Security detection method and device of application program, server and medium

Abstract

The invention provides a security detection method and device for an application program, a server and a medium, and relates to the technical field of communication, in particular to the technical field of vulnerability detection and security protection. According to the specific implementation scheme, key classes included in a program virtual machine are determined, wherein the key classes are classes related to operation of a to-be-detected application program; and then, based on a preset corresponding relationship between each class and a detection item, determining a key detection item corresponding to the key class, the corresponding relationship being from the management platform, and the key detection item being used for checking whether the running process of the to-be-detected application program is abnormal or not. And then inserting a key detection item into the key class, so that the key detection item is executed in the execution process of the key class. And a novel or complex attack means can be more effectively dealt with.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to the field of vulnerability detection and security protection technology. Background Art

[0002] With the acceleration of digital transformation, web applications have gradually become the core business of enterprises and a key tool for enterprise platforms to interact with user devices. However, web applications have also increasingly become the target of attackers, who may damage or steal data stored in enterprise platforms, posing huge security risks. Summary of the invention

[0003] The present disclosure provides a method, device, server and medium for security detection of an application program.

[0004] A first aspect of an embodiment of the present disclosure provides a method for security detection of an application program, comprising:

[0005] Determine the key classes included in the program virtual machine, where the key classes are classes related to the operation of the application to be detected;

[0006] Based on the preset correspondence between each class and the detection item, determine the key detection item corresponding to the key class, the correspondence comes from the management platform, and the key detection item is used to check whether the running process of the application to be detected is abnormal;

[0007] The key detection item is inserted into the key class, so that the key detection item is executed during the execution process of the key class.

[0008] A second aspect of the embodiments of the present disclosure provides a security detection device for an application program, including:

[0009] A determination module, used to determine key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application to be detected;

[0010] The determination module is further used to determine the key detection items corresponding to the key classes based on the preset correspondence between each class and the detection items, wherein the correspondence comes from the management platform, and the key detection items are used to check whether the running process of the application to be detected is abnormal;

[0011] The insertion module is used to insert the key detection item into the key class so that the key detection item is executed during the execution of the key class.

[0012] A third aspect of the embodiments of the present disclosure provides a server, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any method according to the first aspect.

[0016] According to a fourth aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to cause the computer to execute a method according to any one of the first aspects.

[0017] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0018] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0020] Figure 1 is a flow chart of a security detection method for an application program provided by an embodiment of the present disclosure;

[0021] Figure 2 is a flow chart of a method for inserting a detection item in a newly added class provided by an embodiment of the present disclosure;

[0022] Figure 3 is a flow chart of another application security detection method provided by an embodiment of the present disclosure;

[0023] Figure 4 is a schematic diagram of the structure of a security detection device for an application program provided by an embodiment of the present disclosure;

[0024] Figure 5 The block diagram is a server for implementing the security detection method of the application program according to the embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0026] Conventional security protection for Web applications mainly relies on traditional border protection devices, such as firewalls or intrusion detection systems. Border protection devices are usually located between terminals and servers. They match the parameters carried in the request sent by the terminal with the preset feature library to determine whether the request contains attack behavior. If there is an attack behavior, the request is intercepted. If there is no attack behavior, the request is forwarded to the server. However, the accuracy of this method depends on the feature library, which has a lag and is difficult to effectively deal with new or complex attack features.

[0027] In order to solve the above problems, the embodiments of the present disclosure provide a method for security detection of an application, which is applied to a server. For example, the server may be a tomcat or weblogic application server, or other server with application running capabilities and data processing capabilities. The following takes the server as an application server as an example to illustrate the method for security detection of an application provided by the embodiments of the present disclosure. In the application server, the software module that implements the method for security detection of an application provided by the embodiments of the present disclosure may be called a protection engine. Figure 1 As shown, the security detection method of the application provided by the embodiment of the present disclosure includes the following steps:

[0028] S101, determining key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application to be detected.

[0029] The program virtual machine may be a Java virtual machine (JVM), where Java is a programming language. The program virtual machine is a virtual computer, a software that provides a Java program running environment and can compile program codes to convert them into Java bytecodes.

[0030] Each class describes the common characteristics of a group of objects with the same properties and methods, which are used to define the structure and behavior of the objects. Each class contains a data description and a set of functions for operating data or passing messages, which are called methods.

[0031] The application to be detected is an application running in an application server. The application belongs to a server-side application and can respond to user requests from a terminal.

[0032] S102: Determine key detection items corresponding to key classes based on preset correspondences between classes and detection items.

[0033] The corresponding relationship comes from the management platform. For example, when the application server starts the protection engine for the first time, the management platform can send the corresponding relationship between each class and the detection item to the protection engine, and then the protection engine stores these corresponding relationships locally so that after each subsequent startup, these corresponding relationships can be used for security protection. For another example, each time the application server starts the protection engine, the management platform can update the corresponding relationship used by the protection engine so that the protection engine can use the updated corresponding relationship for security protection. The management platform can be applied to the management server.

[0034] Key detection items are used to check whether the running process of the application to be detected is abnormal. For example, when the application to be detected traverses the file directory of the application server, thereby accessing and reading the private files and private file directories in the application server, it is determined that the running process of the application to be detected is abnormal. For another example, when the application to be detected modifies the name of a file stored in the application server, it is determined that the running process of the application to be detected is abnormal. The specific detection method can be referred to the description below.

