A security detection method, device, server and medium for application program

Abstract

The present disclosure provides a method, device, server and medium for security detection of an application program, which relates to the field of communication technology, and in particular to the field of vulnerability detection and security protection technology. The specific implementation scheme is: determining the key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application program to be detected. Then, based on the preset correspondence between each class and the detection item, the key detection items corresponding to the key class are determined, wherein the correspondence comes from the management platform, and the key detection items are used to check whether the operation process of the application program to be detected is abnormal. The key detection items are then inserted into the key class so that the key detection items are executed during the execution process of the key class. More effective response to new or complex attack methods is achieved.

Description

Technical Field

[0001] The present disclosure relates to the field of communication technology, and in particular to the field of vulnerability detection and security protection technology. Background Art

[0002] With the acceleration of digital transformation, web applications have become core businesses, serving as a crucial tool for interaction between enterprise platforms and user devices. However, web applications are also increasingly becoming targets for attackers, who can damage or steal data stored within enterprise platforms, posing a significant security risk. Summary of the Invention

[0003] The present disclosure provides a method, device, server, and medium for security detection of an application program.

[0004] A first aspect of the embodiments of the present disclosure provides a method for security detection of an application program, comprising:

[0005] Determining key classes included in the program virtual machine, where the key classes are classes related to the operation of the application to be detected;

[0006] Determine the key detection items corresponding to the key classes based on the preset correspondence between each class and the detection items, wherein the correspondence is from the management platform, and the key detection items are used to check whether the operation process of the application to be detected is abnormal;

[0007] The key detection item is inserted into the key class, so that the key detection item is executed during the execution process of the key class.

[0008] A second aspect of the embodiments of the present disclosure provides a security detection device for an application program, comprising:

[0009] A determination module, configured to determine key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application to be detected;

[0010] The determination module is further configured to determine key detection items corresponding to the key classes based on preset correspondences between classes and detection items, wherein the correspondences are obtained from a management platform, and the key detection items are used to check whether the running process of the application to be detected is abnormal;

[0011] An insertion module is used to insert the key detection item into the key class so that the key detection item is executed during the execution process of the key class.

[0012] According to a third aspect of the present disclosure, a server is provided, including:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform any one of the methods according to the first aspect.

[0016] According to a fourth aspect of an embodiment of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method according to any one of the first aspects.

[0017] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are provided to facilitate a better understanding of the present invention and do not constitute a limitation of the present disclosure.

[0020] Figure 1 This is a flow chart of a security detection method for an application program provided by an embodiment of the present disclosure;

[0021] Figure 2 is a flowchart of a method for inserting a detection item in a newly added class provided by an embodiment of the present disclosure;

[0022] Figure 3 is a flow chart of another application security detection method provided by an embodiment of the present disclosure;

[0023] Figure 4 This is a schematic diagram of the structure of a security detection device for an application program provided by an embodiment of the present disclosure;

[0024] Figure 5 4 is a block diagram of a server for implementing the security detection method for an application program according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0025] The following description of exemplary embodiments of the present disclosure is made in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding. These details should be considered as merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0026] Conventional web application security protection relies primarily on traditional perimeter defense devices, such as firewalls or intrusion detection systems. These devices typically sit between endpoints and servers. They match parameters carried in requests from the endpoints against a pre-defined signature database to determine whether the request represents an attack. If so, they intercept the request; otherwise, they forward it to the server. However, this approach relies on the signature database for accuracy, which can lag and make it difficult to effectively address new or complex attack signatures.

[0027] In order to solve the above problems, the embodiment of the present disclosure provides a security detection method for an application, which is applied to a server. For example, the server can be a Tomcat or WebLogic application server, or other servers with application running capabilities and data processing capabilities. The following takes the server as an application server as an example to illustrate the security detection method for an application provided by the embodiment of the present disclosure. In the application server, the software module that implements the security detection method for an application provided by the embodiment of the present disclosure can be called a protection engine. Figure 1 As shown, the security detection method of the application provided by the embodiment of the present disclosure includes the following steps:

[0028] S101: Determine key classes included in the program virtual machine, wherein the key classes are classes related to the operation of the application to be detected.

[0029] The program virtual machine may be a Java Virtual Machine (JVM). Java is a programming language. The program virtual machine is a virtual computer, a piece of software that provides a running environment for Java programs and can compile program code and convert it into Java bytecode.

[0030] Each class describes the common characteristics of a group of objects with the same properties and methods, which are used to define the structure and behavior of the objects. Each class contains a data description and a set of functions for manipulating data or passing messages, which are called methods.

[0031] The application to be detected is an application running in an application server. The application is a server-side application that can respond to user requests from a terminal.

[0032] S102: Determine key detection items corresponding to key classes based on preset correspondences between classes and detection items.

[0033] The corresponding relationships come from the management platform. For example, when the protection engine is first started on an application server, the management platform can send the corresponding relationships between each class and detection item to the protection engine. The protection engine then stores these corresponding relationships locally so that it can use them for security protection on each subsequent startup. For another example, each time the protection engine is started on an application server, the management platform can update the corresponding relationships used by the protection engine so that the protection engine can use the updated corresponding relationships for security protection. The management platform can be applied to the management server.

[0034] Key detection items are used to check whether the application under test is operating abnormally. For example, if the application under test traverses the application server's file directory, thereby accessing and reading private files and private file directories on the application server, this is considered abnormal. Another example is if the application under test modifies the name of a file stored on the application server, this is considered abnormal. Specific detection methods are described below.

