A security probe management method and apparatus for an application

Abstract

The application provides a security probe management method and device of an application program, comprising: acquiring a first parameter and a second parameter of each hook point of a security probe of a to-be-detected application program, taking the first parameter and the second parameter of each hook point as design variables to construct a multi-objective game model, determining an optimal solution of multiple objective functions of the multi-objective game model, calculating a solution of each hook point according to the optimal solution, sorting each hook point in an order from small to large according to the value of the solution, monitoring a load condition of the to-be-detected application program, and when the load condition exceeds a first threshold, sequentially closing the corresponding hook point in the order from small to large according to the value of the solution until the load condition of the to-be-detected application program is reduced to within a second threshold, and stopping closing the hook point; wherein the second threshold is less than or equal to the second threshold, thereby improving the security of the system on the basis of ensuring the performance of the system.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of security detection, and in particular, to a security probe management method and device for an application program. BACKGROUND

[0002] With the rapid development of information technology, network security problems are increasingly prominent. As a new application security protection technology, RASP (Runtime Application Self-Protection) can detect and block security attacks in real time, so that the application program has self-protection capability. However, while protecting the application program, the setting of the RASP probe will also introduce certain performance overhead, especially when the CPU (Central Processing Unit) and memory load are high, this overhead may be more obvious, affecting the overall system performance.

[0003] In the existing scheme, by customizing protection rules, users can select appropriate protection methods. When the CPU and memory load are high, the commonly used solution is to directly unload and close all hook points, so as to ensure the normal operation of user business, and then reload when the CPU and memory load decrease. Although the performance overhead of the RASP probe is reduced by reducing the protection rules, appropriate rules need to be analyzed in detail by professional security personnel, and most users lack relevant security knowledge and cannot consider multiple targets such as vulnerability hazard, CPU occupancy, memory occupancy, and running time. Therefore, how to reduce the performance overhead of the RASP probe while ensuring application security has become a problem to be solved. SUMMARY

[0004] Embodiments of the present application provide a security probe management method and device for an application program to solve the technical problem that in the related art, when the CPU and memory load of the system are high, the way of directly unloading and closing all hook points reduces the system security.

[0005] To solve the above technical problems, the present application is implemented as follows:

[0006] In a first aspect, the embodiments of the present application provide a security probe management method for an application program, which comprises:

[0007] obtaining a first parameter and a second parameter of each hook point of a security probe of a to-be-detected application program, wherein the first parameter is used to represent a resource occupancy of the hook point, and the second parameter is used to represent a risk assessment of the hook point;

[0008] The first parameter and the second parameter of each hook point are taken together as design variables of a multi-objective game model, a multi-objective game model is constructed based on the design variables, the multi-objective game model has multiple objective functions, the multiple objective functions are used to comprehensively evaluate the resource occupation and the risk assessment of the hook point, and the resource occupation and the risk assessment are minimized as the target;

[0009] An optimal solution of the multiple objective functions is determined, wherein the optimal solution is a combination of the first parameter and the second parameter;

[0010] According to the optimal solution, the solution of each hook point is calculated, and each hook point is sorted in order of the value of the solution from small to large;

[0011] The load condition of the to-be-detected application program is monitored, when the load condition exceeds a first threshold, the corresponding hook point is closed in order of the value of the solution from small to large, and the closing of the hook point is stopped when the load condition of the to-be-detected application program is reduced to within a second threshold; wherein the second threshold is less than or equal to the second threshold.

[0012] Optionally, determining the optimal solution of the multiple objective functions comprises:

[0013] According to the multiple objective functions and the preset weight value corresponding to each objective function in the multiple objective functions, the multiple objective functions are weighted and summed to obtain an evaluation function of the multi-objective game model;

[0014] The solution when the evaluation function takes the minimum value is determined as the optimal solution.

[0015] Optionally, after monitoring the load condition of the to-be-detected application program, when the load condition of the to-be-detected application program exceeds a first threshold, the corresponding hook point is closed in order of the value of the solution from small to large, and the closing of the hook point is stopped when the load condition of the to-be-detected application program is reduced to within a second threshold, the method further comprises:

[0016] The load condition of the to-be-detected application program is continuously monitored, when the load condition is lower than a third threshold, the closed hook point is opened in order of the value of the solution from large to small, and the opening of the closed hook point is stopped when the load condition of the to-be-detected application program reaches a second preset threshold, wherein the third threshold is less than the second threshold.