[0035] S103: inserting a key detection item into the key class, so that the key detection item is executed during the execution process of the key class.

[0036] In the disclosed embodiment, when the above-mentioned application server is started, the protection engine can be started. The protection engine can be in the form of a javaagent and run on a Java virtual machine. The protection engine can insert key detection items into key classes by replacing bytecodes with the help of the instrumentation technology provided by the Java virtual machine, that is, complete the instrumentation of key classes and implement the hooking of key classes. This method can embed the protection engine into the application to be detected without modifying the source code of the application to be detected, thereby integrating the vulnerability detection function into the application to be detected and avoiding the high complexity of development and maintenance caused by modifications at the source code level.

[0037] Since the disclosed embodiment can insert corresponding key detection items into the key classes related to the operation of the application to be detected, the key detection items can be executed during the execution of the key classes, thereby checking whether the operation of the application to be detected is abnormal during the operation of the application to be detected. That is, the disclosed embodiment can monitor and detect various key operations actually performed by the application to be detected, so that vulnerability detection focuses on the operations actually performed by the application to be detected, rather than just the features included in the user request, thereby reducing the reliance of vulnerability detection on the features included in the user request, making the update of the features included in the user request have less impact on vulnerability detection. Therefore, the disclosed embodiment can more effectively deal with new or complex attack methods.

[0038] The following is a detailed description of the security detection method for an application program provided by an embodiment of the present disclosure.

[0039] In the embodiment of the present disclosure, the key class in S101 may include: a first key class belonging to the application to be detected, and / or a second key class belonging to a service component. The service component is a component included in the server running the application to be detected, for example, the service component may include a container kernel (Catalina).

[0040] The first detection item corresponding to the first key category is used to check whether the process of the application to be detected responding to the user request is abnormal.

[0041] In the embodiment of the present disclosure, the first detection item includes at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item. The first detection items inserted in each first key class can be the same or different, and can be specifically set based on actual needs.

[0042] File operation detection items are used to check whether the file operations targeted by the user request and the file operations performed by the application to be detected are abnormal.

[0043] For example, the file operation detection items are used to check the file path entered by the user, whether the file type of the uploaded file is an abnormal type, whether the communication protocol used is an abnormal protocol stack, whether the user does not have the read / write permission to the file, and whether the code execution environment (WebShell) is obtained through file linking, whether the WebShell is obtained through file renaming, and / or whether the file directory of the application server is traversed. If the check result of any item is yes, the check result is determined to be abnormal.

[0044] The file operation detection item may correspond to: a class for performing file processing included in the application to be detected.

[0045] The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal.

[0046] For example, the code execution detection item includes at least one of the following: deserialization sub-item, Object-Graph Navigation Language (OGNL) sub-item, Spring Expression Language (SPEL) sub-item, ScriptEngine sub-item, Expression Language (EL) sub-item, and class library loading sub-item. Among them, Spring represents the application framework, and ScriptEngine represents returning a string representing the currently used Script programming language.

[0047] The deserialization sub-item is used to check whether the class created by the application to be tested in the process of responding to the user's request belongs to the preset class blacklist. If so, the check result is determined to be abnormal. The OGNL sub-item is used to check whether the OGNL code entered by the user belongs to the preset OGNL code blacklist, or contains sensitive OGNL features. If so, the check result is determined to be abnormal. The SPEL sub-item is used to check whether the SPEL code entered by the user belongs to the preset SPEL code blacklist, or contains sensitive SPEL features. If so, the check result is determined to be abnormal. The ScriptEngine sub-item is used to check whether the ScriptEngine code entered by the user belongs to the preset ScriptEngine code blacklist, or whether the call stack of the ScriptEngine code is abnormal. If so, the check result is determined to be abnormal. The EL sub-item is used to check whether the EL code entered by the user belongs to the preset EL code blacklist, or contains sensitive EL features. If so, the check result is determined to be abnormal. The class library loading sub-item is used to check whether the application to be detected loads the class library or dynamic link library (DLL) through the Universal Naming Convention (UNC) path in the process of responding to user requests. If so, the check result is determined to be abnormal.

[0048] Among them, the deserialization sub-item can correspond to: the class used to read objects from the input stream and reconstruct them into Java objects in memory, that is, the deserialization class. The OGNL sub-item can correspond to: the class that dynamically accesses object properties, calls methods, or performs complex logical operations through string expressions. The SPEL sub-item can correspond to the class that allows objects to be queried and manipulated at runtime. The ScriptEngine sub-item can correspond to the class that provides the ability to embed and execute JavaScript in Java applications. The EL sub-item can correspond to the class that supports the expression language function in Java service pages (Java Server Pages, JSP) and Java service user interfaces (Java Server Faces, JSF). The class library loading sub-item can correspond to the class that loads the class library or DLL.

[0049] The network request detection item is used to check whether the process of the application to be detected sending requests to other devices is abnormal.

[0050] For example, network request detection items include: Java Naming and Directory Interface Injection (JNDI) sub-items and Server-Side Request Forgery (SSRF) sub-items.

[0051] Among them, the JNDI sub-item is used to check whether the application to be detected sends requests to other devices through JNDI, whether the protocol used in the request sent to other devices through JNDI belongs to the protocol blacklist, or whether the stack used belongs to the stack blacklist. If the result of any check is yes, the check result is determined to be abnormal. The SSRF sub-item is used to check whether the user input data contains sensitive features, use the framework (rebind) detection tool to identify vulnerabilities, check whether the metadata of the specified device is accessed, and check whether sensitive domain names or Internet Protocol (IP) addresses are accessed or sensitive communication protocols are used. If the result of any check is yes, the check result is determined to be abnormal.