[0035] S103: Insert key detection items into the key class, so that the key detection items are executed during the execution process of the key class.

[0036] In the disclosed embodiment, when the application server is started, a protection engine can be started. The protection engine can be in the form of a Java agent and run on a Java virtual machine. The protection engine can use the instrumentation technology provided by the Java virtual machine to insert key detection items into key classes by replacing bytecodes, that is, to complete the instrumentation of the key classes and achieve hooking of the key classes. This method can embed the protection engine into the application to be detected without modifying the source code of the application to be detected, thereby integrating the vulnerability detection function into the application to be detected and avoiding the high complexity of development and maintenance caused by modifications at the source code level.

[0037] Since the embodiment of the present disclosure can insert corresponding key detection items into the key classes related to the operation of the application to be detected, the key detection items can be executed during the execution of the key classes, thereby checking whether the operation process of the application to be detected is abnormal during the operation of the application to be detected. That is, the embodiment of the present disclosure can monitor and detect various key operations actually performed by the application to be detected, so that vulnerability detection focuses on the operations actually performed by the application to be detected, rather than just the features included in the user request. Therefore, the dependency of vulnerability detection on the features included in the user request is reduced, and the update of the features included in the user request has less impact on vulnerability detection. Therefore, the embodiment of the present disclosure can more effectively deal with new or complex attack methods.

[0038] The following is a detailed description of the security detection method for an application provided by an embodiment of the present disclosure.

[0039] In an embodiment of the present disclosure, the key class in S101 may include: a first key class belonging to the application to be detected, and / or a second key class belonging to a service component. The service component is a component included in the server running the application to be detected, for example, the service component may include a container kernel (Catalina).

[0040] The first detection item corresponding to the first key category is used to check whether the process of the application to be detected responding to the user request is abnormal.

[0041] In the disclosed embodiment, the first detection item includes at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item. The first detection item inserted into each first key class can be the same or different, and can be set based on actual needs.

[0042] File operation detection items are used to check whether the files requested by users and the file operations performed by the application to be detected are abnormal.

[0043] For example, file operation detection items are used to check whether the file path entered by the user, the file type of the uploaded file is abnormal, whether the communication protocol used is an abnormal protocol stack, whether the user does not have read / write permissions to the file, and whether the code execution environment (WebShell) is obtained through file linking, whether the WebShell is obtained through file renaming, and / or whether the application server's file directory is traversed. If the result of any of the checks is yes, the check result is determined to be abnormal.

[0044] The file operation detection item may correspond to: a class used for file processing included in the application to be detected.

[0045] Code execution detection items are used to check whether the execution process of the code included in the user request by the application to be detected is abnormal.

[0046] For example, code execution detection items include at least one of the following: Deserialization, Object-Graph Navigation Language (OGNL), Spring Expression Language (SPEL), ScriptEngine, Expression Language (EL), and Library Loading. "Spring" represents the application framework, and "ScriptEngine" returns a string representing the currently used script programming language.

[0047] The Deserialization sub-item is used to check whether the class created by the application to be tested in the process of responding to the user request belongs to the preset class blacklist. If so, the check result is determined to be abnormal. The OGNL sub-item is used to check whether the OGNL code entered by the user belongs to the preset OGNL code blacklist, or contains sensitive OGNL features. If so, the check result is determined to be abnormal. The SPEL sub-item is used to check whether the SPEL code entered by the user belongs to the preset SPEL code blacklist, or contains sensitive SPEL features. If so, the check result is determined to be abnormal. The ScriptEngine sub-item is used to check whether the ScriptEngine code entered by the user belongs to the preset ScriptEngine code blacklist, or whether the call stack of the ScriptEngine code is abnormal. If so, the check result is determined to be abnormal. The EL sub-item is used to check whether the EL code entered by the user belongs to the preset EL code blacklist, or contains sensitive EL features. If so, the check result is determined to be abnormal. The Class Library Loading sub-item is used to check whether the application to be tested loads a class library or a Dynamic Link Library (DLL) through a Universal Naming Convention (UNC) path when responding to a user request. If so, the check result is determined to be abnormal.

[0048] The Deserialization sub-item corresponds to a class used to read objects from an input stream and reconstruct them into Java objects in memory, i.e., a deserialization class. The OGNL sub-item corresponds to a class that dynamically accesses object properties, calls methods, or performs complex logical operations through string expressions. The SPEL sub-item corresponds to a class that allows querying and manipulating objects at runtime. The ScriptEngine sub-item corresponds to a class that provides the ability to embed and execute JavaScript in Java applications. The EL sub-item corresponds to a class that supports the expression language functionality in Java Server Pages (JSP) and Java Server Faces (JSF). The Class Library Loading sub-item corresponds to a class that loads a class library or DLL.

[0049] Network request detection items are used to check whether the process of the application to be detected sending requests to other devices is abnormal.

[0050] For example, network request detection items include: Java Naming and Directory Interface Injection (JNDI) sub-items and Server-Side Request Forgery (SSRF) sub-items.