[0017] Optionally, after obtaining the first parameter and the second parameter of each hook point of the security probe of the to-be-detected application program, the method further comprises:

[0018] evaluating a danger level of the to-be-detected application program based on the first parameter, the second parameter, and a current event, wherein the current event comprises at least one of an abnormal attack behavior on the to-be-detected application program, a malicious request behavior on the to-be-detected application program, and a data leakage situation of the to-be-detected application program.

[0019] Optionally, when the load situation of the to-be-detected application program exceeds a first threshold, in order of values of solutions from small to large, the corresponding hook points are sequentially closed until the load situation of the to-be-detected application program is reduced to within a second threshold, and after stopping closing the hook points, the method further comprises:

[0020] continuing to monitor the load situation of the to-be-detected application program, when the load situation is lower than a third threshold and the danger level of the to-be-detected application program changes, reconstructing a new multi-objective game model based on the first parameter and the second parameter of the currently running hook points and the recorded last first parameter and second parameter of the closed hook points before being closed, determining an evaluation function of the new multi-objective game model based on a plurality of new objective functions of the new multi-objective game model;

[0021] determining, as an optimal solution of the new multi-objective game model, a solution when the evaluation function of the new multi-objective game model takes a minimum value;

[0022] re-determining, according to the optimal solution of the new multi-objective game model, a solution of each hook point based on a game strategy, and performing new sorting of each hook point in order of values of solutions from small to large;

[0023] opening the closed hook points and re-closing the hook points in order of values of solutions from small to large according to the new sorting, wherein the third threshold is smaller than the second threshold.

[0024] Optionally, the first parameter comprises at least one of a central processing unit (CPU) occupation, a memory occupation, a JVM heap memory occupation, and a meta-space occupation.

[0025] The second parameter comprises at least one of a vulnerability danger degree of the hook point, a calling number of the hook, a business hit number of the hook point, and a propagation breadth of the hook point.

[0026] In a second aspect, an embodiment of the present application provides an application program security probe management device, the device comprising:

[0027] The acquisition module is configured to acquire a first parameter and a second parameter of each hook point of a security probe of an application to be detected, wherein the first parameter is used to represent resource occupation of the hook point, and the second parameter is used to represent risk assessment of the hook point.

[0028] The execution module is configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, to construct the multi-objective game model based on the design variable, and to use multiple objective functions of the multi-objective game model to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment.

[0029] The execution module is configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, to construct the multi-objective game model based on the design variable, and to use multiple objective functions of the multi-objective game model to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment.

[0030] The execution module is configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, to construct the multi-objective game model based on the design variable, and to use multiple objective functions of the multi-objective game model to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment.

[0031] The execution module is configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, to construct the multi-objective game model based on the design variable, and to use multiple objective functions of the multi-objective game model to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment.

[0032] In a third aspect, an embodiment of the present application provides an electronic device, including a processor, a memory, and a program stored in the memory and executable on the processor, and when the program is executed by the processor, the steps of the application program security probe management method in the first aspect are implemented.

[0033] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the application program security probe management method in the first aspect are implemented.

[0034] In a fifth aspect, an embodiment of the present application provides a computer program product, including computer instructions, and when the computer instructions are executed by a processor, the steps of the application program security probe management method in the first aspect are implemented.

[0035] Therefore, by monitoring the resource occupation and risk assessment of each hook point in the application to be detected, a multi-objective game model is constructed to optimize resource use and security management. When the system load exceeds the threshold, the hook points with high resource occupation and poor risk assessment (which have a higher impact on security) are closed first, and dynamic adjustment is made to improve system performance and stability, thereby achieving an effective balance between resources and security. BRIEF DESCRIPTION OF DRAWINGS

[0036] Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The accompanying drawings are included to provide a description of the preferred embodiments, and are not meant to limit the present application. Moreover, the same reference numerals in the attached drawings are intended to represent the same components throughout the several drawings. In the drawings:

[0037] Figure 1 A flowchart of a security probe management method for an application according to an embodiment of the present application is provided;

[0038] Figure 2 A system architecture block diagram of a RASP according to an embodiment of the present application is provided;

[0039] Figure 3 A flowchart of a security probe management method for an application according to an embodiment of the present application is provided;

[0040] Figure 4 A structural block diagram of a security probe management device for an application according to an embodiment of the present application is provided;

[0041] Figure 5 A structural block diagram of an electronic device according to an embodiment of the present application is provided. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0043] Figure 1 A security probe management method for an application according to an embodiment of the present application is shown, as shown in Figure 1 The method comprises:

[0044] Step S101, obtaining a first parameter and a second parameter of each hook point of a security probe of an application to be detected;

[0045] The first parameter is used to represent the resource occupation of the hook point, and the second parameter is used to represent the risk assessment of the hook point.