[0052] Among them, the JNDI sub-item can correspond to: classes used to handle naming and directory service contexts based on the uniform resource locator (URL). The SSRF sub-item can correspond to: classes that implement the basic functions of Hypertext Transfer Protocol (HTTP) requests.

[0053] Injection detection items are used to check whether the database query statements and / or external injection entities included in the user request are abnormal.

[0054] For example, injection detection items include: Structured Query Language (SQL) sub-items and XML External Entity (XXE) sub-items, where XML stands for Extensible Markup Language.

[0055] The SQL sub-item is used to check whether the application to be detected loads external entities or uses sensitive file transfer protocols to load external entities and read files using sensitive file transfer protocols when responding to user requests. If any of the check results are yes, the check result is determined to be abnormal. The XXE sub-item is used to check whether the HTTP response content generated by the application to be detected when processing user requests contains malicious scripts. If so, the check result is determined to be abnormal.

[0056] The SQL sub-item may correspond to: a class that provides database connection functions, or provides database connection property and configuration acquisition functions. The XXE sub-item may correspond to a class that parses and processes XML documents.

[0057] The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

[0058] For example, a cross-site scripting detection item can check whether the HTTP response generated by the application to be detected to the user request contains a malicious script in the script blacklist. If so, the inspection result is determined to be abnormal.

[0059] Among them, the cross-site scripting class detection item may correspond to: a class used to process HTTP responses.

[0060] The disclosed embodiment supports multiple detection items, and can monitor and detect the operations performed by the application to be detected in response to user requests in real time from multiple angles, thereby enhancing the deep understanding of the internal operation behavior of the application to be detected, realizing function-level vulnerability detection, and being able to more comprehensively guarantee the safe operation of the application to be detected, thereby improving the accuracy and timeliness of vulnerability detection and reducing the operation risk of the application to be detected. In addition, the detection items in the disclosed embodiment are only used to detect the operation security of the application, and do not involve malicious acquisition and processing of the privacy information of the application, thereby ensuring the privacy of the application.

[0061] In the case where the key classes in S101 include the first key class, the way in which the above-mentioned S101 protection engine determines the key classes included in the program virtual machine can be implemented as follows: at startup, determine whether each class included in the program virtual machine meets the first preset condition, and filter out the first key class that meets the first preset condition.

[0062] The first preset condition includes: the class name and the method name included in the class belong to the preset first configuration information, the first configuration information is used to represent the first key class, and the first configuration information comes from the management platform. That is, the management platform can send the first configuration information of the first key class to the protection engine, and the first configuration information includes the class name and the method name included in the class.

[0063] The program virtual machine loads classes through a class loader, so the protection engine can determine whether each class in the Classloader satisfies the first preset condition.

[0064] In the above manner, the embodiment of the present disclosure can accurately screen out the first key class of the application to be detected through the name of the class in the program virtual machine and the name of the method included in the class, thereby reducing the possibility that the detection item is mistakenly inserted into other classes. Moreover, since in general, the class name and the method name included in the class have a higher correlation with the operation corresponding to the class, and a lower correlation with the application to which the class belongs, the protection engine in the embodiment of the present disclosure can support vulnerability detection for various applications, thereby improving the flexibility of the protection engine.

[0065] In the embodiment of the present disclosure, the second detection item corresponding to the second key class is used to check whether the running state of the server is abnormal. Since the second detection item can detect the application server, the detection process can be called baseline detection.

[0066] The second detection item includes at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item and a database detection item.

[0067] The session detection item is used to check whether the access settings to the session information are abnormal, where the session information is the information of the session created by the server in response to the user request.

[0068] For example, the session detection item is used to check whether the session identification (JSESSIONID) attribute of the application server is enabled with httpOnly. If not, the check result is determined to be abnormal. The JSESSIONID attribute is usually stored in a small text file (cookie) of the session. When httpOnly is enabled, the terminal cannot access the cookie through the JavaScript code of the client.

[0069] The account detection item is used to check whether the server login account is abnormal.

[0070] For example, the account detection item is used to check whether the application server is started with a high-authority account. If not, the check result is determined to be abnormal. Among them, high-authority accounts include: the root account of the operating system kernel (Linux), and the administrator account or system account of the operating system (Windows).

[0071] The password detection item is used to check whether the server login password is abnormal.

[0072] For example, the password detection item is used to check whether the password strength level of the administrator user in the user configuration file (tomcat-users.xml) of the application server reaches a preset level. If not, the check result is determined to be abnormal.

[0073] The application detection item is used to check whether the application programs installed on the server are abnormal.

[0074] For example, the application detection item is used to check whether sensitive applications have been deleted in the application server, that is, sensitive applications are not installed. If not, the check result is determined to be abnormal. Among them, sensitive applications include: server default applications such as root (ROOT) applications, management (manager) applications, host management (hostmanager) applications, and document engineering (docs) applications.

[0075] The directory detection item is used to check whether the server's access restrictions on file directories are abnormal.