[0051] The JNDI sub-item is used to check whether the application being tested sends requests to other devices via JNDI, whether the protocol used in requests sent to other devices via JNDI is on the protocol blacklist, or whether the stack used is on the stack blacklist. If any of these checks are positive, the test result is determined to be abnormal. The SSRF sub-item is used to check whether user input data contains sensitive features, identify vulnerabilities using rebind detection tools, check whether metadata of a specified device is accessed, check whether sensitive domain names or Internet Protocol (IP) addresses are accessed, or whether sensitive communication protocols are used. If any of these checks are positive, the test result is determined to be abnormal.

[0052] The JNDI sub-item can correspond to classes used to handle naming and directory service contexts based on the Uniform Resource Locator (URL). The SSRF sub-item can correspond to classes that implement the basic functionality of Hypertext Transfer Protocol (HTTP) requests.

[0053] Injection detection items are used to check whether the database query statements and / or external injection entities included in user requests are abnormal.

[0054] For example, injection detection items include: Structured Query Language (SQL) sub-items and XML External Entity (XXE) sub-items. XML stands for Extensible Markup Language.

[0055] The SQL sub-item checks whether the application under test loads external entities, uses sensitive file transfer protocols to load external entities, or reads files using sensitive file transfer protocols when responding to user requests. If any of these checks are positive, the check result is considered abnormal. The XXE sub-item checks whether the HTTP response generated by the application under test when processing user requests contains malicious scripts. If so, the check result is considered abnormal.

[0056] The SQL sub-item can correspond to classes that provide database connection functionality or provide database connection property and configuration acquisition capabilities. The XXE sub-item can correspond to classes that parse and process XML documents.

[0057] Cross-site scripting detection items are used to check whether the scripts contained in the responses generated by the application to be detected to user requests are abnormal.

[0058] For example, a cross-site scripting detection item can check whether the HTTP response generated by the application to be detected to the user request contains a malicious script in the script blacklist. If so, the inspection result is determined to be abnormal.

[0059] Among them, the cross-site scripting detection item may correspond to: a class used to process HTTP responses.

[0060] The disclosed embodiments support multiple detection items and can monitor and detect the operations performed by the application to be detected in response to user requests in real time from multiple perspectives. This enhances a deep understanding of the internal operating behavior of the application to be detected, implements function-level vulnerability detection, and can more comprehensively ensure the safe operation of the application to be detected. This improves the accuracy and timeliness of vulnerability detection and reduces the operational risks of the application to be detected. In addition, the detection items in the disclosed embodiments are only used to detect the operational security of the application and do not involve malicious acquisition and processing of the application's private information, thus ensuring the privacy of the application.

[0061] In the case where the key classes in S101 include the first key class, the way in which the above-mentioned S101 protection engine determines the key classes included in the program virtual machine can be implemented as follows: at startup, determine whether each class included in the program virtual machine meets the first preset condition, and filter out the first key class that meets the first preset condition.

[0062] The first preset condition includes: the class name and the method names included in the class both belong to preset first configuration information, the first configuration information is used to represent the first key class, and the first configuration information comes from the management platform. Specifically, the management platform can send the first configuration information of the first key class to the protection engine, where the first configuration information includes the class name and the method names included in the class.

[0063] The program virtual machine loads classes through a class loader, so the protection engine can determine whether each class in the class loader meets the first preset condition.

[0064] Through the above-described method, the disclosed embodiment can accurately screen out the first key class of the application to be detected by using the class name and the method name included in the class in the program virtual machine, thereby reducing the possibility of the detection item being mistakenly inserted into other classes. Moreover, because, in general, the class name and the method name included in the class are more closely related to the operations corresponding to the class and less closely related to the application to which the class belongs, the protection engine in the disclosed embodiment can support vulnerability detection for various applications, thereby improving the flexibility of the protection engine.

[0065] In the embodiment of the present disclosure, the second detection item corresponding to the second key class is used to check whether the running state of the server is abnormal. Since the second detection item can detect the application server, this detection process can be called baseline detection.

[0066] The second detection item includes at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item.

[0067] The session detection item is used to check whether the access settings to session information are abnormal, where the session information is the information of the session created by the server in response to the user request.

[0068] For example, the session detection item checks whether the application server's session identifier (JSESSIONID) attribute has httpOnly enabled. If not, the check result is considered abnormal. The JSESSIONID attribute is typically stored in a small text file (cookie) associated with the session. When httpOnly is enabled, the terminal cannot access the cookie through the client's JavaScript code.

[0069] The account detection item is used to check whether the server login account is abnormal.

[0070] For example, the account check item is used to check whether the application server is started with a high-privilege account. If not, the check result is determined to be abnormal. High-privilege accounts include: the root account of the operating system kernel (Linux) and the administrator account or system account of the operating system (Windows).

[0071] The password detection item is used to check whether the server login password is abnormal.

[0072] For example, the password check item is used to check whether the password strength level of the administrator user in the user configuration file (tomcat-users.xml) of the application server reaches a preset level. If not, the check result is determined to be abnormal.

[0073] Application detection is used to check whether the applications installed on the server are abnormal.

[0074] For example, the application detection item checks whether sensitive applications have been deleted from the application server, meaning that they are not installed. If not, the check result is considered abnormal. Sensitive applications include server default applications such as root applications, manager applications, host management applications, and document engineering applications.

[0075] The directory detection item is used to check whether the server's access restrictions on file directories are abnormal.

[0076] For example, the directory check item is used to check whether the directory listing function of the default connector (defaultservlet) of the application server is enabled. If so, the check result is determined to be abnormal. When the directory listing function is enabled, the file directory structure and server version information of the application server may be leaked.