[0046] In step S102, the first parameter and the second parameter of each hook point are collectively used as design variables of a multi-objective game model, and the multi-objective game model is constructed based on the design variables.

[0047] The multi-objective game model has multiple objective functions, and the multiple objective functions are used to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment. The game parties of the multi-objective game model are each hook point.

[0048] In step S103, the optimal solution of the multiple objective functions is determined.

[0049] The optimal solution is a combination of the first parameter and the second parameter.

[0050] In step S104, according to the optimal solution, the solution of each hook point is calculated, and each hook point is sorted in order of the value of the solution from small to large.

[0051] In step S105, the load condition of the to-be-detected application program is monitored, and when the load condition exceeds the first threshold value, the corresponding hook point is closed in order of the value of the solution from small to large, until the load condition of the to-be-detected application program is reduced to within the second threshold value, and the closing of the hook point is stopped.

[0052] The second threshold value is less than or equal to the second threshold value.

[0053] It should be noted that the first parameter includes at least one of the following: CPU occupation, memory occupation, JVM heap memory occupation, and meta-space occupation; and the second parameter includes at least one of the following: vulnerability risk degree of the hook point, call number of the hook, business hit number of the hook point, and propagation breadth of the hook point.

[0054] In a possible implementation, in step S103, the optimal solution of the multiple objective functions includes: according to the multiple objective functions and a preset weight value corresponding to each objective function in the multiple objective functions, the multiple objective functions are weighted and summed to obtain an evaluation function of the multi-objective game model; and the solution when the evaluation function takes the minimum value is determined as the optimal solution.

[0055] In a possible implementation, after step S105, when the load condition of the to-be-detected application program exceeds the first threshold, the corresponding hook points are sequentially closed in the order of the solutions from small to large, until the load condition of the to-be-detected application program is reduced to within the second threshold, and the closing of the hook points is stopped, the method further includes: continuously monitoring the load condition of the to-be-detected application program, and when the load condition is lower than a third threshold, the closed hook points are sequentially opened in the order of the solutions of the closed hook points from large to small, until the load condition of the to-be-detected application program reaches the second threshold, and the opening of the closed hook points is stopped, where the third threshold is smaller than the second threshold.

[0056] In a possible implementation, after step S101, the method further includes: based on the first parameter, the second parameter, and a current event, evaluating a danger level of the to-be-detected application program, where the current event includes at least one of the following: an abnormal attack behavior on the to-be-detected application program, a malicious request behavior on the to-be-detected application program, and a data leakage condition of the to-be-detected application program.

[0057] In a possible implementation, after step S105, when the load condition of the to-be-detected application program exceeds the first threshold, the corresponding hook points are sequentially closed in the order of the solutions from small to large, until the load condition of the to-be-detected application program is reduced to within the second threshold, and the closing of the hook points is stopped, the method further includes: continuously monitoring the load condition of the to-be-detected application program, and when the load condition is lower than a third threshold, and the danger level of the to-be-detected application program changes, reconstructing a new multi-objective game model based on the first parameter and the second parameter of the currently running hook points and the recorded last first parameter and second parameter of the closed hook points before being closed, determining an evaluation function of the new multi-objective game model based on a plurality of new objective functions of the new multi-objective game model, determining an optimal solution of the new multi-objective game model when the evaluation function of the new multi-objective game model takes a minimum value, and determining the solution of the new multi-objective game model as the optimal solution of the new multi-objective game model, re-determining the solution of each hook point based on the game strategy according to the optimal solution of the new multi-objective game model, and performing new sorting of each hook point in the order of the solutions from small to large, opening the closed hook points, and re-closing the hook points in the order of the solutions from small to large in the new sorting.