[0076] For example, the directory detection item is used to check whether the directory listing function of the default connector (defaultservlet) is enabled on the application server. If so, the check result is determined to be abnormal. When the Directory Listing function is enabled, the file directory structure and server version information of the application server may be leaked.

[0077] The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

[0078] For example, the database detection item is used to check whether the application server uses a high-privilege account to connect to the database. If so, the check result is determined to be abnormal.

[0079] The second detection item may correspond to a class that implements the function of a Servlet container.

[0080] The disclosed embodiment supports multiple detection items, can monitor and detect the operation of the application server in real time from multiple angles, realizes function-level vulnerability detection, can more comprehensively protect the operating environment of the application to be detected, improves the accuracy and timeliness of security protection, and reduces the operating risk of the application to be detected. In addition, the detection items in the disclosed embodiment are only used to detect the operating security of the application server, and do not involve malicious acquisition and processing of the privacy information of the application server, thus ensuring the privacy of the application server.

[0081] In the case where the key classes in S101 include the second key classes, the way in which the above-mentioned S101 protection engine determines the key classes included in the program virtual machine can be implemented as follows: at startup, determine whether each class included in the program virtual machine meets the second preset condition, and filter out the second key classes that meet the second preset condition.

[0082] The second preset condition includes: the class name and the method name included in the class belong to the preset second configuration information, the second configuration information is used to characterize the second key class, and the second configuration information comes from the management platform. That is, the management platform can send the second configuration information of the second key class to the protection engine, and the second configuration information includes the class name and the method name included in the class.

[0083] In the above manner, the embodiment of the present disclosure can accurately screen out the second key class of the service component through the name of the class in the program virtual machine and the name of the method included in the class, thereby reducing the possibility that the detection item is mistakenly inserted into other classes. Moreover, since in general, the class name and the method name included in the class have a higher correlation with the operation corresponding to the class, and a lower correlation with the application to which the class belongs, the protection engine in the embodiment of the present disclosure can support vulnerability detection for various servers, thereby improving the flexibility of the protection engine.

[0084] In addition to the above-mentioned detection of the process of the application to be detected responding to the user request and the baseline detection of the application server, the embodiment of the present disclosure also supports the detection of the class library of the application to be detected, that is, the detection of the class library used by the application to be detected.

[0085] The class library detection process of the protection engine includes: in the process of inserting the first detection item in the first key class in the above S103, executing the third detection item, wherein the third detection item is used to: obtain the class library information of the class library that the first key class depends on, and based on the class library information, check whether the class library is abnormal.

[0086] The protection engine can obtain the path of the Java Archive (jar) package in the first key class through the library information collection function provided by the instrumentation technology, and then obtain the library information of the library that the component in the jar package depends on based on the path, such as the name, version and identification number of the library. Then, it is detected whether the library information contains the information in the library information blacklist. If so, it is determined that the library is abnormal, otherwise it is determined that the library is not abnormal.

[0087] The disclosed embodiment also supports a switch to control the library detection function. For example, the protection engine can turn on or off the library detection function based on instructions received from the user or instructions issued by the management platform. In this case, before obtaining the library information of the library that the first key class depends on, the protection engine library can also check whether the library detection function is turned on. If it is turned on, the above step of obtaining the library information of the library that the first key class depends on is executed, otherwise the library detection is not performed.

[0088] Since class libraries are usually provided by third-party developers to expand the functions and features of applications, but their security is difficult to guarantee, the embodiments of the present disclosure detect class libraries used by the application to be detected, which can reduce the impact of abnormal class libraries on the operation of the application to be detected.

[0089] In the disclosed embodiment, each detection item can perform security protection in addition to vulnerability detection. That is, the key detection item is also used to: when the inspection result is abnormal, perform security protection on the application to be detected. Among them, security protection includes at least one of the following: blocking the response of the application to be detected to the user request, generating an abnormal record, and reporting the abnormal record.

[0090] Among them, blocking the response of the application to be detected to the user request means preventing the application to be detected from continuing to respond to the user request. The abnormal record includes: the user request received by the application to be detected this time, the identification of the detection item that determines the inspection result as abnormal, and the current timestamp. The protection engine can report the abnormal record to the specified device or specified account.

[0091] Since the detection items can not only detect vulnerabilities, but also provide security protection, when the application to be detected is attacked by a network, it can be blocked in time to reduce the losses caused by the network attack. The attack behavior can also be recorded and reported so that the staff can detect the network attack in time and take countermeasures in time.

[0092] In addition, the detection items in the embodiments of the present disclosure can all be written in Java language, so that when the program virtual machine executes the detection items, there is no need to perform additional conversion on the detection items, thereby improving the vulnerability detection efficiency, reducing performance overhead, and reducing the impact of the vulnerability detection process on the performance of the application to be detected, and being able to maintain the normal operation of the application to be detected.

[0093] In the disclosed embodiment, the information of key classes and the information of detection items in the protection engine can be hot-updated.

[0094] That is, the protection engine can also send heartbeat information to the management platform, wherein the heartbeat information includes the plug-in information of the plug-in stored locally in the protection engine, for example, the plug-in information includes: an identifier, a version number, and a message digest algorithm 5 (Message-Digest Algorithm 5, MD5), wherein the identifier can be a name and / or an identifier (Identifier, ID). So that the management platform sends a target plug-in that is not stored locally based on the heartbeat information. For example, the management platform can search for a plug-in whose identifier is not in the heartbeat information, and a plug-in whose identifier is in the heartbeat information and has a higher version number from the plug-ins stored by the management platform based on the heartbeat information. Each plug-in includes at least one corresponding relationship and at least one key class of configuration information. Afterwards, the protection engine can receive the target plug-in sent by the management platform, and update the locally stored plug-in based on the target plug-in.

