Application protection method and device, electronic equipment and storage medium

Abstract

The invention provides an application protection method and device, electronic equipment and a storage medium, and relates to the technical field of computers, in particular to the technical fields of application program security protection, network security and the like. According to the specific implementation scheme, a server firstly receives description information sent by a monitoring service, then obtains second monitoring plug-in information associated with a target type to which an application belongs, determines a to-be-updated target monitoring plug-in under the condition that the first monitoring plug-in information is not matched with the second monitoring plug-in information, and updates the target monitoring plug-in according to the to-be-updated target monitoring plug-in. And finally, sending a plug-in updating instruction to the monitoring service. Therefore, conditions are provided for reducing the false alarm rate and the missing report rate of application protection, and the timeliness and the reliability of application protection are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to technical fields such as application security protection and network security, and specifically to an application protection method, device, electronic device and storage medium. Background Art

[0002] In the existing technology, security protection measures for applications usually rely on firewalls, intrusion detection systems, and Web application firewalls. However, these measures usually provide protection based on request characteristics, and it is difficult to detect and protect against new and complex attack methods in a timely manner. How to provide a safe, reliable and timely application protection method is an urgent problem to be solved. Summary of the invention

[0003] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0004] The first embodiment of the present disclosure provides an application protection method, including:

[0005] Receive description information sent by the monitoring service, wherein the description information includes an identifier of the application where the monitoring service is located, and information of a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is used to monitor and intercept abnormal events during the operation of the application;

[0006] Acquire second monitoring plug-in information associated with the target type to which the application belongs;

[0007] In the case where the first monitoring plug-in information does not match the second monitoring plug-in information, determining a target monitoring plug-in to be updated;

[0008] A plug-in update instruction is sent to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

[0009] The second aspect of the present disclosure provides an application protection method, including:

[0010] When the application is in a running state, determine current description information of the application, wherein the description information includes an identifier of the application and information of a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application;

[0011] When no monitoring event returned by the monitoring plug-in is received and a preset period has been reached, sending the description information to the server;

[0012] When the plug-in update instruction sent by the server is received, the monitoring plug-in in the application is updated based on the update instruction.

[0013] The third aspect of the present disclosure provides an application protection device, including:

[0014] A first receiving module, configured to receive description information sent by a monitoring service, wherein the description information includes an identifier of an application in which the monitoring service is located, and information about a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is configured to monitor and intercept abnormal events during the operation of the application;

[0015] An acquisition module, used to acquire second monitoring plug-in information associated with the target type to which the application belongs;

[0016] A first determining module, configured to determine a target monitoring plug-in to be updated when the first monitoring plug-in information does not match the second monitoring plug-in information;

[0017] The first sending module is used to send a plug-in update instruction to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

[0018] The fourth aspect of the present disclosure provides an application protection device, including:

[0019] A second determination module is used to determine the current description information of the application when the application is in a running state, wherein the description information includes the identification of the application and the information of a first monitoring plug-in currently included in the application, and the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application;

[0020] A second sending module, configured to send the description information to the server when no monitoring event returned by the monitoring plug-in is received and a preset period has been reached;

[0021] The third updating module is used to update the monitoring plug-in in the application based on the updating instruction when receiving the plug-in updating instruction sent by the server.

[0022] The fifth aspect embodiment of the present disclosure proposes a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the application protection method proposed in the first aspect embodiment and the second aspect embodiment of the present disclosure is implemented.

[0023] The sixth aspect embodiment of the present disclosure proposes a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the application protection method proposed in the first aspect embodiment and the second aspect embodiment of the present disclosure.

[0024] The seventh aspect embodiment of the present disclosure proposes a computer program product, including a computer program, which, when executed by a processor, implements the application protection method proposed in the first aspect embodiment and the second aspect embodiment of the present disclosure.

[0025] The application protection method, device, electronic device and storage medium provided by the present disclosure have the following beneficial effects:

[0026] In the disclosed embodiment, the server first receives the description information sent by the monitoring service, then obtains the second monitoring plug-in information associated with the target type to which the application belongs, and in the case where the first monitoring plug-in information does not match the second monitoring plug-in information, determines the target monitoring plug-in to be updated, and finally sends a plug-in update instruction to the monitoring service. Thus, after receiving the description information sent by the monitoring service, the server obtains the monitoring plug-in information associated with the type of application where the monitoring service is located from the plug-in repository, and compares it with the monitoring plug-in information currently contained in the application, determines the monitoring plug-in to be updated for the application, and sends a plug-in update instruction to the monitoring service, thereby providing conditions for reducing the false alarm rate and missed alarm rate of application protection, and improving the timeliness and reliability of application protection.

[0027] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present disclosure, nor is it intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0029] Figure 1 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0030] Figure 2 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0031] Figure 3 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0032] Figure 4 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0033] Figure 5A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0034] Figure 6 A flow chart of the application protection method on the server side provided by the present disclosure;

[0035] Figure 7 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0036] Figure 8 A flowchart of an application protection method provided by an embodiment of the present disclosure;

[0037] Fig. 9 A timing diagram of the application protection method provided by the embodiment of the present disclosure;

[0038] Fig.10 A schematic diagram of the structure of an application protection device provided in an embodiment of the present disclosure;

[0039] Fig.11 A schematic diagram of the structure of an application protection device provided in an embodiment of the present disclosure;

[0040] Fig.12 A block diagram of an exemplary computer device suitable for implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0041] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0042] The present disclosure relates to technical fields such as application security protection and network security.

[0043] Application security refers to security measures, security plans, and security controls designed to protect applications from cyberattacks. It includes security considerations during application development and design, as well as systems and methods for protecting applications after they are deployed.

[0044] Cyber ​​Security refers to the protection of the hardware, software and data of the network system from damage, change or leakage due to accidental or malicious reasons, and the continuous, reliable and normal operation of the system and the uninterrupted network services.

[0045] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0046] The following describes the application protection method, device, electronic device and storage medium of the embodiments of the present disclosure with reference to the accompanying drawings.

[0047] Figure 1 A flowchart of an application protection method provided in an embodiment of the present disclosure.