[0058] It should be noted that, based on Figure 1The method shown can dynamically evaluate the influence of each hook point on the application performance and their importance to security protection. Different hook points may be targeted at different security threats or vulnerabilities, and therefore their importance is not the same. Based on these evaluations, the probe can selectively close those hook points that have a greater impact on performance or have a relatively lower demand for current security protection. In order to adaptively adjust the state of the hook points, the load condition of the application, the attack threat level and the performance overhead of the RASP probe are monitored in real time. According to these real-time monitoring data, the probe can automatically adjust which hook points should be activated or closed. When closing part of the hook points, it is necessary to ensure that the security of the application is not seriously affected, which requires finding a balance between security and performance to ensure that the security protection capability of the probe is not excessively weakened while reducing the performance overhead. Once the probe detects that the security threat escalates or the load condition improves, based on the above method, the previously closed hook points can be quickly reactivated to ensure that the security protection capability of the probe is timely restored.

[0059] It should be noted that the system architecture of the RASP can be as shown in Figure 2 The RASP can achieve runtime intrusion detection and protection by injecting protection code into critical functions of the application running, and real-time monitoring and analyzing the runtime behavior of the application program, including request parameters, file reading and writing, database operations, etc.

[0060] The method shown in the embodiments of the present application (which can be referred to Figure 3 ) can continuously monitor the load condition of the application, the real-time level of attack threats and the performance overhead of the RASP probe in the running process through the rasp agent probe. Based on these real-time feedback data, the method can intelligently and automatically decide to expand or retract the protection of the hook points. This adaptive method ensures that the system can maintain efficient operation and effectively respond to potential security threats. The specific steps are as follows:

[0061] 1. The rasp agent collects the CPU occupation, memory occupation, JVM heap memory occupation and meta-space occupation of each hook point of the application;

[0062] 2. Set the evaluation score of the application security risk degree corresponding to the vulnerability danger degree, hook call frequency, business hit frequency and propagation breadth dimension of the hook point;

[0063] 3. According to the data collection for a period of time, obtain the weighted sum of the cpu, memory, jvm memory and meta-space occupation of the corresponding hook points of multiple applications;

[0064] 4. Construct a multi-objective game model, which takes the CPU, memory, JVM memory and metaspace occupation of the HOOK point as the target, and predicts the HOOK point to be closed under the current system state through the method of game theory.

[0065] 5. Put the solution of each HOOK point into the HOOK point array: Z [];

[0066] 6. And sort the values from small to large: Z = sort (Z []);

[0067] 7. Real-time monitoring of application load, when detecting high CPU and memory load, according to the order, the HOOK point is closed to balance the load and record, when detecting that the CPU and memory load is reduced, if the danger level changes, according to the record of closing, the array Y is calculated again, and the corresponding HOOK point is activated in turn, which can effectively reduce the performance overhead of RASP probe and improve the overall performance of the system under the premise of ensuring the safety of the application.

[0068] In the refinement of step 4, it needs to be explained that game theory is also called game theory. Game theory is a mathematical model that studies the strategic interaction between rational decision makers. It has applications in various fields of social science, logic and computer science. Initially, it discusses zero-sum games, that is, one person's gain leads to the loss of other participants. Today, game theory is applicable to a wide range of behavioral relationships, and is now a general term for the science of logical decision-making by humans, animals and computers. In many real-world decision-making problems, multi-objective problems are more widespread than single-objective problems, and decision-makers often need to consider multiple objectives to make decisions, which is more in line with reality. Multi-objective game is a scientific and effective method to solve multi-objective problems. Multi-objective problems can be converted to solve the minimum value of F(X).

[0069] The objective function is:

[0070] F(X) = {f1(X), f2(X),..., f m (X)}

[0071] The design variable is:

[0072] X = {x1, x2,..., x m}

[0073] The above formula needs to satisfy the constraint condition a i ≤ x i ≤ b i ; h l (X) = 0; g k (X) ≤ 0; i = (1, 2,..., n); l = (1, 2,..., p); k = (1, 2,..., q). Where ai b i x i The upper and lower limits are ai, m is the number of design variables, and h is the upper and lower limits. l (X) represents the l-th equality constraint, g k (X) represents the k-th inequality constraint, p represents the number of non-upper-lower bound equality constraints, and q represents the number of non-upper-lower bound inequality constraints.

[0074] According to game theory models, G represents a game with n players, and each player i has S. i A policy space, storing all possible policies, S ij Let $\frac{j}{\frac ... i U ij This represents the payoff obtained by player i when adopting the j-th strategy. The game involving N players is: G = {S1, S2, ..., S...} n ;U1,U2,...,U m}

[0075] To solve multi-objective problems using game theory, we first transform the multi-objective problem into a game problem. The n design objectives in the multi-objective problem correspond to the n players in the game, the design variable X corresponds to the strategy space S, the objective function corresponds to the game payoff, and the constraints in the multi-objective problem can be viewed as constraints on the available strategies.