[0095] Optionally, the protection engine may send a heartbeat message to the management platform each time it is started; or after starting, send a heartbeat message to the management platform every preset time interval, for example, the preset time interval is 12 hours. Alternatively, the protection engine may also send a heartbeat message to the management platform at other times, and the embodiments of the present disclosure do not specifically limit the timing of sending the heartbeat message.

[0096] Through the above method, the disclosed embodiment can hot-update the plug-ins in the protection engine without modifying the source code of the protection engine, so that the vulnerability detection strategy of the protection engine can be updated in time to cope with new and more complex attack methods, thereby improving the flexibility and timeliness of vulnerability detection.

[0097] Moreover, the management platform provided by the embodiment of the present disclosure adopts an architecture design for billions of devices, which can ensure the provision of high-quality services in high-concurrency scenarios, that is, to ensure the availability and performance response of the services.

[0098] In the embodiment of the present disclosure, the protection engine updates the locally stored plug-in based on the target plug-in in the following two cases.

[0099] Case 1: If there is a first plug-in with the same identifier as the target plug-in but a different version among the plug-ins stored locally in the protection engine, the first plug-in is deleted, that is, the first plug-in is uninstalled, and the target plug-in is stored locally, that is, the target plug-in is installed.

[0100] If there is a first plug-in with the same identifier as the target plug-in but a different version among the plug-ins stored locally in the protection engine, it means that the target plug-in is a higher version plug-in of the first plug-in. Therefore, the first plug-in can be deleted and the target plug-in can be stored locally.

[0101] Case 2: If the first plug-in does not exist in the plug-ins stored locally in the protection engine, the target plug-in is stored locally.

[0102] Through the above method, the protection engine can add plug-ins that were not originally stored during operation, and update the originally stored plug-ins to the latest version, realizing hot update of plug-ins, making the protection function provided by the protection engine more complete and accurate.

[0103] In an embodiment of the present disclosure, after the protection engine deletes the first plug-in, the class of the detection item originally inserted into the first plug-in becomes invalid accordingly, so the protection engine can also execute: deleting the reference to the invalid object included in the program virtual machine, wherein the invalid object is an object generated based on the invalid class, and the invalid class is the class of the detection item included in the first plug-in, so that the program virtual machine deletes the invalid class and the invalid object through the garbage collection mechanism.

[0104] For example, the garbage collection mechanism of the Java virtual machine includes: when the memory usage reaches a preset amount, based on the cumulative counts of the counters of each object in the Java virtual machine, a preset number of objects and the classes to which the objects belong are deleted in order from small to large cumulative counts. The cumulative count is the number of times the object is used, and when the reference to the object is deleted, the cumulative count of the object is cleared. Therefore, through the garbage collection mechanism, invalid classes and invalid objects in the program virtual machine can be deleted.

[0105] Since the detection items included in the first plug-in do not need to be executed again after the first plug-in is deleted, the class inserted into the detection item can be deleted. Therefore, the protection engine deletes the reference to the invalid object included in the program virtual machine, thereby utilizing the garbage collection mechanism of the program virtual machine to delete the invalid class and invalid object, thereby reducing the interference caused by the continued operation of the invalid class and invalid object to the operation of the application to be detected.

[0106] Since the program virtual machine can load some classes of the application to be detected and some classes of the service components in advance when it starts, such as the main classes, the protection engine can insert detection items into the key classes already included in the program virtual machine after it starts. During the operation of the program virtual machine, other classes can also be loaded, such as classes that need to be executed during the operation of the application to be detected, and classes that need to be reloaded after being deleted by the garbage collection mechanism.

[0107] After inserting key detection items in the key class, see Figure 2 , the protection engine can also perform the following steps:

[0108] S201, receiving a new addition message sent by a program virtual machine, wherein the new addition message is used to indicate that a new class exists in the program virtual machine.

[0109] When the protection engine is started, it can subscribe to the class loading event of the program virtual machine, so that each time the program virtual machine loads a new class, it can send a new message to the protection engine.

[0110] S202: Determine whether the newly added class belongs to the key class.

[0111] That is, the protection engine can determine whether the newly added class meets the first preset condition or the second preset condition. If so, it is determined that the newly added class belongs to the key class; otherwise, it is determined that the newly added class does not belong to the key class.

[0112] If the newly added class belongs to the key class, S203 is executed; if the newly added class does not belong to the key class, the newly added class is ignored, that is, no detection item is inserted.

[0113] S203: Determine the target detection item corresponding to the newly added class based on the corresponding relationship.

[0114] S204: Insert a target detection item into the newly added class, so that the target detection item is executed during the execution of the newly added class.

[0115] The method of inserting the target detection item in the newly added class is the same as the method of inserting the key detection item in the key class in S103 above. Please refer to the relevant description of S103 above, which will not be repeated here.

[0116] Through the above method, the disclosed embodiment can timely determine whether the newly added class belongs to the key class when the program virtual machine loads a new class, so that when the newly added class belongs to the key class, the target detection item is inserted into the newly added class. Real-time monitoring of the classes loaded in the program virtual machine is guaranteed, the timeliness of inserting the detection item into the key class is improved, and more timely monitoring and vulnerability detection of the application to be detected can be performed.