[0048] like Figure 1 As shown, the application protection method may include the following steps:

[0049] Step 101, receiving description information sent by a monitoring service, wherein the description information includes an identifier of the application where the monitoring service is located, and information of a first monitoring plug-in currently included in the application, where the monitoring plug-in is used to monitor and intercept abnormal events during the operation of the application.

[0050] The monitoring service can be used to monitor whether there are abnormal events in the application, and it can be any service that provides security protection for the application. For example, the monitoring service can be a RASP protection engine, which is not limited in the present disclosure.

[0051] Among them, RASP is the abbreviation of Runtime Application Self-Protection (RASP).

[0052] The application identifier can be used to characterize the application where the monitoring service is located, and can be any pre-set identifier. For example, the application identifier can be the name of the application, such as "application A", and the IP address corresponding to the application (which can uniquely identify the client of the application), etc., which is not limited in this disclosure.

[0053] Among them, IP is the abbreviation of Internet Protocol (IP).

[0054] The monitoring plug-in may be a plug-in for monitoring application behavior, for example, a RASP plug-in, which is not limited in the present disclosure.

[0055] The first monitoring plug-in information may include information related to the monitoring plug-in. For example, the first monitoring plug-in information may include an identifier and a version number of the monitoring plug-in, which is not limited in the present disclosure.

[0056] The identification of the monitoring plug-in can be used to characterize the monitoring plug-in, and can be an identification in any pre-set form. For example, the identification of the monitoring plug-in can be the name of the monitoring plug-in, etc., which is not limited in the present disclosure.

[0057] The abnormal event may be any type of abnormal event, for example, the type of the abnormal event may be a request feature type, a code injection type, a deserialization type, etc., which is not limited in the present disclosure.

[0058] It should be noted that an abnormal event may be an abnormal event of any behavior of an application. For example, an abnormal event may be an abnormal event of database access, file reading and writing, HTTP request, etc. of an application, which is not limited in the present disclosure.

[0059] Among them, HTTP is the abbreviation of Hypertext Transfer Protocol (HTTP).

[0060] In the present disclosure, after receiving the description information sent by the monitoring service, the server can obtain the identifier of the application where the monitoring service is located and the first monitoring plug-in information currently contained in the application from the description information, thereby providing conditions for application protection.

[0061] Step 102: Obtain second monitoring plug-in information associated with the target type to which the application belongs.

[0062] The target type may be determined according to the application. For example, when the application is a video software, the target type may be a video type, and when the application is a chat software, the target type may be a communication type, etc., which is not limited in the present disclosure.

[0063] It should be noted that the second monitoring plug-in information may be preset, and the associated second monitoring plug-in information may be different depending on the target type to which the application belongs, and the present disclosure does not limit this.

[0064] In the present disclosure, after receiving the description information sent by the monitoring service and obtaining the first monitoring plug-in information currently contained in the application, the server can obtain the second monitoring plug-in information associated with the target type to which the application belongs from the plug-in management module, so that the first monitoring plug-in information can be judged based on the second monitoring plug-in information to improve the accuracy of application protection.

[0065] It should be noted that the plug-in management module can provide monitoring services with dynamic loading and unloading plug-in functions, and flexibly expand application protection functions, such as SQL injection monitoring, XSS protection, etc. It can include plug-in warehouse, plug-in combination version management, plug-in deployment and other functions. Among them, the plug-in warehouse can be used to store monitoring plug-in information, plug-in combination version management can be used to package and combine plug-ins under the same application type and the corresponding plug-in versions, and plug-in deployment can be used to deploy plug-ins. This disclosure does not limit this.

[0066] Optionally, after receiving the description information sent by the monitoring service, the server may manage the registration status, version information, directory information, etc. of the monitoring service based on the description information to ensure that the monitoring service can run normally, which is not limited in the present disclosure.

[0067] Optionally, after receiving the description information sent by the monitoring service, the server can also manage the log information of the monitoring service, including the monitoring service's proxy service exceptions, monitoring plug-in exceptions, and operation audits, etc., to provide support for security protection tracking, which is not limited in this disclosure.

[0068] Here, SQL is the abbreviation of Structured Query Language (SQL).

[0069] Among them, XSS is the abbreviation of Cross Site Scripting (XSS).

[0070] Step 103: When the first monitoring plug-in information does not match the second monitoring plug-in information, determine a target monitoring plug-in to be updated.

[0071] The target monitoring plug-in may be a monitoring plug-in to be added to the application, or may be a monitoring plug-in to be updated in the application, etc., which is not limited in the present disclosure.

[0072] In the present disclosure, after obtaining the second monitoring plug-in information associated with the target type to which the application belongs, the server can first match the identification and version number of the monitoring plug-in in the first monitoring plug-in information with the identification and version number of the monitoring plug-in in the second monitoring plug-in information. When the first monitoring plug-in information does not match the second monitoring plug-in information, it can be determined that the monitoring plug-in currently included in the application where the monitoring service is located is missing a plug-in or the version of the plug-in is lower. At this time, in order to update the version of the monitoring plug-in included in the application, or add the missing plug-in in the application, the target monitoring plug-in to be updated can be determined, thereby providing conditions for effectively avoiding the false alarm rate and missed alarm rate of application protection, and improving the reliability of application protection.

[0073] Step 104: Send a plug-in update instruction to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

[0074] In the present disclosure, after determining the target monitoring plug-in to be updated, the server can send a plug-in update instruction to the monitoring service, thereby realizing flexible updating and management of the plug-ins contained in the application to meet the needs of different application scenarios, reduce the difficulty of maintenance and management, and improve the real-time and accuracy of application protection.

[0075] Optionally, before sending the plug-in update instruction to the monitoring service, the server may also determine the policy configuration information of the monitoring service, including alarm settings, protection settings, application hardening, configuration management, etc., and then send the policy configuration information together with the plug-in update instruction to the monitoring service. This disclosure does not limit this.