[0076] The key to transforming a multi-objective problem into a game theory problem lies in mapping the design variables to the strategy space S1, S2, ..., S of the players. n First, we should determine the degree of influence of the design variables on the players' payoffs, and then perform fuzzy clustering on them to obtain the strategy space S1, S2, ..., S for each player. n The main steps are as follows:

[0077] (1) Perform single-objective optimization on each of the n objectives to obtain the corresponding optimization solutions:

[0078]

[0079] in

[0080] (2) According to step size Δx j Design variable x j Divide the data into T equal segments, then the design variable x j The payoff f for the i-th player i Influence factor Δ ji for

[0081]

[0082] (3) Let the classification sample be Δ j = {Δ j1 , Δ j2 ,..., Δ jn}(j = 1, 2,..., m), Δ j represents the set of the jth design variable affecting the influence factor of all n objectives. The classification sample includes {Δ = {Δ1, Δ2,..., Δ m}}. The fuzzy clustering is performed on all samples, and all design variables X are classified into the strategy space S1, S2,..., Sm of each game party. n

[0083] And the tidal adaptive stretching hook point is a typical multi-objective problem, which needs to consider the risk degree of each hook point corresponding to the vulnerability, the number of hook calls, the number of business hits, the propagation breadth dimension, the CPU occupation, the memory occupation, the JVM heap memory occupation and the meta space occupation released after being closed. For such problems, a multi-objective game problem is proposed.

[0084] The objective function is: F(x) = {f1(X), f2(X), f3(X), f4(X), f5(X)}→min

[0085] The design variable is: X = {C1, λ1, u1, C2, λ2, u2, m, C3, λ3, u3, C4, λ4, u4, k}

[0086] The constraint condition is: C1≥0, C2≥0, C3≥0, C4≥0

[0087] Among them:

[0088] f1(X) = (λ1u1+λ2u2+λ3u3+λ4u4)C1

[0089] f2(X) = (λ1u1+λ2u2+λ3u3+λ4u4)C2

[0090]

[0091] f4(X) = (λ1u1+λ2u2+λ3u3+λ4u4)C3

[0092] f5(X) = (λ1u1+λ2u2+λ3u3+λ4u4)C4

[0093] λ1 is the vulnerability risk rate, which refers to the risk rate corresponding to high risk, medium risk and low risk according to the risk degree of the vulnerability;

[0094] u1 is the evaluation score of the risk rate in the whole influence dimension;

[0095] ​λ2 is the service hit rate, which refers to the frequency of the application hook service entering detection per unit time;

[0096] u2 is the evaluation score of the service hit rate in the entire impact dimension;

[0097] λ3 is the availability, which refers to the propagation range of the vulnerability, and the availability;

[0098] u3 is the evaluation score of the availability in the entire impact dimension;

[0099] λ4 is the hook hit rate, which refers to the hit rate of the service entering the business and being detected as a security risk;

[0100] u4 is the evaluation score of the hook hit rate in the entire impact dimension;

[0101] m is the cpu, memory, jvm memory occupation and metaspace occupation of a single application hook point;

[0102] k is the number of applications collected;

[0103] C1 is the cpu occupation of the application hook point;

[0104] C2 is the memory occupation of the application hook point;

[0105] C3 is the jvm memory occupation of the application hook point.

[0106] C4 is the metaspace occupation of the application hook point.

[0107] For the multi-objective game problem in the adaptive stretch hook point, the linear weighting method is used to convert the multi-objective problem into a single objective problem for solving. Each single objective function fi(X) in F(x)={f1(X),f2(X),f3(X),f4(X),f5(X)}→min is multiplied by the corresponding weight wi, and then summed to obtain the evaluation function E(X):

[0108]

[0109] In this way, the multi-objective optimization problem is converted into a single objective optimization problem, that is, to find the minimum value of E(X).

[0110] The constraint condition is: C1≥0,C2≥0,C3≥0,C4≥0, and the optimal solution of

[0111] is obtained. The optimal solution is the solution of the original multi-objective problem.

[0112] ​In summary, the embodiment of the present application provides a self-adaptive RASP probe optimization method based on a multi-objective game model, aiming to tide in the hook point of the self-adaptive RASP when the CPU and memory load are high, from the resource occupation of the hook point (such as CPU occupation, memory occupation, JVM heap memory occupation, etc.) and the risk assessment situation (such as vulnerability danger degree, hook call frequency, business hit frequency, propagation breadth, etc.), based on a multi-objective game model, the minimum value of each hook point is solved, and the corresponding hook point is sequentially reduced by sorting.

