Java deserialization vulnerability defense method and system
By automatically building semantic structure trees and whitelist lists, identifying legitimate Java deserialization operations, it solves the problem that it is difficult to effectively defend against Java deserialization vulnerabilities in the existing technology, and achieves a high-reliability defense effect.
Patent Information
- Application Number
- CN202411674233.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-03-11
AI Technical Summary
It is difficult for existing technology to effectively defend against Java deserialization vulnerabilities. High-level attackers can bypass the blacklist construction utilization chain, resulting in the vulnerability still has harm.
By automatically building semantic structure trees and whitelist lists, we can identify legitimate deserialization operations, reduce false positives and missed reports, and improve the reliability of defense.
It realizes accurate identification of legal deserialization operations, reduces false positives and missed reports, and improves the reliability of Java deserialization vulnerability defense.
Smart Images
Figure CN119598452A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of computer technology, and in particular relates to a Java deserialization vulnerability defense method and system. Background Art
[0002] In the related technology, serialization and deserialization related operations are used in many programming languages, such as Java, C#, PHP, Python and other programming languages. Serialization refers to converting objects in programming languages into byte sequences for storage or transmission, while deserialization is the restoration of byte sequences to objects in programming languages. An attacker can construct malicious byte sequences, and when the service program deserializes these byte sequences, the attacker can achieve his goal (execute arbitrary commands on the server or read and write arbitrary files).
[0003] In order to mitigate the harm caused by the Java deserialization vulnerability, the system can ensure the security of the system by prohibiting the appearance of some classes during the deserialization process, which is a blacklist idea. This defense idea can successfully prevent script kiddies, that is, using open source tools such as ysoserial to generate an exploit chain, and then use the exploit chain to attack other systems. It only needs to analyze each exploit chain generated by the open source tool, and then add the types and classes involved in each chain but not within the normal serialization usage range to the blacklist, and then successfully defend against attackers who use open source tools to attack. However, this defense method is still a relatively elementary defense method. High-level attackers can construct specific exploit chains by themselves to bypass blacklists. Almost every year, new Java deserialization exploit chains are constructed to bypass various blacklists. Therefore, how to better mitigate the harm caused by Java deserialization vulnerabilities has become an urgent problem to be solved. Summary of the invention
[0004] In view of the above shortcomings of the prior art, the purpose of the invention is to provide a Java deserialization vulnerability defense method and system. The method can automatically determine the semantic structure tree and whitelist list without manual preparation, and can accurately identify legal deserialization operations, reduce false positives and false negatives, and improve the reliability of defense.
[0005] The first aspect of the present invention proposes a Java deserialization vulnerability defense method, comprising: S1, obtaining one or more deserialization points in a program; S2, determining a root node according to the class to which the object generated by the deserialization point belongs, and constructing a semantic structure tree corresponding to the deserialization point based on the root node; S3, based on traversing the semantic structure tree, determining a whitelist list of the semantic structure tree according to the class corresponding to each node in the semantic structure tree and the attributes of the edge connecting each node with the corresponding parent node; S4, importing the whitelist list as a configuration file into a Java probe, and verifying the deserialization operation performed by the program based on the Java probe.
[0006] Further, determining the root node according to the class to which the deserialization point generated object belongs includes: determining the object generated by the deserialization point, and determining the class to which the object belongs based on the attribute information of the object; and taking the class to which the object belongs as the root node.
[0007] Furthermore, a semantic structure tree corresponding to the deserialization point is constructed based on the root node, including: determining whether the class to which the object belongs is converted to the target class; if it is determined that it is converted to the target class, taking the target class as a child node extending from the class to which the object belongs, and determining the attributes of the first edge between the target class and the class to which the object belongs; obtaining the attributes of the target class and the class to which the attributes of the target class belong; if the class to which the attributes of the target class belong is not the target type, taking the class to which the attributes of the target class belong as a child node extending from the target class, and determining the attributes of the second edge between the target class and the class to which the attributes of the target class belong.