[0076] In the disclosed embodiment, the server first receives the description information sent by the monitoring service, then obtains the second monitoring plug-in information associated with the target type to which the application belongs, and in the case where the first monitoring plug-in information does not match the second monitoring plug-in information, determines the target monitoring plug-in to be updated, and finally sends a plug-in update instruction to the monitoring service. Thus, after receiving the description information sent by the monitoring service, the server obtains the monitoring plug-in information associated with the type of application where the monitoring service is located from the plug-in repository, and compares it with the monitoring plug-in information currently contained in the application, determines the monitoring plug-in to be updated for the application, and sends a plug-in update instruction to the monitoring service, thereby providing conditions for reducing the false alarm rate and missed alarm rate of application protection, and improving the timeliness and reliability of application protection.

[0077] Figure 2 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0078] like Figure 2 As shown, the application-based protection method may include the following steps:

[0079] Step 201: Receive abnormal event description information sent by a monitoring service, wherein the abnormal event description information includes at least one of the following: the type, source and occurrence time of the abnormal event.

[0080] The type of the abnormal event may be any type, such as a request feature type, a code injection type, or a deserialization type, etc., which is not limited in the present disclosure.

[0081] In the present disclosure, after receiving the abnormal event description information sent by the monitoring service, the server can determine the type, source, occurrence time, etc. of the abnormal event of the application based on the abnormal event description information, so that the server can collect the abnormal event information of the application and determine accurate and reliable protection measures.

[0082] Step 202: Store the abnormal event description information in association with the application identifier.

[0083] In the present disclosure, after receiving the abnormal event description information sent by the monitoring service, the server can associate the abnormal event description information with the application identifier and store it, thereby improving the real-time performance of the abnormal event information stored in the server, and can also help users analyze and trace the abnormal events.

[0084] In the disclosed embodiment, the server first receives the abnormal event description information sent by the monitoring service, and then stores the abnormal event description information in association with the application identifier, thereby achieving timely updating of the abnormal event information stored on the server side and improving the timeliness and accuracy of application protection.

[0085] Figure 3 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0086] like Figure 3 As shown, the application protection method may include the following steps:

[0087] Step 301: Receive abnormal event description information sent by a monitoring service, wherein the abnormal event description information includes at least one of the following: the type, source and occurrence time of the abnormal event.

[0088] Step 302: Store the abnormal event description information in association with the application identifier.

[0089] The specific implementation forms of step 301 to step 302 can refer to the detailed descriptions in other embodiments of the present disclosure, and will not be described in detail here.

[0090] Step 303: Receive an abnormal event display request, wherein the display request includes an identifier of a target type.

[0091] The target type identifier can be used to characterize the target type, and can be a preset identifier in any form. For example, the target type identifier can be a name of the target type, etc., which is not limited in the present disclosure.

[0092] In the present disclosure, after the server associates and stores the abnormal event description information with the identification of the application, after receiving the abnormal event display request, in order to determine the abnormal event to be displayed, the server may first determine the identification of the target type from the display request.

[0093] Step 304: Obtain description information of all abnormal events associated with all applications under the target type.

[0094] In the present disclosure, after receiving an abnormal event display request, the server can obtain all abnormal event description information associated with all applications under the target type based on the identifier of the target type in the display request, thereby providing a data basis for abnormal event display.

[0095] Step 305: Generate and display an abnormal event display interface corresponding to the target type according to the abnormal event description information, wherein the display interface includes at least one of the following: the type of abnormal event, the quantity distribution of different types of abnormal events, and the occurrence time distribution of abnormal events.

[0096] It should be noted that when the display interface includes types of abnormal events, when the target type of the application includes multiple types of abnormal events, the type of abnormal events with a larger number among all abnormal events corresponding to the target type can be selected for display, and the present disclosure does not limit this.

[0097] It should be noted that when displaying abnormal events, the server can also display the URL, source, interception status, alarm message and other information of the abnormal events, and support multi-condition screening and filtering to facilitate users to analyze and trace the abnormal events. This disclosure does not limit this.

[0098] Wherein, URL is the abbreviation of Uniform Resource Locator (URL).

[0099] In the present disclosure, after obtaining all abnormal event description information associated with all applications under the target type, an abnormal event display interface corresponding to the target type can be generated and displayed based on the abnormal event description information, thereby facilitating users to analyze abnormal events of applications of the target type.

[0100] It should be noted that when generating and displaying the abnormal event display interface corresponding to the target type, the display interface may also include a line abnormal trend chart, alarm information, etc., which is not limited in the present disclosure.

[0101] Optionally, the server can also provide functions such as vulnerability list and vulnerability details viewing in the display interface by aggregating information such as the request IP of abnormal events, thereby helping users to fully understand and analyze security vulnerabilities in the application. This disclosure is not limited to this.

[0102] Optionally, the server can also display an application list in the display interface. Through multi-condition screening and filtering, the user can comprehensively view the detailed information of each application for effective management. The permission management function displays the user permission list and helps users efficiently manage user permissions through multi-condition screening and filtering. The license management function displays license management to help users efficiently view and modify the authorization serial number of the application to ensure that the application runs in compliance. The present disclosure does not limit this.

[0103] In the disclosed embodiment, the server first receives the abnormal event description information sent by the monitoring service, then associates and stores the abnormal event description information with the identification of the application, then receives an abnormal event display request, and obtains all abnormal event description information associated with all applications under the target type, and finally generates and displays the abnormal event display interface corresponding to the target type based on the abnormal event description information. Thus, after the server associates and stores the abnormal event description information sent by the monitoring service with the identification of the application, when receiving the abnormal event display request, it obtains all abnormal event description information associated with all applications under the target type, generates and displays the abnormal event display interface, thereby facilitating the user to analyze the abnormal event, allowing the user to customize and finely manage application protection, and improving the accuracy and reliability of application protection.

[0104] Figure 4 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0105] like Figure 4 As shown, the application protection method may include the following steps:

[0106] Step 401: receiving a configuration instruction, wherein the configuration instruction includes an identifier of a target type and information of a plug-in to be configured.

[0107] The configuration instruction may be an instruction for instructing the server to update the monitoring plug-in information corresponding to the target type.