[0113] The method shown in the embodiment of the present application also has the following technical effects:

[0114] Intelligent evaluation and decision: By monitoring the performance overhead of the RASP probe in real time, including CPU usage, memory occupation, etc. Based on the multi-objective game model, for the vulnerability danger degree, hook call frequency, business hit frequency, and propagation breadth of each hook point, the specific influence of each hook point on performance is analyzed, the performance bottleneck is identified, the priority rules are formulated, the algorithm is used to dynamically evaluate and select the security risk and performance requirement of the current application, and according to the output result of the algorithm, the hook points that need to be closed or activated are intelligently selected.

[0115] Adaptive management: In order to adaptively manage the state of the hook point, the necessity of real-time monitoring is emphasized. Specifically, the probe needs to continuously monitor the load condition, the real-time level of attack threat, and the performance overhead of the RASP probe during running. Based on these real-time feedback data, the probe can intelligently and automatically decide which hook points should be activated to strengthen protection and which hook points can be closed under certain circumstances to optimize performance. This dynamic management strategy ensures that the application can maintain efficient operation and effectively cope with potential security threats.

[0116] Balance between security and performance: While closing part of the hook points to reduce performance overhead, the bottom line of application security is always adhered to. The core of this strategy is to find the best balance point between security and performance, which optimizes system running efficiency and ensures sufficient security protection capability. Once the probe perceives that the security threat escalates or the load condition is optimized, it can quickly respond and automatically reactivate the previously closed hook points to ensure that the security protection capability is timely restored. Through this dynamic adjustment mechanism, the application performance can be maximized without sacrificing security, providing a safe and efficient running environment for users.

[0117] As Figure 4 shown, the embodiment of the present application also provides a security probe management device of an application program, as Figure 4 shown, the device 40 comprises:

[0118] The acquisition module 401 is configured to acquire a first parameter and a second parameter of each hook point of a security probe of an application to be detected, where the first parameter is used to represent resource occupation of the hook point, and the second parameter is used to represent risk assessment of the hook point.

[0119] The execution module 402 is configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, to construct the multi-objective game model based on the design variable, and to use multiple objective functions of the multi-objective game model to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment as a target. The game party of the multi-objective game model is each hook point.

[0120] The execution module 402 is configured to determine an optimal solution of the multiple objective functions, where the optimal solution is a combination of the first parameter and the second parameter.

[0121] According to the optimal solution, the execution module 402 is configured to calculate a solution of each hook point, to sort each hook point in an order from small to large according to a value of the solution, and to sequentially close the corresponding hook point in the order from small to large according to the value of the solution until the load condition of the application to be detected is reduced to within the second threshold value.

[0122] The execution module 402 is configured to monitor the load condition of the application to be detected, to sequentially close the corresponding hook point in the order from small to large according to the value of the solution when the load condition of the application to be detected exceeds the first threshold value, and to stop closing the hook point when the load condition of the application to be detected is reduced to within the second threshold value.

[0123] In a possible implementation, the execution module 402 is configured to determine the optimal solution of the multiple objective functions, including:

[0124] The execution module 402 is configured to perform weighted sum calculation on the multiple objective functions according to the multiple objective functions and a preset weight value corresponding to each objective function in the multiple objective functions, to obtain an evaluation function of the multi-objective game model.

[0125] The execution module 402 is configured to determine, as the optimal solution, a solution when the evaluation function takes a minimum value.

[0126] In a possible implementation, the execution module 402 is configured to, when monitoring the load condition of the application to be detected, sequentially close the corresponding hook point in the order from small to large according to the value of the solution when the load condition of the application to be detected exceeds the first threshold value, and to stop closing the hook point when the load condition of the application to be detected is reduced to within the second threshold value.

[0127] Continuously monitor the load condition of the application to be detected, when the load condition is lower than a third threshold, open the closed hook points in order of the values of the solutions of the closed hook points from large to small, until the load condition of the application to be detected reaches a second preset threshold, stop opening the closed hook points, wherein the third threshold is smaller than the second threshold.

[0128] In a possible implementation, the execution module 402 is configured to, after obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected, evaluate the danger level of the application to be detected based on the first parameter, the second parameter, and a current event, wherein the current event includes at least one of the following: an abnormal attack behavior on the application to be detected, a malicious request behavior on the application to be detected, and a data leakage situation of the application to be detected.