[0008] Furthermore, the method further includes: when it is tracked that the target class has a subclass, taking the subclass as a child node extending from the target class, and determining the attribute of the third edge between the target class and the subnode.
[0009] Furthermore, according to the class corresponding to each node in the semantic structure tree and the attribute of the edge connecting each node with the corresponding parent node, the whitelist of the semantic structure tree is determined, including: obtaining the class corresponding to each node in the semantic structure tree; judging whether the class corresponding to each node is the target parent class; if it is determined that it is not the target parent class, adding the target parent class corresponding to the node to the whitelist; determining the attribute of the edge connecting each node with the corresponding parent node; if the attribute of the connecting edge is not the attribute of the third edge, adding the class corresponding to the node to the whitelist to obtain the whitelist.
[0010] Furthermore, the deserialization operation performed by the program is verified based on the Java probe, including: when the Java probe reads the white list, determining the working environment of the Java probe; the bytecode of the Java probe checks whether the classes involved in the deserialization operation are all in the white list based on the isAssignableFrom method.
[0011] Furthermore, the working environment includes: the Java probe inserts bytecodes before and after the deserialization operation is executed; wherein, before the deserialization operation starts to be executed, the Java probe inserts the bytecode to set the whitelist list; after the deserialization operation is completed, the Java probe inserts the bytecode to clear the whitelist list.
[0012] According to a second aspect of the present invention, a Java deserialization vulnerability defense system is proposed, comprising: an acquisition module for acquiring one or more deserialization points in a program; a construction module for determining a root node according to a class to which an object generated by the deserialization point belongs, and constructing a semantic structure tree corresponding to the deserialization point based on the root node; a determination module for determining a whitelist of the semantic structure tree based on traversing the semantic structure tree and according to the class corresponding to each node in the semantic structure tree and the attributes of the edge connecting each node with the corresponding parent node; and a verification module for importing the whitelist as a configuration file into a Java probe, and verifying the deserialization operation performed by the program based on the Java probe.
[0013] According to a third aspect of the present invention, an electronic device is proposed, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute any of the methods described in the first aspect of the present invention.
[0014] According to a fourth aspect of the present invention, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute any one of the methods according to the first aspect of the present invention.
[0015] The beneficial effects of the present invention are as follows:
[0016] The Java deserialization vulnerability defense method and system described in the present invention obtain one or more deserialization points in a program; determine the root node according to the class to which the deserialization point generates the object, and construct a semantic structure tree corresponding to the deserialization point based on the root node; based on traversing the semantic structure tree, determine the whitelist of the semantic structure tree according to the class corresponding to each node in the semantic structure tree and the attributes of the edge connecting each node with the corresponding parent node; import the whitelist into the Java probe as a configuration file, and verify the deserialization operation performed by the program based on the Java probe. The method can automatically determine the semantic structure tree and the whitelist without manual formulation, and can accurately identify legal deserialization operations, reduce false positives and false negatives, and by importing the whitelist into the Java probe as a configuration file, real-time verification can be performed when the program executes the deserialization operation to ensure that only legal deserialization operations can be executed, thereby improving the reliability of defense. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings are only used to illustrate specific embodiments and are not considered to limit the present invention. In the entire drawings, the same reference symbols represent the same components. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings.
[0018] Figure 1 is a flow chart of a Java deserialization vulnerability defense method according to an embodiment of the present invention;
[0019] Figure 2 is a flowchart of a Java deserialization vulnerability defense method according to a specific embodiment of the present invention;
[0020] Figure 3 is a schematic diagram of constructing a semantic structure tree according to an embodiment of the present invention;
[0021] Figure 4 is a schematic diagram of a Java deserialization vulnerability defense system according to an embodiment of the present invention;
[0022] Figure 5 It is a structural block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION
[0023] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work should fall within the scope of protection of the present invention.
[0024] Furthermore, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessarily obscuring the concepts disclosed in the present invention.