[0117] See also Figure 3The following describes the overall process of the security detection method for an application provided by the embodiment of the present disclosure in combination with actual application scenarios:

[0118] S301. When the protection engine is started, it selects a first key class and a second key class from various classes included in the program virtual machine.

[0119] S302: Based on the preset correspondence between each class and the detection item, determine a first detection item corresponding to the first key class, and determine a second detection item corresponding to the second key class.

[0120] S303: Determine whether the class library detection is enabled. If yes, execute S304; if no, execute S305.

[0121] S304, inserting a first detection item into the first key class, inserting a second detection item into the second key class, and in the process of inserting the first detection item, obtaining class library information of the class library that the first key class depends on, and checking whether the class library is abnormal based on the class library information. Then, executing S306.

[0122] S305: Insert a first detection item into the first key class, and insert a second detection item into the second key class.

[0123] S306. During the execution of the key class, the running process of the application to be detected is monitored and checked in real time through the detection items to see if it is abnormal.

[0124] S307. When the inspection result of the inspection item is abnormal, security protection is performed on the application to be inspected.

[0125] The disclosed embodiment provides a protection engine based on Runtime Application Self-Protection (RASP), which can be embedded in the application program to monitor and detect the execution process of the application program in real time, so as to timely and accurately detect vulnerabilities and provide security protection, and can effectively deal with new and complex attack methods such as zero-day vulnerabilities or advanced persistent threats (APT) attacks. It improves the accuracy and response speed of vulnerability detection and security protection, and is suitable for Web applications that use a large number of open source components or various applications developed by third-party integrators.

[0126] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of the operating information of the applications and servers involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0127] It should be noted that the application program and user request in this embodiment are not targeted at a specific user and cannot reflect the personal information of a specific user.

[0128] It should be noted that the operation information of the application program and the server in this embodiment may come from a public data set.

[0129] Based on the same inventive concept, corresponding to the above method embodiment, the embodiment of the present disclosure also provides a security detection device for an application program, such as Figure 4 As shown, the device includes: a determination module 401 and an insertion module 402;

[0130] A determination module 401 is used to determine key classes included in the program virtual machine, where the key classes are classes related to the operation of the application to be detected;

[0131] The determination module 401 is further used to determine the key detection items corresponding to the key classes based on the preset correspondence between each class and the detection items, the correspondence comes from the management platform, and the key detection items are used to check whether the operation process of the application to be detected is abnormal;

[0132] The inserting module 402 is used to insert the key detection item into the key class so that the key detection item is executed during the execution process of the key class.

[0133] In some embodiments of the present disclosure, the key class includes a first key class belonging to the application to be detected, and the first detection item corresponding to the first key class is used to check whether the process of the application to be detected responding to the user request is abnormal; the determination module 401 is specifically used to:

[0134] At startup, determining whether each class included in the program virtual machine meets a first preset condition, the first preset condition including: the class name and the method name included in the class belong to preset first configuration information, the first configuration information is used to characterize the first key class, and the first configuration information comes from the management platform;

[0135] The first key category that meets the first preset condition is screened out.

[0136] In some embodiments of the present disclosure, the first detection item includes at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item;

[0137] File operation detection items are used to check whether the file requested by the user and the file operation performed by the application to be detected are abnormal;

[0138] The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal;

[0139] The network request detection item is used to check whether the process of the application to be detected sending requests to other devices is abnormal;

[0140] Injection detection items are used to: check whether the database query statements and / or external injection entities included in the user request are abnormal;

[0141] The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

[0142] In some embodiments of the present disclosure, the key class includes a second key class belonging to a service component, the service component is a component included in a server running an application to be detected, and the second detection item corresponding to the second key class is used to check whether the running state of the server is abnormal; the determination module 401 is specifically used to:

[0143] At startup, determining whether each class included in the program virtual machine meets a second preset condition, the second preset condition including: the class name and the method name included in the class belong to preset second configuration information, the second configuration information is used to characterize the second key class, and the second configuration information comes from the management platform;

[0144] The second key category satisfying the second preset condition is screened out.

[0145] In some embodiments of the present disclosure, the second detection item includes at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item;

[0146] The session detection item is used to: check whether the access settings to the session information are abnormal. The session information is the information of the session created by the server in response to the user request;

[0147] The account detection item is used to: check whether the server login account is abnormal;

[0148] The password detection item is used to: check whether the server login password is abnormal;

[0149] The application detection item is used to: check whether the application installed on the server is abnormal;

[0150] The directory detection item is used to: check whether the server's access restrictions on file directories are abnormal;

[0151] The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

[0152] In some embodiments of the present disclosure, the device further comprises:

[0153] An acquisition module, used for acquiring class library information of a class library that the first key class depends on during the process of inserting the first detection item into the first key class;

[0154] The check module is used to check whether the class library is abnormal based on the class library information.

[0155] In some embodiments of the present disclosure, the device further comprises:

[0156] A sending module, used to send heartbeat information to the management platform, the heartbeat information including plug-in information of the locally stored plug-in, so that the management platform sends a target plug-in that is not stored locally based on the heartbeat information, the plug-in including at least one corresponding relationship and configuration information of at least one key class;

[0157] A receiving module, used to receive the target plug-in sent by the management platform;

[0158] Update module, used to update locally stored plugins based on target plugins.