[0108] In the present disclosure, after receiving the configuration instruction sent by the monitoring service, in order to determine the plug-in information to be configured and the target type of the application, the server can first determine the identifier of the target type and the plug-in information to be configured from the configuration instruction, thereby providing conditions for the server to update the monitoring plug-in.

[0109] Step 402: based on the plug-in information to be configured, update the second monitoring plug-in information associated with the target type.

[0110] In the present disclosure, after receiving the configuration instruction and determining the target type identifier and the plug-in information to be configured from the configuration instruction, the server can update the second monitoring plug-in information associated with the target type based on the plug-in information to be configured, thereby enabling the server and the application to maintain information consistency in the monitoring plug-in information, improving the timeliness of the monitoring plug-in information in the server, and providing conditions for improving the accuracy of application protection.

[0111] In the disclosed embodiment, the server first receives the configuration instruction, and then updates the second monitoring plug-in information associated with the target type based on the plug-in information to be configured, thereby providing conditions for improving the timeliness and reliability of application protection.

[0112] Figure 5 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0113] like Figure 5 As shown, the application protection method may include the following steps:

[0114] Step 501, receiving description information sent by the monitoring service, wherein the description information includes the identifier of the application where the monitoring service is located, and information of the first monitoring plug-in currently included in the application, the monitoring plug-in is used to monitor and intercept abnormal events during the operation of the application.

[0115] The specific implementation form of step 501 can refer to the detailed description in other embodiments of the present disclosure, and will not be described in detail here.

[0116] Step 502: determine that the first monitoring plug-in verification code included in the description information is different from the second monitoring plug-in verification code associated with the stored target type, and obtain second monitoring plug-in information associated with the type to which the application belongs.

[0117] The first monitoring plug-in verification code may be generated by the monitoring service based on the first monitoring plug-in information, and the second monitoring plug-in verification code may be generated based on the second monitoring plug-in information.

[0118] It should be noted that the first monitoring plug-in verification code and the second monitoring plug-in verification code can be obtained based on any method. For example, they can be obtained based on a digest algorithm (such as MD5, SHA algorithm, etc.), or a hash algorithm, or a CRC algorithm, etc., and this disclosure does not limit this.

[0119] Among them, MD5 is the abbreviation of Message Digest Algorithm 5 (MD5).

[0120] Among them, SHA is the abbreviation of Secure Hash Algorithm (SHA).

[0121] Among them, CRC is the abbreviation of Cyclic Redundancy Check (CRC).

[0122] In the present disclosure, after the server receives the description information sent by the monitoring service, if the description information contains a first monitoring plug-in verification code, in order to improve resource utilization, the server can first compare the first monitoring plug-in verification code with the second monitoring plug-in verification code associated with the target type. If the first monitoring plug-in verification code is different from the second monitoring plug-in verification code, it can be determined that the monitoring plug-in currently included in the application where the monitoring service is located is different from the monitoring plug-in associated with the application target type stored in the server. At this time, the server can then obtain the second monitoring plug-in information associated with the type to which the application belongs, so that the monitoring plug-in contained in the first monitoring plug-in information can be compared one by one with the monitoring plug-in contained in the second monitoring plug-in information, thereby improving the resource utilization of the server.

[0123] Optionally, after receiving the configuration instruction for the target type and updating the second detection plug-in information, the server can update the second monitoring plug-in verification code associated with the target type based on the updated second monitoring plug-in information, thereby improving the timeliness and reliability of the second monitoring plug-in verification code.

[0124] Step 503: When the first monitoring plug-in information does not match the second monitoring plug-in information, determine a target monitoring plug-in to be updated.

[0125] Step 504: Send a plug-in update instruction to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

[0126] The specific implementation forms of steps 503 to 504 can refer to the detailed descriptions in other embodiments of the present disclosure and will not be described in detail here.

[0127] In the disclosed embodiment, the server first receives the description information sent by the monitoring service, then determines that the first monitoring plug-in verification code contained in the description information is different from the second monitoring plug-in verification code associated with the stored target type, obtains the second monitoring plug-in information associated with the type to which the application belongs, and then, in the event that the first monitoring plug-in information and the second monitoring plug-in information do not match, determines the target monitoring plug-in to be updated, and finally sends a plug-in update instruction to the monitoring service. Thus, when the server determines that the first monitoring plug-in verification code in the description information sent by the monitoring service is different from the second monitoring plug-in verification code associated with the stored target type, it obtains the second monitoring plug-in information associated with the type to which the application belongs, and in the event that the first monitoring plug-in information and the second monitoring plug-in information do not match, determines the monitoring plug-in to be updated and sends a plug-in update instruction to the monitoring service, thereby improving server resource utilization and improving the accuracy of application protection.

[0128] Combine the following Figure 6 , the application protection method provided by the present invention is illustrated by examples. Figure 6 A flowchart of the server-side application protection method provided in the present invention.

[0129] like Figure 6 As shown, the application protection method provided by the present disclosure may include functional modules such as a license management module, an application management module, a permission management module, a plug-in management module, a plug-in repository module, a combined version module, and a plug-in deployment module on the server side platform.

[0130] Among them, the license management module can help users view and modify the authorization serial number of the application; the application management module can provide an application list function; and the permission management module can provide a user permission list.

[0131] It should be noted that the plug-in repository module, the combined version module and the plug-in deployment module may all be located in the plug-in management module, and this disclosure does not limit this.

[0132] In the present disclosure, when performing application protection, the application protection management platform on the server side first fills in the authorization serial number of the application and creates the application, then creates an administrator role and applies it according to the administrator authority content in the authority management module, enters the application, obtains the first monitoring plug-in information currently contained in the application, and then obtains the second monitoring plug-in information of the type to which the application belongs from the plug-in warehouse, matches the first monitoring plug-in information with the second monitoring plug-in information, and when the two do not match, determines the monitoring plug-in to be updated in the application, and then through the combined version management module, packages and combines the monitoring plug-ins to be updated to obtain the combined version of the monitoring plug-in to be updated, and then creates a plug-in deployment task through the plug-in deployment module, determines the deployment scope and / or grayscale ratio and / or priority level of the plug-in, turns on the deployment switch, and sends the combined version of the monitoring plug-in to be updated to the monitoring service in the application, and finally turns off the deployment switch to end the plug-in deployment task, thereby realizing timely updates of the monitoring plug-ins contained in the application and improving the timeliness and accuracy of application protection.