[0025] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the orientation or position relationship indicated by the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. In addition, the terms "first", "second", and "third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. The terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.
[0026] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of methods and systems consistent with some aspects of the present invention as detailed in the appended claims.
[0027] Serialization and deserialization related operations are used in many programming languages, such as Java, C#, PHP, Python and other programming languages. Serialization refers to converting objects in programming languages into byte sequences for storage or transmission, while deserialization is the restoration of byte sequences to objects in programming languages. Attackers can construct malicious byte sequences, and when the service program deserializes these byte sequences, the attacker can achieve his goal (execute arbitrary commands on the server or read and write arbitrary files).
[0028] Although Python ranks first and Java ranks fourth in the programming language popularity ranking (TIOBE Index), the number of Java deserialization vulnerabilities in real network attack and defense is far greater than that of Python deserialization vulnerabilities. This is mainly because serialization and deserialization related operations are rarely required in Python programming, while serialization and deserialization operations must be used in many places in Java programming.
[0029] The successful exploitation of Java deserialization vulnerabilities depends on the attacker's carefully constructed exploit chain. The successful execution of a Java program depends on the corresponding library function, and the successful execution of an exploit chain also depends on the corresponding library function. Currently, there is an open source tool ysoserial for automatically generating exploit chains. This tool mainly focuses on commonly used public libraries. Since these public libraries have a certain amount of references, they have a certain scope of application. Therefore, most systems reference the Apache Commons Collections library.
[0030] In order to mitigate the harm caused by Java deserialization vulnerabilities, the system can ensure system security by prohibiting the appearance of some classes during the deserialization process, which is a blacklist approach. This defense approach can successfully prevent script kiddies from using open source tools such as ysoserial to generate an exploit chain, and then use the exploit chain to attack other systems. It only needs to analyze each exploit chain generated by the open source tool, and then add the types and classes involved in each chain that are not within the normal serialization usage range to the blacklist, which can successfully defend against attackers who use open source tools to attack.
[0031] However, this defense method is still a relatively rudimentary one. High-level attackers can construct specific exploit chains to bypass blacklists. Almost every year, new Java deserialization exploit chains are constructed to bypass various blacklists. For example, the CVE-2017-1000353 vulnerability is an example of bypassing blacklists by constructing an exploit chain through the SignedObject object.
[0032] A better defense idea is to establish a whitelist and only allow the classes involved in the deserialization of normal user data. However, the difficulty in establishing a whitelist is how to determine the scope of the whitelist. Most developers are afraid of interfering with the normal operation of the business. Without clarifying the specific inheritance and polymorphic relationships, they directly set the whitelist range to a large value, which has no protection effect at all. For example, the CVE-2021-26295 vulnerability involves the Apache OFBiz framework. Because its whitelist strategy is too broad, one of the regular expressions is "java..*", which allows attackers to construct an exploit chain for java.rmi.server to successfully execute arbitrary commands.
[0033] There is nothing wrong with establishing a whitelist defense idea, but it is difficult to establish a whitelist strategy that has good defense effects and does not affect normal business operations. Therefore, the best way is to automatically determine the classes involved in deserializing normal user data through program semantic analysis, and then combine these classes into a whitelist list.
[0034] With the whitelist, these policies can be embedded into the system. One way is to modify the original system code and add verification logic in the deserialization operation part to verify whether the class not in the whitelist is involved. If so, the deserialization operation is prohibited. However, there are many existing systems, and it takes a lot of time to modify the system source code one by one.
[0035] To this end, the present invention proposes a Java deserialization vulnerability defense method, system and related equipment. Specifically, the Java deserialization vulnerability defense method, system and related equipment of an embodiment of the present invention are described below with reference to the accompanying drawings.
[0036] Figure 1 It is a flow chart of a Java deserialization vulnerability defense method according to an embodiment of the present invention. It should be noted that the Java deserialization vulnerability defense method of the embodiment of the present invention can be applied to the Java deserialization vulnerability defense system of the embodiment of the present invention. The Java deserialization vulnerability defense system can be configured on an electronic device or in a server. This embodiment of the application is not limited to this.