[0077] The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

[0078] For example, the database detection item is used to check whether the application server uses a high-privilege account to connect to the database. If so, the check result is determined to be abnormal.

[0079] The second detection item may correspond to a class that implements the function of a Servlet container.

[0080] The disclosed embodiments support multiple detection options, enabling real-time monitoring and detection of application server operations from multiple perspectives. This enables function-level vulnerability detection, more comprehensively safeguarding the operating environment of the application being tested, improving the accuracy and timeliness of security protection, and reducing the operational risks of the application being tested. Furthermore, the detection options in the disclosed embodiments are only used to detect the operational security of the application server and do not involve malicious acquisition or processing of the application server's private information, thus ensuring the privacy of the application server.

[0081] In the case where the key classes in S101 include the second key class, the way in which the above-mentioned S101 protection engine determines the key classes included in the program virtual machine can be implemented as follows: at startup, determine whether each class included in the program virtual machine meets the second preset condition, and filter out the second key class that meets the second preset condition.

[0082] The second preset condition includes: the class name and the method names included in the class both belong to preset second configuration information, the second configuration information is used to represent the second key class, and the second configuration information comes from the management platform. That is, the management platform can send the second configuration information of the second key class to the protection engine, where the second configuration information includes the class name and the method names included in the class.

[0083] Through the above-described method, the disclosed embodiment can accurately filter out the second key class of the service component through the name of the class in the program virtual machine and the name of the method included in the class, thereby reducing the possibility of the detection item being mistakenly inserted into other classes. Moreover, because, in general, the class name and the method name included in the class are more closely related to the operation corresponding to the class, and less closely related to the application to which the class belongs, the protection engine in the disclosed embodiment can support vulnerability detection for various servers, thereby improving the flexibility of the protection engine.

[0084] In addition to the above-mentioned detection of the process of the application to be detected responding to user requests and the baseline detection of the application server, the embodiment of the present disclosure also supports class library detection of the application to be detected, that is, detection of the class library used by the application to be detected.

[0085] The class library detection process of the protection engine includes: in the process of inserting the first detection item in the first key class in the above S103, executing the third detection item, wherein the third detection item is used to: obtain the class library information of the class library that the first key class depends on, and based on the class library information, check whether the class library is abnormal.

[0086] The protection engine uses the library information collection function provided by instrumentation technology to obtain the path to the Java Archive (JAR) package within the first key class. Based on this path, it then obtains the library information of the class libraries that the components within the JAR package depend on, such as the library name, version, and identification number. It then checks whether the library information contains information on the library information blacklist. If so, the library is considered abnormal; otherwise, it is considered normal.

[0087] The disclosed embodiments also support controlling the library detection function. For example, the protection engine can enable or disable the library detection function based on instructions received from the user or instructions from the management platform. In this case, before obtaining the library information of the library that the first key class depends on, the protection engine library can also check whether the library detection function is enabled. If it is enabled, the above steps of obtaining the library information of the library that the first key class depends on are performed; otherwise, the library detection function is not performed.

[0088] Since class libraries are usually provided by third-party developers to expand the functions and features of applications, but their security is difficult to guarantee, the embodiments of the present disclosure detect the class libraries used by the application to be detected, which can reduce the impact of abnormal class libraries on the operation of the application to be detected.

[0089] In the disclosed embodiments, each detection item can not only detect vulnerabilities but also provide security protection. Specifically, key detection items are used to provide security protection for the application under test when the detection result is abnormal. This security protection includes at least one of the following: blocking the application under test from responding to user requests, generating an exception record, and reporting the exception record.

[0090] Blocking the detected application's response to user requests prevents it from continuing to respond to user requests. Exception records include the user request received by the detected application, the identification of the detected item that resulted in an exception, and the current timestamp. The protection engine can report exception records to a designated device or account.

[0091] Because detection items not only detect vulnerabilities but also provide security protection, network attacks on the application being tested can be blocked in a timely manner, reducing the damage caused by network attacks. Attacks can also be recorded and reported, allowing staff to detect network attacks in a timely manner and take timely countermeasures.

[0092] In addition, the detection items in the embodiments of the present disclosure can all be written in Java language, so that when the program virtual machine executes the detection items, there is no need to perform additional conversion on the detection items, which improves the efficiency of vulnerability detection, reduces performance overhead, and reduces the impact of the vulnerability detection process on the performance of the application to be detected, and can maintain the normal operation of the application to be detected.

[0093] In the disclosed embodiment, information on key classes and detection items in the protection engine can be hot-updated.

[0094] That is, the protection engine can also send heartbeat information to the management platform, wherein the heartbeat information includes the plug-in information of the plug-in stored locally by the protection engine, for example, the plug-in information includes: identifier, version number, Message-Digest Algorithm 5 (MD5), wherein the identifier can be a name and / or an identifier (ID). So that the management platform can send the target plug-in that is not stored locally based on the heartbeat information. For example, the management platform can search for plug-ins whose identifiers are not in the heartbeat information, and plug-ins whose identifiers are in the heartbeat information and have a higher version number from the plug-ins stored by the management platform based on the heartbeat information. Each plug-in includes at least one corresponding relationship and configuration information of at least one key class. Afterwards, the protection engine can receive the target plug-in sent by the management platform, and update the locally stored plug-in based on the target plug-in.