[0133] Figure 7 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0134] like Figure 7 As shown, the application protection method may include the following steps:

[0135] Step 701, when the application is in running state, determine the current description information of the application, wherein the description information includes the identification of the application and the first monitoring plug-in information currently included in the application, and the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application.

[0136] In the present disclosure, when the application is in a running state, the monitoring service can determine the current description information of the application, thereby providing a data basis for application protection.

[0137] Optionally, when determining the current description information of the application, the monitoring service can also generate a first monitoring plug-in verification code based on the first detection plug-in information, so that the server can match the monitoring plug-in based on the verification code of the monitoring plug-in, thereby providing conditions for improving server resource utilization. The present disclosure does not limit this.

[0138] In the present disclosure, the monitoring service can be automatically loaded and run when the application is running. It can intercept (Hook) the key class methods of the application through the plug-in technology, capture the application's database access, file reading and writing, HTTP requests and other key behavior information, thereby realizing real-time protection of the application at the function level. Compared with application protection measures based on request characteristics (such as firewalls and intrusion detection systems), it has significant advantages and can more effectively respond to new and complex attacks, especially attacks that exploit the application's own vulnerabilities and logical defects, and significantly improve the application's security protection capabilities. The present disclosure does not limit this.

[0139] It should be noted that the monitoring service runs directly inside the application server in the form of a plug-in and completes the plug-in work when the application is started, which makes the monitoring service have good compatibility and can be applied to a variety of technology stacks and application environments. At the same time, the deployment and update of the monitoring service are relatively simple and convenient, and do not require a lot of modification or reconstruction of the application, thereby reducing implementation costs and risks and improving the efficiency and effectiveness of application protection.

[0140] Optionally, the monitoring service may perform a security configuration specification check on the application when the application is running to ensure that the application complies with the security specification, which is not limited in the present disclosure.

[0141] Optionally, when the application is running, the monitoring service may also monitor class library information in the application to identify potential security risks, which is not limited in the present disclosure.

[0142] Step 702: When no monitoring event returned by the monitoring plug-in is received and a preset period has been reached, description information is sent to the server.

[0143] Among them, the monitoring event may be a corresponding event obtained by monitoring key behavior information of the application, such as database access, file reading and writing, and HTTP request, and the present disclosure does not limit this.

[0144] The preset period may be a period for communicating with the server, which may be preset. For example, the preset period may be 30 minutes, etc., which is not limited in the present disclosure.

[0145] In the present disclosure, when the monitoring service does not receive a monitoring event returned by the monitoring plug-in and reaches a preset period, it can send descriptive information to the server through a heartbeat packet, so that the server and the application can maintain consistent information and improve the timeliness of application protection.

[0146] Step 703: When receiving the plug-in update instruction sent by the server, update the monitoring plug-in in the application based on the update instruction.

[0147] In the present disclosure, after the monitoring service sends description information to the server, when the monitoring service receives the plug-in update instruction sent by the server, it can update the monitoring plug-in in the application based on the update instruction, thereby ensuring the accuracy and reliability of the monitoring plug-in information of the application and improving the application protection capabilities.

[0148] In the disclosed embodiment, when the application is in a running state, the monitoring service first determines the current description information of the application, and then sends the description information to the server when no monitoring event returned by the monitoring plug-in is received and the preset period is reached, and finally updates the monitoring plug-in in the application based on the update instruction when the plug-in update instruction sent by the server is received. Thus, when the application is in a running state, the monitoring service determines the current description information of the application, and sends the description information to the server when no monitoring event returned by the monitoring plug-in is received and the preset period is reached, and updates the monitoring plug-in in the application based on the plug-in update instruction received from the server, thereby improving the timeliness and reliability of application protection.

[0149] Figure 8 A flowchart of an application protection method provided by an embodiment of the present disclosure.

[0150] like Figure 8 As shown, the application protection method may include the following steps:

[0151] Step 801, when the application is in running state, determine the current description information of the application, wherein the description information includes the identification of the application and the first monitoring plug-in information currently included in the application, and the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application.

[0152] The specific implementation form of step 801 can refer to the detailed description in other embodiments of the present disclosure, and will not be described in detail here.

[0153] Step 802: upon receiving an abnormal event returned by any monitoring plug-in, determine the type of the abnormal event according to the type of any monitoring plug-in.

[0154] In the present disclosure, after the monitoring service determines the current description information of the application, when it receives an abnormal event returned by any monitoring plug-in, in order to enable users to promptly perform statistics and analysis on the abnormal events occurring in the application and formulate corresponding protective measures, the type of abnormal event can be first determined based on the correspondence between the type of monitoring plug-in and the type of abnormal event.

[0155] Step 803: Send description information of the abnormal event to the server, wherein the description information of the abnormal event includes at least one of the following: the type, source and occurrence time of the abnormal event.

[0156] In the present disclosure, after determining the type of abnormal event, the monitoring service may send description information of the abnormal event to the server, so that the server may obtain the abnormal event information of the application in a timely manner.

[0157] It should be noted that since the monitoring service is located inside the application, it can monitor the application's operating status in real time. Once an abnormal event is detected, it can respond and protect immediately, which can significantly improve the response speed of application protection and reduce the losses caused by abnormal events.

[0158] Optionally, after sending the description information of the abnormal event to the server, the monitoring service can verify whether the abnormal event has been repaired through a harmless payload combined with the function behavior of the server, thereby reducing the false alarm rate. At the same time, since the monitoring service is applied inside the application, failed abnormal events will not trigger the monitoring logic, and each abnormal event is a successful alarm, which greatly reduces the missed alarm rate, thereby improving the accuracy and reliability of application protection, which is not limited in this disclosure.

[0159] The payload may be a function code used to exploit a vulnerability.