[0037] like Figure 1 As shown, the Java deserialization vulnerability defense system includes:
[0038] S110, obtaining one or more deserialization points in the program.
[0039] In an embodiment of the present invention, all deserialization operation locations in a program can be identified, and the deserialization operation locations are used as deserialization points.
[0040] S120, determining a root node according to the class to which the deserialization point generates the object, and constructing a semantic structure tree corresponding to the deserialization point based on the root node.
[0041] In an embodiment of the present invention, the object generated by the deserialization point is determined, and the class to which the object belongs is determined based on the attribute information of the object; the class to which the object belongs is used as the root node. Then, a semantic structure tree corresponding to the deserialization point is constructed based on the root node. For specific implementation methods, please refer to the subsequent embodiments.
[0042] Among them, each deserialization point corresponds to the construction of a semantic structure tree.
[0043] S130, based on traversing the semantic structure tree, determine a whitelist of the semantic structure tree according to the class corresponding to each node in the semantic structure tree and the attribute of the edge connecting each node with the corresponding parent node.
[0044] In the embodiment of the present invention, when constructing a semantic structure tree, the semantic structure tree can be traversed. In the process of traversing the semantic structure tree, the class corresponding to each node in the semantic structure tree can be determined. By judging the class corresponding to each node and the attribute of the edge connecting each node with the corresponding parent node, the whitelist of the semantic structure tree can be determined. The specific implementation method can refer to the subsequent embodiments.
[0045] Among them, each semantic structure tree corresponds to a whitelist.
[0046] S140, importing the whitelist as a configuration file into the Java probe, and verifying the deserialization operation performed by the program based on the Java probe.
[0047] In an embodiment of the present invention, when a whitelist is obtained, the whitelist can be imported into a Java probe as a configuration file. When the Java probe reads the whitelist, the working environment of the Java probe is determined; the bytecode of the Java probe checks whether the classes involved in the deserialization operation are all in the whitelist based on the isAssignableFrom method. The specific implementation method can refer to the subsequent embodiments.
[0048] According to the Java deserialization vulnerability defense method of the embodiment of the present invention, one or more deserialization points in the program are obtained; the root node is determined according to the class to which the object generated by the deserialization point belongs, and a semantic structure tree corresponding to the deserialization point is constructed based on the root node; based on the traversal of the semantic structure tree, the white list of the semantic structure tree is determined according to the class corresponding to each node in the semantic structure tree and the attributes of the edge connecting each node with the corresponding parent node; the white list is imported into the Java probe as a configuration file, and the deserialization operation performed by the program is verified based on the Java probe. This method can automatically determine the semantic structure tree and the white list without manual formulation, and can accurately identify legal deserialization operations, reduce false positives and false negatives, and by importing the white list as a configuration file into the Java probe, real-time verification can be performed when the program executes the deserialization operation to ensure that only legal deserialization operations can be executed, thereby improving the reliability of defense.
[0049] In order to make it easier for those skilled in the art to understand the present invention, Figure 2 A Java deserialization vulnerability defense method according to a specific embodiment of the present invention is as follows. Figure 2 As shown, the Java deserialization vulnerability defense method includes:
[0050] S210, obtaining one or more deserialization points in the program.
[0051] S220, determining a root node according to the class to which the deserialized point generated object belongs.
[0052] In an embodiment of the present invention, an object generated by a deserialization point is determined, and a class to which the object belongs is determined based on the attribute information of the object; and the class to which the object belongs is taken as a root node.
[0053] S230, constructing a semantic structure tree corresponding to the deserialization point based on the root node.