[0095] Optionally, the protection engine may send a heartbeat message to the management platform each time it is started; or, after starting, may send a heartbeat message to the management platform at a preset interval, such as 12 hours. Alternatively, the protection engine may send a heartbeat message to the management platform at other times. The present embodiment does not specifically limit the timing of sending the heartbeat message.

[0096] Through the above method, the embodiment of the present disclosure can hot-update the plug-ins in the protection engine without modifying the source code of the protection engine, so that the vulnerability detection strategy of the protection engine can be updated in time to cope with new and more complex attack methods, thereby improving the flexibility and timeliness of vulnerability detection.

[0097] Moreover, the management platform provided by the embodiment of the present disclosure adopts an architecture design oriented towards hundreds of millions of devices, which can ensure the provision of high-quality services in high-concurrency scenarios, that is, to ensure the availability and performance response of the services.

[0098] In the embodiment of the present disclosure, the protection engine updates the locally stored plug-in based on the target plug-in in the following two cases.

[0099] Case 1: If there is a first plug-in with the same identifier as the target plug-in but a different version among the plug-ins stored locally in the protection engine, the first plug-in is deleted, that is, the first plug-in is uninstalled, and the target plug-in is stored locally, that is, the target plug-in is installed.

[0100] If there is a first plug-in with the same identifier as the target plug-in but a different version among the plug-ins stored locally in the protection engine, it means that the target plug-in is a higher version plug-in than the first plug-in. Therefore, the first plug-in can be deleted and the target plug-in can be stored locally.

[0101] Case 2: If the first plug-in does not exist in the plug-ins stored locally in the protection engine, the target plug-in is stored locally.

[0102] Through the above method, the protection engine can add plug-ins that were not originally stored during operation, and update the originally stored plug-ins to the latest version, realizing hot update of plug-ins, making the protection function provided by the protection engine more complete and accurate.

[0103] In an embodiment of the present disclosure, after the protection engine deletes the first plug-in, the class of the detection item originally inserted into the first plug-in becomes invalid accordingly. Therefore, the protection engine can also execute: deleting the reference to the invalid object included in the program virtual machine, where the invalid object is an object generated based on the invalid class, and the invalid class is the class of the detection item included in the first plug-in, so that the program virtual machine deletes the invalid class and invalid object through the garbage collection mechanism.

[0104] For example, the Java virtual machine's garbage collection mechanism involves deleting a predetermined number of objects and their classes, in ascending order of cumulative counts, based on the accumulated counts of each object's counter in the Java virtual machine when the memory usage reaches a preset limit. The cumulative count represents the number of times an object has been used, and when an object's reference is deleted, the cumulative count is reset to zero. Therefore, the garbage collection mechanism can delete expired classes and objects in the program virtual machine.

[0105] Since the detection items included in the first plug-in do not need to be executed after the first plug-in is deleted, the class inserted into the detection item can be deleted. Therefore, the protection engine deletes the reference to the invalid object included in the program virtual machine, thereby utilizing the garbage collection mechanism of the program virtual machine to delete the invalid class and invalid object, reducing the interference caused by the continued operation of the invalid class and invalid object to the operation of the application to be detected.

[0106] Because the program virtual machine can pre-load a subset of classes from the application under test and a subset of classes from service components at startup—for example, these classes can be main classes—the protection engine can then insert detection items for key classes already included in the program virtual machine. During the program virtual machine's operation, it can also load additional classes, such as those required for execution during the application under test and those that need to be reloaded after being deleted by garbage collection.

[0107] After inserting key detection items into the key class, see Figure 2 , the protection engine can also perform the following steps:

[0108] S201: Receive a new addition message sent by a program virtual machine, wherein the new addition message is used to indicate that a new class exists in the program virtual machine.

[0109] The protection engine can subscribe to the class loading event of the program virtual machine when it is started, so that the program virtual machine can send a new message to the protection engine every time a new class is loaded.

[0110] S202: Determine whether the newly added class belongs to the key class.

[0111] That is, the protection engine can determine whether the newly added class meets the first preset condition or the second preset condition. If so, it is determined that the newly added class belongs to the key class; otherwise, it is determined that the newly added class does not belong to the key class.

[0112] If the newly added class belongs to the key class, S203 is executed; if the newly added class does not belong to the key class, the newly added class is ignored, that is, no detection item is inserted.

[0113] S203: Determine the target detection item corresponding to the newly added class based on the corresponding relationship.

[0114] S204: Insert a target detection item into the newly added class, so that the target detection item is executed during the execution of the newly added class.

[0115] The method of inserting target detection items into the newly added class is the same as the method of inserting key detection items into the key class in S103 above. Please refer to the relevant description of S103 above and will not be repeated here.

[0116] Through the above method, the disclosed embodiment can promptly determine whether a new class is a critical class when the program virtual machine loads it. This allows the target detection item to be inserted into the newly added class if it is a critical class. This ensures real-time monitoring of classes loaded into the program virtual machine, improves the timeliness of inserting detection items into critical classes, and enables more timely monitoring and vulnerability detection of the application being tested.

[0117] See also Figure 3The following describes the overall process of the security detection method for an application provided by the embodiment of the present disclosure in combination with actual application scenarios:

[0118] S301. When the protection engine is started, it selects a first key class and a second key class from various classes included in the program virtual machine.