[0159] In some embodiments of the present disclosure, the update module is specifically used to:

[0160] If there is a first plug-in with the same identifier as the target plug-in and a different version among the locally stored plug-ins, the first plug-in is deleted and the target plug-in is stored locally;

[0161] If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

[0162] In some embodiments of the present disclosure, the device further comprises:

[0163] A deletion module is used to delete the reference to the invalid object included in the program virtual machine after deleting the first plug-in, where the invalid object is an object generated based on the invalid class, and the invalid class is a class of the detection item included in the first plug-in inserted, so that the program virtual machine deletes the invalid class and the invalid object through a garbage collection mechanism.

[0164] In some embodiments of the present disclosure, the device further comprises:

[0165] A receiving module, used for receiving a new message sent by the program virtual machine after inserting the key detection item into the key class, where the new message is used for indicating that a new class exists in the program virtual machine;

[0166] The determination module 401 is also used to determine whether the newly added class belongs to the key class;

[0167] The determination module 401 is further configured to determine, based on the corresponding relationship, a target detection item corresponding to the newly added class;

[0168] The inserting module 402 is further used to insert the target detection item into the newly added class, so that the target detection item is executed during the execution process of the newly added class.

[0169] In some embodiments of the present disclosure, the key detection items are also used to: when the inspection result is abnormal, perform security protection on the application to be detected, and the security protection includes at least one of the following: blocking the response of the application to be detected to user requests, generating abnormal records, and reporting abnormal records.

[0170] According to an embodiment of the present disclosure, the present disclosure also provides a server, a readable storage medium, and a computer program product.

[0171] Figure 5 A schematic block diagram of an example server 500 that can be used to implement an embodiment of the present disclosure is shown. The server is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The server can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0172] like Figure 5 As shown, the server 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the server 500 can also be stored. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0173] A number of components in the server 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the server 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0174] The computing unit 501 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 501 performs the various methods and processes described above, such as a security detection method for an application. For example, in some embodiments, the security detection method for an application may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on the server 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the security detection method for the application described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to execute the security detection method for the application by any other appropriate means (e.g., by means of firmware).

[0175] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0176] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0177] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0178] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0179] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0180] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.

[0181] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0182] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A security detection method for an application program, comprising: Determine the key classes included in the program virtual machine, where the key classes are classes related to the operation of the application to be detected; Based on the preset correspondence between each class and the detection item, determine the key detection item corresponding to the key class, the correspondence comes from the management platform, and the key detection item is used to check whether the running process of the application to be detected is abnormal; The key detection item is inserted into the key class, so that the key detection item is executed during the execution process of the key class.

2. The method according to claim 1, wherein: The key class includes a first key class belonging to the application to be detected, and a first detection item corresponding to the first key class is used to check whether a process in which the application to be detected responds to a user request is abnormal; The key classes included in the determination program virtual machine include: At startup, determining whether each class included in the program virtual machine meets a first preset condition, wherein the first preset condition includes: the class name and the method name included in the class belong to preset first configuration information, the first configuration information is used to characterize the first key class, and the first configuration information comes from the management platform; The first key category that meets the first preset condition is screened out.

3. According to the method of claim 2, the first detection item comprises at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item; The file operation detection item is used to: check whether the file requested by the user and the file operation performed by the application to be detected are abnormal; The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal; The network request detection item is used to: check whether the process of the application to be detected sending a request to other devices is abnormal; The injection detection item is used to: check whether the database query statement and / or external injection entity included in the user request is abnormal; The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

4. According to the method according to any one of claims 1 to 3, the key class includes a second key class belonging to a service component, the service component is a component included in a server running the application to be detected, and the second detection item corresponding to the second key class is used to check whether the running state of the server is abnormal; The key classes included in the determination program virtual machine include: At startup, determining whether each class included in the program virtual machine meets a second preset condition, wherein the second preset condition includes: the class name and the method name included in the class belong to preset second configuration information, the second configuration information is used to characterize the second key class, and the second configuration information comes from the management platform; The second key category satisfying the second preset condition is screened out.

5. The method according to claim 4, wherein the second detection item comprises at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item; The session detection item is used to: check whether the access setting to the session information is abnormal, the session information is the information of the session created by the server for the user request; The account detection item is used to: check whether the login account of the server is abnormal; The password detection item is used to: check whether the login password of the server is abnormal; The application detection item is used to: check whether the application installed on the server is abnormal; The directory detection item is used to: check whether the access restriction of the server to the file directory is abnormal; The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

6. The method according to claim 2 or 3, further comprising: In the process of inserting the first detection item into the first key class, obtaining class library information of a class library on which the first key class depends; Based on the class library information, check whether the class library is abnormal.

7. The method according to any one of claims 2 to 6, further comprising: Sending heartbeat information to the management platform, the heartbeat information including plug-in information of a locally stored plug-in, so that the management platform sends a target plug-in that is not stored locally based on the heartbeat information, the plug-in including at least one of the corresponding relationships and configuration information of at least one key class; Receiving the target plug-in sent by the management platform; The locally stored plugin is updated based on the target plugin.