[0054] In an embodiment of the present invention, when the root node is determined, it is determined whether the class to which the object belongs is converted to the target class; when it is determined to be converted to the target class, the target class is used as a child node extending from the class to which the object belongs, and the attributes of the first edge between the target class and the class to which the object belongs are determined; the attributes of the target class and the class to which the attributes of the target class belong are obtained; when the class to which the attributes of the target class belong is not the target type, the class to which the attributes of the target class belong is used as a child node extending from the target class, and the attributes of the second edge between the target class and the class to which the attributes of the target class belong are determined.
[0055] Among them, the attribute of the first edge can be marked as 1, and the attribute of the second edge can be marked as 2.
[0056] The target type can be understood as a basic Java data type, including but not limited to byte, short, int, long, float, double, boolean, char, String, etc.
[0057] In an embodiment of the present invention, when it is traced that a target class has a subclass, the subclass is regarded as a subnode extending from the target class, and the attribute of the third edge between the target class and the subnode is determined.
[0058] Among them, the attribute of the third side can be marked as 3.
[0059] S240, based on traversing the semantic structure tree, determine a whitelist of the semantic structure tree according to the class corresponding to each node in the semantic structure tree and the attribute of the edge connecting each node with the corresponding parent node.
[0060] In an embodiment of the present invention, based on traversing the semantic structure tree, the class corresponding to each node in the semantic structure tree is obtained; it is determined whether the class corresponding to each node is the target parent class; if it is determined that it is not the target parent class, the target parent class corresponding to the node is added to the whitelist; the attribute of the edge connecting each node and the corresponding parent node is determined; if the attribute of the connecting edge is not the attribute of the third edge, the class corresponding to the node is added to the whitelist to obtain a whitelist list.
[0061] S250, importing the whitelist as a configuration file into the Java probe, and verifying the deserialization operation performed by the program based on the Java probe.
[0062] In an embodiment of the present invention, when the Java probe reads the white list, the working environment of the Java probe is determined; the bytecode of the Java probe checks whether the classes involved in the deserialization operation are all in the white list based on the isAssignableFrom method.
[0063] The working environment includes: the Java probe inserts bytecodes before and after the deserialization operation is executed; before the deserialization operation starts to be executed, the Java probe inserts the bytecode to set the whitelist list; after the deserialization operation is completed, the Java probe inserts the bytecode to clear the whitelist list.
[0064] It can be understood that, when the working environment of the Java probe is determined, the Java probe inserts the bytecode into the deserialization process to verify whether the classes involved in the deserialization operation are all in the whitelist. It is known that the Java deserialization operation first parses the class corresponding to the byte sequence, and then calls its constructor or generates an object through reflection. The Java probe needs to insert the verified bytecode after the parsing process and before the object is generated, because the object generation part will call the exploit chain constructed by the attacker, and it must be blocked before the exploit chain is called;
[0065] As mentioned before, when the attribute of the edge connecting a node to its parent node is 3 (inheritance relationship), the class corresponding to the node will not be added to the whitelist. This is because the judgment of whether the class involved in deserialization is in the whitelist is not based on the class name, but on the isAssignableFrom method. When two classes have different class names but have an inheritance relationship, the isAssignableFrom method will also return true. Therefore, after the parent class has been added to the whitelist, its subclass does not need to be added to the whitelist.
[0066] In a specific embodiment of the present invention, Figure 3 As shown in the figure, it is determined that the class to which the object generated by the deserialization point belongs is the Object class, so the Object class is used as the root node of the semantic structure tree. Then the object is tracked and it is found that it will be converted into the Animal class in a certain program branch later. Therefore, a child node is extended, that is, the Animal class is used as a child node of the Object class, and the attribute of the edge connecting the Animal class and the Object class is marked as 1. No other relationship is tracked later. Therefore, the root node is processed and its child node Animal class is recursively processed. It is tracked that the Animal class has two subclasses (Tiger and Dog), so it is extended to the child node of the Animal class, and the connection attribute is marked as 3. Then it is tracked to The Animal class has 4 attributes, but two of them belong to Java basic data types (int, String). These two attributes are not added to the tree, and the classes corresponding to the other two attributes (Comparable, Object) are added to the tree, and the connection attribute is marked as 2; continue to recursively process the four nodes Tiger, Dog, Comparable, and Object, and find that only the Comparable node can extend new child nodes, and the other nodes only involve Java basic data types; trace that the object corresponding to the Comparable node will be converted to the Score class in a certain program branch, so the Score class is added to the tree, and the connection attribute is marked as 1. Then get the semantic structure tree.