[0119] S302: Based on the preset correspondence between each class and the detection item, determine a first detection item corresponding to the first key class, and determine a second detection item corresponding to the second key class.

[0120] S303: Determine whether class library detection is enabled. If yes, execute S304; if not, execute S305.

[0121] S304: Insert a first detection item into the first key class and a second detection item into the second key class. During the insertion of the first detection item, obtain class library information of the class library that the first key class depends on, and check whether the class library is abnormal based on the class library information. Then, execute S306.

[0122] S305: Insert a first detection item into the first key class, and insert a second detection item into the second key class.

[0123] S306 : During the execution of the key class, the running process of the application to be detected is monitored and checked in real time through the detection items to see if it is abnormal.

[0124] S307: When the inspection result of the inspection item is abnormal, security protection is performed on the application to be inspected.

[0125] The disclosed embodiments provide a protection engine based on Runtime Application Self-Protection (RASP). This engine can be embedded within applications to monitor and detect application execution in real time, enabling timely and accurate vulnerability detection and security protection. This engine effectively addresses new and complex attack vectors, such as zero-day vulnerabilities and Advanced Persistent Threat (APT) attacks. This improved vulnerability detection and security protection accuracy and response speed are suitable for web applications that heavily utilize open source components or various applications developed by third-party integrators.

[0126] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of the operating information of the applications and servers involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0127] It should be noted that the application and user request in this embodiment are not targeted at a specific user and cannot reflect the personal information of a specific user.

[0128] It should be noted that the running information of the application and the server in this embodiment may come from a public data set.

[0129] Based on the same inventive concept, corresponding to the above method embodiment, the embodiment of the present disclosure also provides a security detection device for an application program, such as Figure 4 As shown, the apparatus includes: a determination module 401 and an insertion module 402;

[0130] Determination module 401, for determining key classes included in the program virtual machine, where the key classes are classes related to the operation of the application to be detected;

[0131] The determination module 401 is further configured to determine key detection items corresponding to key classes based on preset correspondences between classes and detection items, where the correspondences are obtained from the management platform. The key detection items are used to check whether the running process of the application to be detected is abnormal.

[0132] The inserting module 402 is configured to insert a key detection item into a key class so that the key detection item is executed during the execution of the key class.

[0133] In some embodiments of the present disclosure, the key class includes a first key class belonging to the application to be detected, and the first detection item corresponding to the first key class is used to check whether the process of the application to be detected responding to the user request is abnormal; the determination module 401 is specifically used to:

[0134] At startup, determining whether each class included in the program virtual machine meets a first preset condition, the first preset condition including: the class name and the method name included in the class belong to preset first configuration information, the first configuration information is used to represent the first key class, and the first configuration information comes from the management platform;

[0135] Filter out the first key category that meets the first preset condition.

[0136] In some embodiments of the present disclosure, the first detection item includes at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item;

[0137] File operation detection items are used to check whether the files requested by users and the file operations performed by the application to be detected are abnormal.

[0138] Code execution detection is used to check whether the application to be tested executes the code included in the user request abnormally.

[0139] The network request detection item is used to check whether the process of the detected application sending requests to other devices is abnormal;

[0140] Injection detection items are used to check whether the database query statements and / or external injection entities included in the user request are abnormal;

[0141] Cross-site scripting detection items are used to check whether the scripts contained in the responses generated by the application to be detected to user requests are abnormal.

[0142] In some embodiments of the present disclosure, the key class includes a second key class belonging to a service component, where the service component is a component included in a server that runs an application to be detected. The second detection item corresponding to the second key class is used to check whether the running status of the server is abnormal. The determination module 401 is specifically used to:

[0143] During startup, determining whether each class included in the program virtual machine satisfies a second preset condition, the second preset condition including: the class name and the method name included in the class both belong to preset second configuration information, the second configuration information is used to represent the second key class, and the second configuration information comes from the management platform;

[0144] The second key category that meets the second preset condition is screened out.

[0145] In some embodiments of the present disclosure, the second detection item includes at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item;

[0146] The session detection item is used to check whether the access settings to session information are abnormal. Session information is the information about the session created by the server in response to user requests.

[0147] The account detection item is used to: check whether the server login account is abnormal;

[0148] The password detection item is used to: check whether the server login password is abnormal;

[0149] Application detection is used to check whether the applications installed on the server are abnormal;

[0150] The directory detection item is used to check whether the server's access restrictions on file directories are abnormal;

[0151] The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

[0152] In some embodiments of the present disclosure, the apparatus further comprises:

[0153] An acquisition module, configured to acquire class library information of a class library on which the first key class depends, during the process of inserting the first detection item into the first key class;

[0154] The inspection module is used to check whether the class library is abnormal based on the class library information.

[0155] In some embodiments of the present disclosure, the apparatus further comprises:

[0156] A sending module, configured to send heartbeat information to the management platform, the heartbeat information including plug-in information of a locally stored plug-in, so that the management platform sends a target plug-in not stored locally based on the heartbeat information, the plug-in including configuration information of at least one corresponding relationship and at least one key class;

[0157] A receiving module is used to receive the target plug-in sent by the management platform;

[0158] Update module, used to update locally stored plugins based on target plugins.