8. The method according to claim 7, wherein: The updating of the locally stored plug-in based on the target plug-in includes: If there is a first plug-in with the same identifier as the target plug-in and a different version among the locally stored plug-ins, the first plug-in is deleted and the target plug-in is stored locally; If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

9. The method according to claim 8, after deleting the first plug-in, further comprising: Delete a reference to an invalid object included in the program virtual machine, wherein the invalid object is an object generated based on an invalid class, and the invalid class is a class of a detection item included in the first plug-in inserted, so that the program virtual machine deletes the invalid class and the invalid object through a garbage collection mechanism.

10. The method according to any one of claims 2 to 9, after inserting the key detection item into the key class, further comprising: receiving a new added message sent by the program virtual machine, wherein the new added message is used to indicate that a new class exists in the program virtual machine; Determining whether the newly added class belongs to the key class; If yes, then based on the corresponding relationship, determining the target detection item corresponding to the newly added class; The target detection item is inserted into the newly added class so that the target detection item is executed during the execution of the newly added class.

11. The method according to any one of claims 1 to 10, wherein: The key detection items are also used to: when the inspection result is abnormal, perform security protection on the application to be detected, and the security protection includes at least one of the following: blocking the response of the application to be detected to user requests, generating abnormal records and reporting abnormal records.

12. A security detection device for an application program, comprising: A determination module, used to determine key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application to be detected; The determination module is further used to determine the key detection items corresponding to the key classes based on the preset correspondence between each class and the detection items, wherein the correspondence comes from the management platform, and the key detection items are used to check whether the running process of the application to be detected is abnormal; The insertion module is used to insert the key detection item into the key class so that the key detection item is executed during the execution of the key class.

13. The device according to claim 12, wherein: The key class includes a first key class belonging to the application to be detected, and the first detection item corresponding to the first key class is used to check whether the process of the application to be detected responding to the user request is abnormal; the determination module is specifically used to: At startup, determining whether each class included in the program virtual machine meets a first preset condition, wherein the first preset condition includes: the class name and the method name included in the class belong to preset first configuration information, the first configuration information is used to characterize the first key class, and the first configuration information comes from the management platform; The first key category that meets the first preset condition is screened out.

14. The apparatus according to claim 13, wherein the first detection item comprises at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item; The file operation detection item is used to: check whether the file requested by the user and the file operation performed by the application to be detected are abnormal; The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal; The network request detection item is used to: check whether the process of the application to be detected sending a request to other devices is abnormal; The injection detection item is used to: check whether the database query statement and / or external injection entity included in the user request is abnormal; The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

15. The device according to any one of claims 12 to 14, wherein the key class includes a second key class belonging to a service component, the service component is a component included in a server running the application to be detected, and the second detection item corresponding to the second key class is used to check whether the running state of the server is abnormal; the determination module is specifically used to: At startup, it is determined whether each class included in the program virtual machine meets a second preset condition, wherein the second preset condition includes: The class name and the method name included in the class belong to the preset second configuration information, the second configuration information is used to characterize the second key class, and the second configuration information comes from the management platform; The second key category satisfying the second preset condition is screened out.

16. The apparatus according to claim 15, wherein the second detection item comprises at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item; The session detection item is used to: check whether the access setting to the session information is abnormal, the session information is the information of the session created by the server for the user request; The account detection item is used to: check whether the login account of the server is abnormal; The password detection item is used to: check whether the login password of the server is abnormal; The application detection item is used to: check whether the application installed on the server is abnormal; The directory detection item is used to: check whether the access restriction of the server to the file directory is abnormal; The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

17. The apparatus according to claim 13 or 14, further comprising: an acquisition module, configured to acquire class library information of a class library on which the first key class depends during the process of inserting the first detection item into the first key class; The checking module is used to check whether the class library is abnormal based on the class library information.

18. The device according to any one of claims 13 to 17, further comprising: A sending module, configured to send heartbeat information to the management platform, the heartbeat information including plug-in information of a locally stored plug-in, so that the management platform sends a target plug-in not stored locally based on the heartbeat information, the plug-in including at least one of the corresponding relationships and configuration information of at least one key class; A receiving module, used for receiving the target plug-in sent by the management platform; An update module is used to update the locally stored plug-in based on the target plug-in.

19. The device according to claim 18, wherein: The update module is specifically used for: If there is a first plug-in with the same identifier as the target plug-in and a different version among the locally stored plug-ins, the first plug-in is deleted and the target plug-in is stored locally; If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

20. The apparatus according to claim 19, further comprising: A deletion module is used to delete the reference to the invalid object included in the program virtual machine after deleting the first plug-in, wherein the invalid object is an object generated based on the invalid class, and the invalid class is a class of the detection item included in the first plug-in inserted, so that the program virtual machine deletes the invalid class and the invalid object through a garbage collection mechanism.

21. The device according to any one of claims 13 to 20, further comprising: A receiving module, configured to receive a new message sent by the program virtual machine after the key detection item is inserted into the key class, wherein the new message is used to indicate that a new class exists in the program virtual machine; The determination module is further used to determine whether the newly added class belongs to the key class; The determination module is further configured to determine, based on the corresponding relationship, the target detection item corresponding to the newly added class; The insertion module is further used to insert the target detection item into the newly added class, so that the target detection item is executed during the execution of the newly added class.

22. The device according to any one of claims 12 to 21, wherein: The key detection items are also used to: when the inspection result is abnormal, perform security protection on the application to be detected, and the security protection includes at least one of the following: blocking the response of the application to be detected to user requests, generating abnormal records and reporting abnormal records.

23. A server, comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 11.

24. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-11.

25. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 11.

Images