[0067] After that, the semantic structure tree is traversed. General classes (such as Object, Serializable, Comparable, etc.) will not be added to the whitelist, so the Object node and Comparable node involved here are filtered out; then, since the attribute corresponding to the edge connecting the Tiger and Dog nodes to their parent nodes is 3, they will not be added to the whitelist according to the rules; finally, after deduplication, the final whitelist is formed, which is cn.ctseelink.Animal and cn.ctseelink.Score. Then, the whitelist is imported into the Java probe as a configuration file, and the deserialization operation performed by the Java probe is verified.
[0068] According to the Java deserialization vulnerability defense method of the embodiment of the present invention, by constructing a semantic structure tree and determining a whitelist list, the method can accurately identify which classes and attributes are involved in the legitimate deserialization operation, thereby effectively defending against malicious deserialization attacks. With the update and iteration of the program, the semantic structure tree and the whitelist list can be dynamically updated to adapt to new deserialization scenarios and object relationships, ensuring the effectiveness of defense measures. Through traversal and attribute judgment based on the semantic structure tree, the method can avoid misjudging legitimate deserialization operations as malicious behavior, thereby reducing the false alarm rate. By recursively processing each node of the semantic structure tree, it is ensured that all possible deserialization paths are taken into account, thereby reducing the possibility of missed reports. The Java probe inserts bytecode for verification before and after the deserialization operation, but only intervenes in the necessary parsing and object generation stages, avoiding unnecessary impact on program performance. The method is not only applicable to Java native deserialization operations, but can also be extended to deserialization operations performed using third-party libraries or frameworks, and only the construction method of the semantic structure tree and the determination rules of the whitelist list need to be adjusted according to the specific situation. By automatically constructing a semantic structure tree and determining a whitelist, the cost of manual review and configuration is reduced, making the implementation of defense measures easier. As the program is updated and iterated, the effectiveness of the defense measures can be maintained by simply updating the semantic structure tree and whitelist, without the need for extensive code modification or reconstruction. By marking the attributes of the connecting edges (such as the inheritance relationship is marked as 3), this method can correctly handle the inheritance relationship between objects and avoid repeatedly adding subclasses to the whitelist. The isAssignableFrom method is used to determine the class relationship. This method can handle the situation where the class names are different but have an inheritance relationship due to polymorphism, ensuring the accuracy of the defense measures.
[0069] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.
[0070] According to one aspect of an embodiment of the present invention, a Java deserialization vulnerability defense system is also proposed. Figure 4 Schematic diagram of the ava deserialization vulnerability defense system according to an embodiment of the present invention; Figure 4 As shown, including:
[0071] An acquisition module 410, used to acquire one or more deserialization points in a program;
[0072] A construction module 420 is used to determine a root node according to the class to which the deserialization point generation object belongs, and to construct a semantic structure tree corresponding to the deserialization point based on the root node;
[0073] A determination module 430 is used to determine a whitelist of the semantic structure tree based on traversing the semantic structure tree and according to a class corresponding to each node in the semantic structure tree and an attribute of an edge connecting each node with a corresponding parent node;
[0074] The verification module 440 is used to import the white list as a configuration file into the Java probe, and verify the deserialization operation performed by the program based on the Java probe.