[0159] In some embodiments of the present disclosure, the update module is specifically configured to:

[0160] If there is a first plug-in in the locally stored plug-ins that has the same identifier as the target plug-in but a different version, the first plug-in is deleted and the target plug-in is stored locally;

[0161] If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

[0162] In some embodiments of the present disclosure, the apparatus further comprises:

[0163] The deletion module is used to delete the reference to the invalid object included in the program virtual machine after deleting the first plug-in. The invalid object is an object generated based on the invalid class. The invalid class is a class of the detection item included in the first plug-in inserted, so that the program virtual machine deletes the invalid class and invalid object through the garbage collection mechanism.

[0164] In some embodiments of the present disclosure, the apparatus further comprises:

[0165] A receiving module, configured to receive a new message sent by the program virtual machine after the key detection item is inserted into the key class, wherein the new message is used to indicate the presence of the new class in the program virtual machine;

[0166] The determination module 401 is further used to determine whether the newly added class belongs to the key class;

[0167] The determination module 401 is further configured to determine, based on the corresponding relationship, a target detection item corresponding to the newly added class;

[0168] The inserting module 402 is further configured to insert the target detection item into the newly added class, so that the target detection item is executed during the execution of the newly added class.

[0169] In some embodiments of the present disclosure, key detection items are also used to: perform security protection on the application to be detected when the inspection result is abnormal, and the security protection includes at least one of the following: blocking the application to be detected from responding to user requests, generating abnormal records, and reporting abnormal records.

[0170] According to an embodiment of the present disclosure, the present disclosure also provides a server, a readable storage medium, and a computer program product.

[0171] Figure 5 A schematic block diagram of an example server 500 that can be used to implement embodiments of the present disclosure is shown. Server is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. Server can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0172] like Figure 5 As shown, server 500 includes a computing unit 501, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of server 500. Computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An input / output (I / O) interface 505 is also connected to bus 504.

[0173] Multiple components in the server 500 are connected to the I / O interface 505, including: an input unit 506, such as a keyboard, a mouse, etc.; an output unit 507, such as various types of displays, speakers, etc.; a storage unit 508, such as a magnetic disk, an optical disk, etc.; and a communication unit 509, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 509 allows the server 500 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0174] The computing unit 501 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the application security detection method. For example, in some embodiments, the application security detection method can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the server 500 via the ROM 502 and / or the communication unit 509. When the computer program is loaded into the RAM 503 and executed by the computing unit 501, one or more steps of the application security detection method described above can be performed. Alternatively, in other embodiments, the computing unit 501 can be configured to perform the application security detection method through any other suitable means (e.g., via firmware).

[0175] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-a-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0176] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0177] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fibers, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0178] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0179] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0180] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0181] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not limited herein.

[0182] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A security detection method for an application, comprising: At startup, determining whether each class included in the program virtual machine meets the first preset condition or the second preset condition; The first preset condition includes: the class name and the method names included in the class both belong to preset first configuration information, and the first configuration information is used to represent a first key class of the application to be detected; the second preset condition includes: the class name and the method names included in the class both belong to preset second configuration information, and the second configuration information is used to represent a second key class of a service component, and the service component is a component included in a server running the application to be detected, and the first configuration information and the second configuration information are from a management platform; Screening out key categories, the key categories including: a first key category meeting the first preset condition, and / or a second key category meeting the second preset condition; Determining, based on a preset correspondence between each class and a detection item, a key detection item corresponding to the key class, wherein the correspondence is from a management platform, a first detection item corresponding to the first key class is used to check whether a process in which the application to be detected responds to a user request is abnormal, and a second detection item corresponding to the second key class is used to check whether an operating status of the server is abnormal; The key detection item is inserted into the key class, so that the key detection item is executed during the execution process of the key class.

2. The method according to claim 1, wherein the first detection item comprises at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item; The file operation detection item is used to check whether the file requested by the user and the file operation performed by the application to be detected are abnormal; The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal; The network request detection item is used to check whether the process of the application to be detected sending a request to other devices is abnormal; The injection detection item is used to: check whether the database query statement and / or external injection entity included in the user request is abnormal; The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

3. The method according to claim 1, wherein the second detection item comprises at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item; The session detection item is used to check whether the access settings to the session information are abnormal, wherein the session information is information about the session created by the server in response to the user request; The account detection item is used to: check whether the login account of the server is abnormal; The password detection item is used to: check whether the login password of the server is abnormal; The application detection item is used to: check whether the application installed on the server is abnormal; The directory detection item is used to check whether the access restriction of the server to the file directory is abnormal; The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

4. The method according to claim 1, further comprising: In the process of inserting the first detection item into the first key class, obtaining class library information of a class library on which the first key class depends; Based on the class library information, check whether the class library is abnormal.

5. The method according to claim 1, further comprising: Sending heartbeat information to the management platform, the heartbeat information including plug-in information of a locally stored plug-in, so that the management platform sends a target plug-in that is not locally stored based on the heartbeat information, the plug-in including at least one of the corresponding relationships and configuration information of at least one key class; Receiving the target plug-in sent by the management platform; Update the locally stored plugin based on the target plugin.

6. The method according to claim 5, wherein: The updating of the locally stored plug-in based on the target plug-in includes: If there is a first plug-in in the locally stored plug-ins that has the same identifier as the target plug-in but a different version, the first plug-in is deleted and the target plug-in is stored locally; If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

7. The method according to claim 6, further comprising, after deleting the first plug-in: Deleting a reference to an invalidation object included in the program virtual machine, where the invalidation object is an object generated based on an invalidation class, where the invalidation class is a class of a detection item included in the first plug-in, so that the program virtual machine deletes the invalidation class and the invalidation object through a garbage collection mechanism.