[0160] In the disclosed embodiment, when the application is in the running state, the monitoring service first determines the current description information of the application, and then, when receiving an abnormal event returned by any monitoring plug-in, determines the type of the abnormal event according to the type of any monitoring plug-in, and sends the description information of the abnormal event to the server. Thus, after receiving the abnormal event returned by the monitoring plug-in, the monitoring service determines the type of the abnormal event according to the type of the monitoring plug-in, and sends the abnormal event to the server, thereby improving the timeliness and reliability of application protection.

[0161] Combine the following Fig. 9 , the application protection method provided by the present invention is illustrated by examples. Fig. 9 A timing diagram of application protection provided for an embodiment of the present disclosure.

[0162] like Fig. 9 The timing diagram of the application protection includes the following steps:

[0163] Step 901: The monitoring service is deployed on the application that needs to be protected.

[0164] Step 902: The monitoring service is started along with the application.

[0165] Step 903: The monitoring service reads the local configuration and obtains the server link.

[0166] It should be noted that after the application is started, the monitoring service can obtain the host identification, the first monitoring plug-in information currently included in the application, the IP address of the application, etc. by reading the local configuration of the application, and the present disclosure does not limit this.

[0167] Step 904: The monitoring service sends the application description information to the server.

[0168] It should be noted that the monitoring service may include the registration information of the application in the description information of the application sent to the server, so that the server can register the application.

[0169] Step 905: The server returns response information to the monitoring service.

[0170] It should be noted that the response information returned by the server to the monitoring service may be registration success information.

[0171] Step 906: When the preset period is reached, the monitoring service sends a heartbeat to the server, which may carry description information.

[0172] Step 907: The server returns the application policy configuration information and monitoring plug-in configuration information to the monitoring service.

[0173] The policy configuration information may be configuration policy information of a monitoring plug-in of an application.

[0174] In the present disclosure, after receiving the description information sent by the monitoring service, the server can first determine the type of application where the monitoring service is located, and obtain the second monitoring plug-in information under this type from the plug-in repository, compare the first monitoring plug-in information with the second monitoring plug-in information, and if the first monitoring plug-in information does not match the second monitoring plug-in information, determine the monitoring plug-in to be updated in the application, and send the application's policy configuration information and the monitoring plug-in configuration information to the monitoring service, wherein the monitoring plug-in configuration information includes the monitoring plug-in information to be updated in the application.

[0175] Step 908: The monitoring service updates the monitoring plug-in in the application as needed.

[0176] In the present disclosure, after receiving the policy configuration information and the monitoring plug-in configuration information sent by the server, the monitoring service can update the monitoring plug-in in the application based on the policy configuration information and the monitoring plug-in configuration information.

[0177] Step 909: The monitoring service requests the monitoring plug-in from the object storage service.

[0178] In the present disclosure, when the monitoring service updates the monitoring plug-in in the application, if it is found that the monitoring plug-in to be updated is missing, the monitoring service can request the missing monitoring plug-in from the object storage service.

[0179] Step 910: The object storage service returns the monitoring plug-in to the monitoring service.

[0180] In the present disclosure, after receiving the request sent by the monitoring service, the object storage service returns the requested monitoring plug-in to the monitoring service, so that the monitoring service can continue to update the monitoring plug-in included in the application.

[0181] Step 911, the monitoring service updates the monitoring plug-in.

[0182] Step 912: The monitoring service detects an abnormal event.

[0183] Step 913: The monitoring service reports the abnormal event to the server.

[0184] Step 914: The server stores the abnormal event data in a database for recording.

[0185] Step 915: The database returns operation success information to the server.

[0186] The operation success information may be used to indicate that the database has stored the abnormal event.

[0187] Step 916: The server returns recording success information to the monitoring service.

[0188] Depend on Fig. 9 It can be obtained that by deploying the monitoring service in the application that needs to be protected, and when the application starts, the description information of the application is obtained and sent to the server for comparison. After the server determines that the application has a monitoring plug-in that needs to be updated, it sends the monitoring plug-in information to be updated to the monitoring service, so that the monitoring service can update the monitoring service included in the application. After that, after the monitoring service detects an abnormal event, it reports it to the server for recording, thereby effectively responding to new and complex attacks and significantly improving the application protection capabilities.

[0189] In order to implement the above embodiments, the present disclosure also proposes an application protection device.

[0190] Fig.10 A schematic diagram of the structure of an application protection device provided in an embodiment of the present disclosure.

[0191] like Fig.10 As shown, the application protection device 1000 includes: a first receiving module 1001, an acquisition module 1002, a first determination module 1003, and a first sending module 1004.

[0192] The first receiving module 1001 is used to receive description information sent by the monitoring service, wherein the description information includes an identifier of the application where the monitoring service is located and information of a first monitoring plug-in currently included in the application, where the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application;

[0193] An acquisition module 1002 is used to acquire second monitoring plug-in information associated with a target type to which the application belongs;

[0194] A first determination module 1003, configured to determine a target monitoring plug-in to be updated when the first monitoring plug-in information does not match the second monitoring plug-in information;

[0195] The first sending module 1004 is used to send a plug-in update instruction to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install a target monitoring plug-in in the application.

[0196] In a possible implementation of the present disclosure, it further includes:

[0197] A second receiving module (not shown in the figure) is used to receive abnormal event description information sent by the monitoring service, wherein the abnormal event description information includes at least one of the following: the type, source and occurrence time of the abnormal event;

[0198] The storage module (not shown in the figure) is used to store the abnormal event description information in association with the application identifier.

[0199] In a possible implementation of the present disclosure, the storage module (not shown in the figure) is further used for:

[0200] receiving an abnormal event display request, wherein the display request includes an identifier of a target type;

[0201] Get description information of all abnormal events associated with all applications under the target type;

[0202] According to the abnormal event description information, an abnormal event display interface corresponding to the target type is generated and displayed, wherein the display interface includes at least one of the following: the type of abnormal event, the quantity distribution of different types of abnormal events, and the occurrence time distribution of abnormal events.

