be detected, and when the load is lower than the third threshold and the danger level of the application to be detected changes, reconstruct a new multi-objective game model based on the first parameter and the second parameter of the currently running hook point and the most recently recorded first parameter and second parameter of the closed hook point before being closed, and determine the evaluation function of the new multi-objective game model based on the new multiple objective functions of the new multi-objective game model;

[0130] The solution when the evaluation function of the new multi-objective game model takes the minimum value is determined as the optimal solution of the new multi-objective game model;

[0131] According to the optimal solution of the new multi-objective game model, the solution of each hook point is re-determined based on the game strategy; and each hook point is re-sorted in the order of solution value from small to large;

[0132] The closed hook points are opened, and the hook points are closed again in the order of the solution values ​​from small to large in the new sorting, wherein the third threshold is smaller than the second threshold.

[0133] In a possible implementation, the first parameter includes at least one of the following: CPU occupancy, memory occupancy, JVM heap memory occupancy, and metaspace occupancy;

[0134] The second parameter includes at least one of the following: the vulnerability risk level of the hook point, the number of calls to the hook, the number of business hits of the hook point, and the spread breadth of the hook point.

[0135] In summary, the embodiment of the present application provides an adaptive RASP probe optimization device based on a multi-objective game model, which aims to adaptively scale the hook points of RASP in a tidal manner when the CPU and memory loads are high. From the two aspects of resource occupancy of the hook points (such as: CPU occupancy, memory occupancy, JVM heap memory occupancy, etc.) and risk assessment (such as: vulnerability risk level, number of HOOK calls, number of business hits, propagation breadth, etc.), based on the multi-objective game model, the minimum value of each hook point is solved, and the corresponding hook points are reduced and expanded in sequence through sorting.

[0136] The present application embodiment provides an electronic device 50, such as Figure 5 As shown, the electronic device 50 includes: a processor 501, a memory 502, and a program stored in the memory 502 and executable on the processor 501. When the program is executed by the processor 501, a security probe management method for an application program as shown in the above embodiment is implemented.

[0137] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of a security probe management method for an application program as shown in the above embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. The computer-readable storage medium is, for example, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0138] An embodiment of the present application also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the security probe management method of the above-mentioned application and can achieve the same technical effect. To avoid repetition, they are not repeated here.

[0139] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0140] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0141] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A security probe management method for an application, characterized in that: The method comprises: Obtain a first parameter and a second parameter of each hook point of the security probe of the application to be detected, wherein the first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point; The first parameter and the second parameter of each hook point are used together as design variables of a multi-objective game model, and a multi-objective game model is constructed based on the design variables. The multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupation and risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment; the game party of the multi-objective game model is each hook point; Determining optimal solutions of the multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter; According to the optimal solution, the solution of each hook point is calculated; each hook point is sorted in order of the solution value from small to large; Monitor the load condition of the application to be detected. When the load condition exceeds a first threshold, close the corresponding hook points in order from small to large in solution value, until the load condition of the application to be detected drops to within a second threshold, and then stop closing the hook points; wherein the second threshold is less than or equal to the second threshold.

2. The method according to claim 1, characterized in that: Determining the optimal solutions of the multiple objective functions includes: According to the multiple objective functions and the preset weight values ​​corresponding to each objective function, the multiple objective functions are weighted summed to obtain an evaluation function of the multi-objective game model; The solution when the evaluation function takes the minimum value is determined as the optimal solution.

3. The method according to claim 1, characterized in that When monitoring the load of the application to be detected, when the load of the application to be detected exceeds a first threshold, closing the corresponding hook points in order of solution values ​​from small to large until the load of the application to be detected decreases to within a second threshold, after stopping closing the hook points, the method further includes: Continuously monitor the load condition of the application to be detected. When the load condition is lower than a third threshold, open the closed hook points in order of the solution values ​​of the closed hook points from large to small, until the load condition of the application to be detected reaches a second preset threshold, and then stop opening the closed hook points, wherein the third threshold is smaller than the second threshold.

4. The method according to claim 1, characterized in that: After obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected, the method further includes: Based on the first parameter, the second parameter and the current event, the danger level of the application to be detected is evaluated, wherein the current event includes at least one of the following: abnormal attack behavior on the application to be detected, malicious request behavior on the application to be detected and data leakage of the application to be detected.

5. The method according to claim 4, characterized in that After monitoring the load of the application to be detected, when the load exceeds a first threshold, closing corresponding hook points in order of solution values ​​from small to large, until the load of the application to be detected decreases to within a second threshold, after stopping closing the hook points, the method further includes: Continue to monitor the load of the application to be detected, and when the load is lower than the third threshold and the danger level of the application to be detected changes, reconstruct a new multi-objective game model based on the first parameter and the second parameter of the currently running hook point and the most recently recorded first parameter and second parameter of the closed hook point before being closed, and determine the evaluation function of the new multi-objective game model based on the new multiple objective functions of the new multi-objective game model; Determine the solution when the evaluation function of the new multi-objective game model takes the minimum value as the optimal solution of the new multi-objective game model; According to the optimal solution of the new multi-objective game model, the solution of each hook point is re-determined based on the game strategy; and each hook point is newly sorted in the order of the solution value from small to large; The closed hook points are opened, and the hook points are closed again in the order of the solution values ​​from small to large in the new sorting, wherein the third threshold is smaller than the second threshold.

6. The method according to any one of claims 1 to 5, characterized in that The first parameter includes at least one of the following: CPU occupancy, memory occupancy, JVM heap memory occupancy and metaspace occupancy; The second parameter includes at least one of the following: the vulnerability risk level of the hook point, the number of calls to the hook, the number of business hits of the hook point, and the spread breadth of the hook point.

7. A security probe management device for an application, characterized in that: The device comprises: An acquisition module, used to acquire a first parameter and a second parameter of each hook point of the security probe of the application to be detected, wherein the first parameter is used to indicate the resource occupancy of the hook point, and the second parameter is used to indicate the risk assessment of the hook point; An execution module, used for taking the first parameter and the second parameter of each hook point as design variables of a multi-objective game model, and constructing a multi-objective game model based on the design variables, wherein the multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupancy and risk assessment of the hook point, with the goal of minimizing the resource occupancy and minimizing the risk assessment; the game party of the multi-objective game model is each hook point; Determining optimal solutions of the multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter; According to the optimal solution, the solution of each hook point is calculated; each hook point is sorted in order of the solution value from small to large; Monitor the load condition of the application to be detected. When the load condition exceeds a first threshold, close the corresponding hook points in order from small to large in solution value, until the load condition of the application to be detected drops to within a second threshold, and then stop closing the hook points; wherein the second threshold is less than or equal to the second threshold.

8. An electronic device, characterized in that: include: A processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, the steps of a security probe management method for an application program as described in any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a security probe management method for an application program according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that It comprises computer instructions, which, when executed by a processor, implement the steps of a security probe management method for an application as described in any one of claims 1-6.

Images