[0129] In a possible implementation, the execution module 402 is configured to, after monitoring the load condition of the application to be detected, when the load condition exceeds a first threshold, close the corresponding hook points in order of the values of the solutions from small to large, until the load condition of the application to be detected decreases to within a second threshold, stop closing the hook points, and

[0130] Continuously monitor the load condition of the application to be detected, when the load condition is lower than a third threshold, and the danger level of the application to be detected changes, reconstruct a new multi-objective game model based on the first parameter and the second parameter of the currently running hook points and the recorded last first parameter and second parameter of the closed hook points before being closed, determine an evaluation function of the new multi-objective game model based on a new plurality of objective functions of the new multi-objective game model;

[0131] Determine the solution when the evaluation function of the new multi-objective game model takes a minimum value as the optimal solution of the new multi-objective game model;

[0132] According to the optimal solution of the new multi-objective game model, determine the solution of each hook point based on the game strategy, and perform new sorting of each hook point in order of the values of the solutions from small to large;

[0133] Open the closed hook points, and close the hook points again in order of the values of the solutions from small to large in the new sorting, wherein the third threshold is smaller than the second threshold.

[0134] In a possible implementation, the first parameter includes at least one of the following: a central processing unit (CPU) occupation, a memory occupation, a JVM heap memory occupation, and a meta space occupation.

[0135] The second parameter includes at least one of the vulnerability danger degree of the hook point, the calling frequency of the hook, the business hit frequency of the hook point, and the propagation breadth of the hook point.

[0136] To sum up, the embodiment of the application provides an adaptive RASP probe optimization device based on a multi-target game model, aiming to tide in the hook point of the adaptive RASP when the CPU and memory load are high, and to solve the minimum value of each hook point based on a multi-target game model from two aspects of the resource occupation situation (such as CPU occupation, memory occupation, and JVM heap memory occupation) and the risk assessment situation (such as the vulnerability danger degree, the calling frequency of the hook, the business hit frequency, and the propagation breadth) of the hook point, and to sequentially reduce the corresponding hook point through sorting.

[0137] The embodiment of the application provides an electronic device 50, as shown in the figure, the electronic device 50 includes: a processor 501, a memory 502 and a program stored in the memory 502 and executable on the processor 501, when the program is executed by the processor 501, a security probe management method of an application program is realized as shown in the above embodiment. Figure 5

[0138] The embodiment of the application further provides a computer readable storage medium, the computer readable storage medium stores a computer program, when the computer program is executed by the processor, the steps of the security probe management method of the application program are realized as shown in the above embodiment, and the same technical effects can be achieved, to avoid repetition, which will not be repeated here. The computer readable storage medium includes a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a magnetic disk or an optical disk, etc.

[0139] The embodiment of the application further provides a computer program product, including computer instructions, when the computer instructions are executed by the processor, the steps of the security probe management method of the application program are realized, and the same technical effects can be achieved, to avoid repetition, which will not be repeated here.

[0140] It should be noted that in this paper, the term "includes", "contains" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "includes a" does not exclude the presence of another identical element in the process, method, article or device including the element. ​

[0141] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned example methods can be realized by means of software and a necessary general hardware platform, and of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product in essence or in the form of a part that contributes to the prior art. The computer software product is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0142] The embodiments of the present application are described above in combination with the drawings, but the present application is not limited to the above-mentioned specific embodiments, and the above-mentioned specific embodiments are only illustrative and not limiting. Those skilled in the art can make many forms without departing from the scope of the present application under the inspiration of the present application, and all of them belong to the protection of the present application.

Claims

1. A security probe management method of an application program, characterized by, The method comprises: obtaining a first parameter and a second parameter of each hook point of a security probe of an application to be detected, wherein the first parameter is used to represent resource occupation of the hook point, and the second parameter is used to represent risk assessment of the hook point; collecting the first parameter and the second parameter of each hook point as design variables of a multi-objective game model, constructing a multi-objective game model based on the design variables, the multi-objective game model has multiple objective functions, the multiple objective functions are used to comprehensively evaluate the resource occupation and the risk assessment of the hook point, and the minimum resource occupation and the minimum risk assessment are used as the target; the game party of the multi-objective game model is each hook point; determining an optimal solution of the multiple objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter; according to the optimal solution, calculating the solution of each hook point; and sorting each hook point in order of the value of the solution from small to large; monitoring the load condition of the application to be detected, and when the load condition exceeds a first threshold, sequentially closing the corresponding hook point in order of the value of the solution from small to large, until the load condition of the application to be detected is reduced to within a second threshold, and stopping closing the hook point; wherein the second threshold is less than or equal to the second threshold.