[0203] In a possible implementation of the present disclosure, it further includes:

[0204] A third receiving module (not shown in the figure), configured to receive a configuration instruction, wherein the configuration instruction includes an identifier of a target type and information of a plug-in to be configured;

[0205] The first updating module (not shown in the figure) is used to update the second monitoring plug-in information associated with the target type based on the plug-in information to be configured.

[0206] In a possible implementation of the present disclosure, the acquisition module 1002 is specifically configured to:

[0207] Determine that the first monitoring plug-in verification code contained in the description information is different from the second monitoring plug-in verification code associated with the stored target type, and obtain the second monitoring plug-in information associated with the type to which the application belongs, wherein the first monitoring plug-in verification code is generated by the monitoring service based on the first monitoring plug-in information, and the second monitoring plug-in verification code is generated based on the second monitoring plug-in information.

[0208] In a possible implementation of the present disclosure, it further includes:

[0209] The second updating module (not shown in the figure) is used to update the second monitoring plug-in verification code associated with the target type based on the updated second monitoring plug-in information after receiving the configuration instruction for the target type.

[0210] The functions and specific implementation principles of the above modules in the embodiments of the present disclosure can be referred to the above method embodiments, and will not be repeated here.

[0211] In the disclosed embodiment, the server first receives the description information sent by the monitoring service, then obtains the second monitoring plug-in information associated with the target type to which the application belongs, and in the case where the first monitoring plug-in information does not match the second monitoring plug-in information, determines the target monitoring plug-in to be updated, and finally sends a plug-in update instruction to the monitoring service. Thus, after receiving the description information sent by the monitoring service, the server obtains the monitoring plug-in information associated with the type of application where the monitoring service is located from the plug-in repository, and compares it with the monitoring plug-in information currently contained in the application, determines the monitoring plug-in to be updated for the application, and sends a plug-in update instruction to the monitoring service, thereby providing conditions for reducing the false alarm rate and missed alarm rate of application protection, and improving the timeliness and reliability of application protection.

[0212] In order to implement the above embodiments, the present disclosure also proposes an application protection device.

[0213] Fig.11 A schematic diagram of the structure of an application protection device provided in an embodiment of the present disclosure.

[0214] like Fig.11 As shown, the application protection device 1100 includes: a second determination module 1101, a second sending module 1102, and a third update module 1103.

[0215] The second determination module 1101 is used to determine the current description information of the application when the application is in a running state, wherein the description information includes the identification of the application and the information of the first monitoring plug-in currently included in the application, and the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application;

[0216] The second sending module 1102 is used to send description information to the server when no monitoring event returned by the monitoring plug-in is received and a preset period has arrived;

[0217] The third updating module 1103 is used to update the monitoring plug-in in the application based on the updating instruction when receiving the plug-in updating instruction sent by the server.

[0218] In a possible implementation of the present disclosure, the second determining module 1101 is further configured to:

[0219] In case of receiving an abnormal event returned by any monitoring plug-in, determining the type of the abnormal event according to the type of any monitoring plug-in;

[0220] Sending description information of the abnormal event to the server, wherein the description information of the abnormal event includes at least one of the following: the type, source and occurrence time of the abnormal event.

[0221] In a possible implementation of the present disclosure, the description information further includes a first monitoring plug-in verification code and:

[0222] A generation module (not shown in the figure) is used to generate a first monitoring plug-in verification code based on the first detection plug-in information.

[0223] The functions and specific implementation principles of the above modules in the embodiments of the present disclosure can be referred to the above method embodiments, and will not be repeated here.

[0224] In the disclosed embodiment, when the application is in a running state, the monitoring service first determines the current description information of the application, and then sends the description information to the server when no monitoring event returned by the monitoring plug-in is received and the preset period is reached, and finally updates the monitoring plug-in in the application based on the update instruction when the plug-in update instruction sent by the server is received. Thus, when the application is in a running state, the monitoring service determines the current description information of the application, and sends the description information to the server when no monitoring event returned by the monitoring plug-in is received and the preset period is reached, and updates the monitoring plug-in in the application based on the plug-in update instruction received from the server, thereby improving the timeliness and reliability of application protection.

[0225] Fig.12A schematic block diagram of an example electronic device 1200 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0226] like Fig.12 As shown, the device 1200 includes a computing unit 1201, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1202 or a computer program loaded from a storage unit 1208 into a random access memory (RAM) 1203. In the RAM 1203, various programs and data required for the operation of the device 1200 can also be stored. The computing unit 1201, the ROM 1202, and the RAM 1203 are connected to each other via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0227] A number of components in the device 1200 are connected to the I / O interface 1205, including: an input unit 1206, such as a keyboard, a mouse, etc.; an output unit 1207, such as various types of displays, speakers, etc.; a storage unit 1208, such as a disk, an optical disk, etc.; and a communication unit 1209, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 1209 allows the device 1200 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0228] The computing unit 1201 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 1201 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 1201 performs the various methods and processes described above, such as the application protection method. For example, in some embodiments, the application protection method may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 1208. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 1200 via ROM 1202 and / or the communication unit 1209. When the computer program is loaded into RAM 1203 and executed by the computing unit 1201, one or more steps of the application protection method described above may be performed. Alternatively, in other embodiments, the computing unit 1201 may be configured to perform the application protection method in any other appropriate manner (e.g., by means of firmware).

[0229] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0230] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a general-purpose computer, a special-purpose computer, or other programmable processor or controller, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine as a stand-alone software package and partially on a remote machine, or entirely on a remote machine or server.

[0231] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0232] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0233] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), the Internet, and a blockchain network.

[0234] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0235] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0236] In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present disclosure, the meaning of "multiple" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined. In the description of the present disclosure, the words "if" and "if" used can be interpreted as "at the time of" or "when" or "in response to determination" or "under the circumstances of".

[0237] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. An application protection method, comprising: Receive description information sent by the monitoring service, wherein the description information includes an identifier of an application in which the monitoring service is located, and information about a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is used to monitor and intercept abnormal events during the operation of the application; Acquire second monitoring plug-in information associated with the target type to which the application belongs; In the case where the first monitoring plug-in information does not match the second monitoring plug-in information, determining a target monitoring plug-in to be updated; A plug-in update instruction is sent to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

2. The method of claim 1, wherein: The method further comprises: Receive abnormal event description information sent by the monitoring service, wherein the abnormal event description information includes at least one of the following: the type, source and occurrence time of the abnormal event; The abnormal event description information is associated with the identification of the application and stored.