[0075] According to the Java deserialization vulnerability defense system of the embodiment of the present invention, one or more deserialization points in the program are obtained; the root node is determined according to the class to which the object generated by the deserialization point belongs, and the semantic structure tree corresponding to the deserialization point is constructed based on the root node; based on the traversal of the semantic structure tree, the white list of the semantic structure tree is determined according to the class corresponding to each node in the semantic structure tree and the attributes of the edge connecting each node with the corresponding parent node; the white list is imported into the Java probe as a configuration file, and the deserialization operation performed by the program is verified based on the Java probe. In this way, the semantic structure tree and the white list can be automatically determined without manual formulation, and legal deserialization operations can be accurately identified, reducing false positives and false negatives. By importing the white list as a configuration file into the Java probe, real-time verification can be performed when the program executes the deserialization operation to ensure that only legal deserialization operations can be executed, thereby improving the reliability of defense.
[0076] Optionally, the construction module 420 is specifically configured to determine the object generated by the deserialization point, and determine the class to which the object belongs based on the attribute information of the object; and use the class to which the object belongs as the root node.
[0077] Optionally, a construction module 420 is specifically used to determine whether the class to which the object belongs is converted to a target class; if it is determined that the class is converted to the target class, the target class is used as a child node extending from the class to which the object belongs, and the attributes of the first edge between the target class and the class to which the object belongs are determined; the attributes of the target class and the class to which the attributes of the target class belong are obtained; if the class to which the attributes of the target class belong is not a target type, the class to which the attributes of the target class belong is used as a child node extending from the target class, and the attributes of the second edge between the target class and the class to which the attributes of the target class belong are determined.
[0078] Optionally, the construction module 420 is specifically configured to, when it is tracked that the target class has a subclass, use the subclass as a child node extending from the target class, and determine the attribute of the third edge between the target class and the subnode.
[0079] Optionally, the determination module 430 is specifically used to obtain the class corresponding to each node in the semantic structure tree; determine whether the class corresponding to each node is the target parent class; if it is determined that it is not the target parent class, add the target parent class corresponding to the node to the whitelist; determine the attribute of the edge connecting each node with the corresponding parent node; if the attribute of the connecting edge is not the attribute of the third edge, add the class corresponding to the node to the whitelist to obtain the whitelist list.
[0080] Optionally, the verification module 440 is specifically used to determine the working environment of the Java probe when the Java probe reads the white list; the bytecode of the Java probe checks whether the classes involved in the deserialization operation are all in the white list based on the isAssignableFrom method.
[0081] Optionally, the working environment includes: the Java probe inserts bytecodes before and after the deserialization operation is executed; before the deserialization operation starts to be executed, the Java probe inserts the bytecode to set the whitelist; after the deserialization operation is completed, the Java probe inserts the bytecode to clear the whitelist. According to one aspect of an embodiment of the present invention, an electronic device is provided.
[0082] Figure 5 Schematic diagram of the structure of an electronic device according to an embodiment of the present invention. Figure 5 As shown, the electronic device may include one or more ( Figure 5 Only one is shown in the figure) processor 102 (processor 102 may include but is not limited to a microprocessor (Microprocessor Unit, referred to as MPU) or a programmable logic device (Programmable logic device, referred to as PLD)) and a memory 104 for storing data. In an exemplary embodiment, the electronic device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 5 The structure shown is for illustration only and does not limit the structure of the above terminal device. Figure 5 More or fewer components as shown, or with Figure 5 Equivalent functions or comparisons shown Figure 5 A different configuration with more features is shown.
[0083] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the Java deserialization vulnerability defense method in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, to implement the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the terminal device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
[0084] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the switching device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.
[0085] The present invention provides a non-transient computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable the computer to execute a Java deserialization vulnerability defense method.
[0086] The applicant of the present invention has made a detailed explanation and description of the implementation examples of the present invention in conjunction with the drawings in the specification. However, those skilled in the art should understand that the above implementation examples are only preferred implementation schemes of the present invention, and the detailed description is only to help readers better understand the spirit of the present invention, but not to limit the scope of protection of the present invention. On the contrary, any improvements or modifications based on the inventive spirit of the present invention should fall within the scope of protection of the present invention.