8. The method according to any one of claims 1 to 7, further comprising: receiving a new addition message sent by the program virtual machine, wherein the new addition message is used to indicate that a new class exists in the program virtual machine; Determining whether the newly added class belongs to the key class; If yes, then determining the target detection item corresponding to the newly added class based on the corresponding relationship; The target detection item is inserted into the newly added class, so that the target detection item is executed during the execution process of the newly added class.

9. The method according to any one of claims 1 to 7, wherein: The key detection item is also used to: when the inspection result is abnormal, perform security protection on the application to be detected, and the security protection includes at least one of the following: blocking the response of the application to be detected to user requests, generating abnormal records and reporting abnormal records.

10. A security detection device for an application program, comprising: A determination module, configured to determine, at startup, whether each class included in the program virtual machine satisfies a first preset condition or a second preset condition; The first preset condition includes: the class name and the method names included in the class all belong to preset first configuration information, and the first configuration information is used to represent a first key class of the application to be detected; the second preset condition includes: the class name and the method names included in the class all belong to preset second configuration information, and the second configuration information is used to represent a second key class of a service component, and the service component is a component included in a server running the application to be detected, and the first configuration information and the second configuration information are from a management platform; the key classes are screened out, and the key classes include: the first key class that meets the first preset condition, and / or the second key class that meets the second preset condition; The determination module is further configured to determine, based on preset correspondences between classes and detection items, key detection items corresponding to the key class, the correspondences being from a management platform, a first detection item corresponding to the first key class being configured to check whether a process in which the application to be detected responds to a user request is abnormal, and a second detection item corresponding to the second key class being configured to check whether an operating status of the server is abnormal; An insertion module is used to insert the key detection item into the key class so that the key detection item is executed during the execution process of the key class.

11. The apparatus according to claim 10, wherein the first detection item comprises at least one of the following: a file operation detection item, a code execution detection item, a network request detection item, an injection detection item, and a cross-site scripting detection item; The file operation detection item is used to check whether the file requested by the user and the file operation performed by the application to be detected are abnormal; The code execution detection item is used to check whether the execution process of the code included in the user request by the application to be detected is abnormal; The network request detection item is used to check whether the process of the application to be detected sending a request to other devices is abnormal; The injection detection item is used to: check whether the database query statement and / or external injection entity included in the user request is abnormal; The cross-site scripting detection item is used to check whether the script contained in the response generated by the application to be detected to the user request is abnormal.

12. The apparatus according to claim 10, wherein the second detection item comprises at least one of the following: a session detection item, an account detection item, a password detection item, an application detection item, a directory detection item, and a database detection item; The session detection item is used to check whether the access settings to the session information are abnormal, wherein the session information is information about the session created by the server in response to the user request; The account detection item is used to: check whether the login account of the server is abnormal; The password detection item is used to: check whether the login password of the server is abnormal; The application detection item is used to: check whether the application installed on the server is abnormal; The directory detection item is used to check whether the access restriction of the server to the file directory is abnormal; The database detection item is used to check whether the connection relationship between the server and the database is abnormal.

13. The apparatus according to claim 10, further comprising: an acquisition module, configured to acquire class library information of a class library on which the first key class depends during the process of inserting the first detection item into the first key class; The checking module is used to check whether the class library is abnormal based on the class library information.

14. The apparatus according to claim 10, further comprising: a sending module, configured to send heartbeat information to the management platform, the heartbeat information including plug-in information of a locally stored plug-in, so that the management platform sends a target plug-in not stored locally based on the heartbeat information, the plug-in including configuration information of at least one of the corresponding relationships and at least one key class; A receiving module, configured to receive the target plug-in sent by the management platform; An update module is configured to update a locally stored plug-in based on the target plug-in.

15. The device according to claim 14, wherein The update module is specifically used to: If there is a first plug-in in the locally stored plug-ins that has the same identifier as the target plug-in but a different version, the first plug-in is deleted and the target plug-in is stored locally; If the first plug-in does not exist in the locally stored plug-ins, the target plug-in is stored locally.

16. The apparatus according to claim 15, further comprising: A deletion module is used to delete a reference to an invalid object included in the program virtual machine after deleting the first plug-in, where the invalid object is an object generated based on an invalid class, and the invalid class is a class of a detection item included in the first plug-in, so that the program virtual machine deletes the invalid class and the invalid object through a garbage collection mechanism.

17. The apparatus according to any one of claims 10 to 16, further comprising: a receiving module, configured to receive a new addition message sent by the program virtual machine after the key detection item is inserted into the key class, wherein the new addition message is used to indicate that a new class exists in the program virtual machine; The determination module is further configured to determine whether the newly added class belongs to the key class; The determining module is further configured to determine, based on the corresponding relationship, the target detection item corresponding to the newly added class; The insertion module is further configured to insert the target detection item into the newly added class, so that the target detection item is executed during the execution of the newly added class.

18. The device according to any one of claims 10 to 16, wherein: The key detection item is also used to: when the inspection result is abnormal, perform security protection on the application to be detected, and the security protection includes at least one of the following: blocking the response of the application to be detected to user requests, generating abnormal records and reporting abnormal records.

19. A server comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to cause the computer to execute the method according to any one of claims 1 to 9.

21. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 9.

Images