2. The method of claim 1, wherein, determining the optimal solution of the multiple objective functions comprises: performing weighted summation calculation on the multiple objective functions according to the multiple objective functions and preset weight values corresponding to each objective function in the multiple objective functions, to obtain an evaluation function of the multi-objective game model; determining the solution when the evaluation function takes the minimum value as the optimal solution.

3. The method of claim 1, wherein, After monitoring the load condition of the application to be detected, when the load condition of the application to be detected exceeds a first threshold, sequentially closing the corresponding hook point in order of the value of the solution from small to large, until the load condition of the application to be detected is reduced to within a second threshold, and stopping closing the hook point, the method further comprises: continuously monitoring the load condition of the application to be detected, and when the load condition is lower than a third threshold, sequentially opening the closed hook point in order of the value of the solution of the closed hook point from large to small, until the load condition of the application to be detected reaches a second preset threshold, and stopping opening the closed hook point, wherein the third threshold is less than the second threshold.

4. The method of claim 1, wherein, After obtaining the first parameter and the second parameter of each hook point of the security probe of the application to be detected, the method further comprises: based on the first parameter, the second parameter and a current event, evaluating the danger level of the application to be detected, wherein the current event comprises at least one of the following: abnormal attack behavior on the application to be detected, malicious request behavior on the application to be detected, and data leakage condition of the application to be detected.

5. The method of claim 4, wherein, The method further comprises: continuously monitoring the load condition of the application to be detected, when the load condition is lower than a third threshold value and the risk level of the application to be detected changes, reconstructing a new multi-objective game model based on the first parameter and the second parameter of the currently running hook point and the recorded last first parameter and second parameter of the closed hook point before being closed, determining an evaluation function of the new multi-objective game model based on a new plurality of objective functions of the new multi-objective game model; determining the solution when the evaluation function of the new multi-objective game model takes the minimum value as the optimal solution of the new multi-objective game model; redetermining the solution of each hook point based on the game strategy according to the optimal solution of the new multi-objective game model; and performing new sorting of each hook point in the order from small to large value of the solution; opening the closed hook point and re-closing the hook point in the order from small to large value of the solution in the new sorting, wherein the third threshold value is less than the second threshold value.

6. The method according to any one of claims 1-5, characterized in that, The first parameter comprises at least one of the following: central processing unit (CPU) occupation, memory occupation, JVM heap memory occupation, and meta-space occupation; The second parameter comprises at least one of the following: vulnerability risk degree of the hook point, call number of the hook, business hit number of the hook point, and propagation breadth of the hook point.

7. An application security probe management apparatus, characterized by comprising: The apparatus comprises: an acquisition module configured to acquire a first parameter and a second parameter of each hook point of a security probe of an application to be detected, wherein the first parameter is used to indicate resource occupation of the hook point, and the second parameter is used to indicate risk assessment of the hook point; an execution module configured to collectively use the first parameter and the second parameter of each hook point as a design variable of a multi-objective game model, construct the multi-objective game model based on the design variable, the multi-objective game model has a plurality of objective functions, and the plurality of objective functions are used to comprehensively evaluate the resource occupation and the risk assessment of the hook point, so as to minimize the resource occupation and minimize the risk assessment as a target; and the multi-objective game model has a game side of each hook point; determine an optimal solution of the plurality of objective functions, wherein the optimal solution is a combination of the first parameter and the second parameter; calculate the solution of each hook point according to the optimal solution; and sort each hook point in the order from small to large value of the solution. The load condition of the application to be detected is monitored, when the load condition exceeds a first threshold, the corresponding hook points are closed in the order of the values from small to large, until the load condition of the application to be detected is reduced to within a second threshold, and the closing of the hook points is stopped; wherein the second threshold is less than or equal to the second threshold.

8. An electronic device, comprising: Comprising: A processor, a memory, and a program stored on the memory and executable on the processor, the program being executed by the processor to implement the steps of the application security probe management method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the application security probe management method according to any one of claims 1-6.

10. A computer program product, characterised in that, The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the application security probe management method according to any one of claims 1-6. The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the application security probe management method according to any one of claims 1-6.

Images