[0087] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.
[0088] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present invention have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present invention. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.
[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the above embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. Any changes or replacements that can be easily thought of by those skilled in the art within the technical scope disclosed in the present invention should be covered within the protection scope of the present invention.
Claims
1. A Java deserialization vulnerability defense method, characterized in that: include: S1, obtain one or more deserialization points in the program; S2, determining a root node according to the class to which the deserialization point generation object belongs, and constructing a semantic structure tree corresponding to the deserialization point based on the root node; S3, based on traversing the semantic structure tree, determining a whitelist of the semantic structure tree according to the class corresponding to each node in the semantic structure tree and the attribute of the edge connecting each node with the corresponding parent node; S4, importing the white list into a Java probe as a configuration file, and verifying the deserialization operation performed by the program based on the Java probe.
2. The Java deserialization vulnerability defense method according to claim 1 is characterized in that: Determining the root node according to the class to which the deserialization point generating object belongs includes: Determine the object generated by the deserialization point, and determine the class to which the object belongs based on the attribute information of the object; The class to which the object belongs is taken as the root node.
3. The Java deserialization vulnerability defense method according to claim 2 is characterized in that: Constructing a semantic structure tree corresponding to the deserialization point based on the root node, including: Determine whether the class to which the object belongs is converted to a target class; In the case of determining to convert to the target class, taking the target class as a child node extending from the class to which the object belongs, and determining an attribute of a first edge between the target class and the class to which the object belongs; Acquire the attributes of the target class and the class to which the attributes of the target class belong; When the class to which the attribute of the target class belongs is not the target type, the class to which the attribute of the target class belongs is taken as a child node extending from the target class, and the attribute of the second edge between the target class and the class to which the attribute of the target class belongs is determined.
4. The Java deserialization vulnerability defense method according to claim 3 is characterized in that: Also includes: In the case where it is traced that the target class has a subclass, the subclass is regarded as a child node extending from the target class, and the attribute of the third edge between the target class and the child node is determined.
5. The Java deserialization vulnerability defense method according to claim 1, characterized in that: Determining a whitelist of the semantic structure tree according to a class corresponding to each node in the semantic structure tree and an attribute of an edge connecting each node with a corresponding parent node includes: Obtaining the class corresponding to each node in the semantic structure tree; Determine whether the class corresponding to each node is the target parent class; If it is determined that the node is not the target parent class, the target parent class corresponding to the node is added to the whitelist; Determine the attributes of the edge connecting each node with the corresponding parent node; When the attribute of the connecting edge is not the attribute of the third edge, the class corresponding to the node is added to the whitelist to obtain the whitelist.
6. The Java deserialization vulnerability defense method according to claim 1, characterized in that: Verifying the deserialization operation performed by the program based on the Java probe includes: In the case where the Java probe reads the white list, determining the working environment of the Java probe; The bytecode of the Java probe checks whether all classes involved in the deserialization operation are in the whitelist based on the isAssignableFrom method.
7. The Java deserialization vulnerability defense method according to claim 6, characterized in that: The working environment includes: the Java probe inserts bytecodes before and after the deserialization operation is executed; wherein, Before the deserialization operation starts to be executed, the Java probe will be inserted into the bytecode to set the whitelist; After the deserialization operation is completed, the Java probe will insert the bytecode to clear the whitelist.
8. A Java deserialization vulnerability defense system, characterized in that: include: An acquisition module is used to obtain one or more deserialization points in a program; A construction module, used to determine a root node according to the class to which the deserialization point generation object belongs, and to construct a semantic structure tree corresponding to the deserialization point based on the root node; A determination module, configured to determine a whitelist of the semantic structure tree based on traversing the semantic structure tree and according to a class corresponding to each node in the semantic structure tree and an attribute of an edge connecting each node with a corresponding parent node; A verification module is used to import the white list as a configuration file into a Java probe, and verify the deserialization operation performed by the program based on the Java probe.
9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 7.