3. The method of claim 2, wherein: After the abnormal event description information is associated with the identification of the application and stored, the method further includes: receiving an abnormal event display request, wherein the display request includes an identifier of the target type; Obtain description information of all abnormal events associated with all applications under the target type; According to the abnormal event description information, an abnormal event display interface corresponding to the target type is generated and displayed, wherein the display interface includes at least one of the following: the type of abnormal event, the quantity distribution of different types of abnormal events, and the occurrence time distribution of abnormal events.

4. The method of claim 1, wherein: The method further comprises: Receiving a configuration instruction, wherein the configuration instruction includes an identifier of the target type and information of the plug-in to be configured; Based on the plug-in information to be configured, the second monitoring plug-in information associated with the target type is updated.

5. The method according to any one of claims 1 to 4, wherein: The acquiring of second monitoring plug-in information associated with the target type to which the application belongs includes: Determine that a first monitoring plug-in verification code contained in the description information is different from a second monitoring plug-in verification code associated with the stored target type, and obtain second monitoring plug-in information associated with the type to which the application belongs, wherein the first monitoring plug-in verification code is generated by the monitoring service based on the first monitoring plug-in information, and the second monitoring plug-in verification code is generated based on the second monitoring plug-in information.

6. The method of claim 5, wherein: The method further comprises: After receiving the configuration instruction for the target type, the second monitoring plug-in verification code associated with the target type is updated based on the updated second monitoring plug-in information.

7. An application protection method, comprising: When the application is in a running state, determine current description information of the application, wherein the description information includes an identifier of the application and information of a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application; When no monitoring event returned by the monitoring plug-in is received and a preset period has been reached, sending the description information to the server; When the plug-in update instruction sent by the server is received, the monitoring plug-in in the application is updated based on the update instruction.

8. The method of claim 7, wherein: After determining the current description information of the application, the method further includes: In case of receiving an abnormal event returned by any monitoring plug-in, determining the type of the abnormal event according to the type of any monitoring plug-in; Sending description information of the abnormal event to the server, wherein the description information of the abnormal event includes at least one of the following: the type, source and occurrence time of the abnormal event.

9. The method of claim 7, wherein: The description information also includes the first monitoring plug-in verification code, and the method further includes: Based on the first detection plug-in information, the first monitoring plug-in verification code is generated.

10. An application protection device, wherein: The device comprises: A first receiving module, configured to receive description information sent by a monitoring service, wherein the description information includes an identifier of an application in which the monitoring service is located, and information about a first monitoring plug-in currently included in the application, wherein the monitoring plug-in is configured to monitor and intercept abnormal events during the operation of the application; An acquisition module, used to acquire second monitoring plug-in information associated with the target type to which the application belongs; A first determining module, configured to determine a target monitoring plug-in to be updated when the first monitoring plug-in information does not match the second monitoring plug-in information; The first sending module is used to send a plug-in update instruction to the monitoring service, wherein the update instruction is used to instruct the monitoring service to install the target monitoring plug-in in the application.

11. The device of claim 10, wherein: Also includes: A second receiving module is used to receive abnormal event description information sent by the monitoring service, wherein the abnormal event description information includes at least one of the following: the type, source and occurrence time of the abnormal event; The storage module is used to store the abnormal event description information in association with the identification of the application.

12. The device of claim 11, wherein: The storage module is further used for: receiving an abnormal event display request, wherein the display request includes an identifier of the target type; Obtain description information of all abnormal events associated with all applications under the target type; According to the abnormal event description information, an abnormal event display interface corresponding to the target type is generated and displayed, wherein the display interface includes at least one of the following: the type of abnormal event, the quantity distribution of different types of abnormal events, and the occurrence time distribution of abnormal events.

13. The device of claim 10, wherein: Also includes: A third receiving module, configured to receive a configuration instruction, wherein the configuration instruction includes an identifier of the target type and plug-in information to be configured; The first updating module is used to update the second monitoring plug-in information associated with the target type based on the plug-in information to be configured.

14. The device according to any one of claims 10 to 13, wherein: The acquisition module is specifically used for: Determine that a first monitoring plug-in verification code contained in the description information is different from a second monitoring plug-in verification code associated with the stored target type, and obtain second monitoring plug-in information associated with the type to which the application belongs, wherein the first monitoring plug-in verification code is generated by the monitoring service based on the first monitoring plug-in information, and the second monitoring plug-in verification code is generated based on the second monitoring plug-in information.

15. The device of claim 14, wherein: Also includes: The second updating module is used to update the second monitoring plug-in verification code associated with the target type based on the updated second monitoring plug-in information after receiving the configuration instruction for the target type.

16. An application protection device, wherein: The device comprises: A second determination module is used to determine the current description information of the application when the application is in a running state, wherein the description information includes the identification of the application and the information of a first monitoring plug-in currently included in the application, and the monitoring plug-in is used to monitor and intercept abnormal events during the running of the application; A second sending module, configured to send the description information to the server when no monitoring event returned by the monitoring plug-in is received and a preset period has been reached; The third updating module is used to update the monitoring plug-in in the application based on the updating instruction when receiving the plug-in updating instruction sent by the server.

17. The device of claim 16, wherein: The second determining module is further used for: In case of receiving an abnormal event returned by any monitoring plug-in, determining the type of the abnormal event according to the type of any monitoring plug-in; Sending description information of the abnormal event to the server, wherein the description information of the abnormal event includes at least one of the following: the type, source and occurrence time of the abnormal event.

18. The device of claim 16, wherein: The description information also includes the first monitoring plug-in verification code, and also includes: A generation module is used to generate the first monitoring plug-in verification code based on the first detection plug-in information.

19. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions that may be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the application protection method described in any one of claims 1-9.

20. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable the computer to execute the application protection method according to any one of claims 1-9.

21. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the application protection method according to any one of claims 1 to 9.

Images