De-serialization attack detection method and device and electronic equipment

Abstract

The embodiment of the invention provides a deserialization attack detection method and device and electronic equipment, and relates to the technical field of information security, and the method comprises the steps: determining a service interface for receiving a to-be-processed deserialization request as a to-be-processed interface; based on serialization data carried by the to-be-processed deserialization request, extracting information of a specified dimension indicated by the to-be-processed deserialization request as to-be-detected information; and detecting the to-be-detected information based on to-be-utilized normal information corresponding to the to-be-processed interface recorded in a preset behavior pattern library to obtain a final detection result representing whether the to-be-processed deserialization request is abnormal or not. According to the scheme, the deserialization attack can be accurately detected.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a deserialization attack detection method, device and electronic device. Background Art

[0002] Deserialization refers to the process of converting serialized data back into an object. Deserialization attacks refer to constructing malicious serialized data and then using the deserialization mechanism to call malicious programs. For example, the front end can send a deserialization request containing serialized data to the back end server, and the server will deserialize the serialized data based on the received serialized data to convert the serialized data into an object. If the attacker embeds malicious code in the serialized data, the server may execute the malicious code during the deserialization process, causing damage to the server.

[0003] Therefore, how to accurately detect deserialization attacks is an urgent problem to be solved. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a deserialization attack detection method, device and electronic device to accurately detect deserialization attacks. The specific technical solution is as follows:

[0005] The present application embodiment first provides a deserialization attack detection method, the method comprising:

[0006] Determine the business interface that receives the pending deserialization request as the pending interface;

[0007] Based on the serialized data carried by the pending deserialization request, extract the information of the specified dimension indicated by the pending deserialization request as the information to be detected; wherein the specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the calling function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request;

[0008] Based on the normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library, the information to be detected is detected to obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: the information of the specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

[0009] Optionally, the normal information to be utilized corresponding to the interface to be processed recorded in a preset behavior pattern library is used to detect the information to be detected, and a final detection result characterizing whether the deserialization request to be processed is abnormal is obtained, including:

[0010] Obtaining a first sub-detection result and / or a second sub-detection result; wherein the first sub-detection result is obtained by matching the information to be detected with the normal information to be used; the second sub-detection result is obtained by detecting the information to be detected based on a pre-trained detection model; the detection model is obtained by training based on the information recorded in the behavior pattern library;

[0011] Based on the obtained sub-detection results, a final detection result characterizing whether the to-be-processed deserialization request is abnormal is determined.

[0012] Optionally, the behavior pattern library also records the to-be-utilized exception information corresponding to the to-be-processed interface; the exception information corresponding to an interface is: information on the dimension of the exception obtained based on the serialized data carried by the abnormal deserialization request received by the interface;

[0013] Before obtaining the first sub-detection result and / or the second sub-detection result, the method further includes:

[0014] If the information to be detected matches the abnormal information to be utilized, determining that the final detection result indicates that the deserialization request to be processed is abnormal;

[0015] The obtaining of the first sub-detection result and / or the second sub-detection result includes:

[0016] In the case that the information to be detected does not match the abnormal information to be used, a first sub-detection result and / or a second sub-detection result are obtained.

[0017] Optionally, the method for determining the first sub-detection result includes the following steps:

[0018] If at least one of the following conditions is not met, it is determined that the first sub-detection result indicates that the pending deserialization request is abnormal:

[0019] The information to be detected matches the authority of the user role that initiates the deserialization request to be processed;

[0020] The class to which the object in the information to be detected belongs is consistent with the class in the normal information to be used;

[0021] If all the above conditions are met, a first matching result between the attribute of the object in the information to be detected and the attribute in the normal information to be used, and / or a second matching result between the calling sequence of the function in the information to be detected and the calling sequence of the function in the normal information to be used is obtained;

[0022] A first sub-detection result is determined based on the acquired matching result.

[0023] Optionally, the first matching result includes: a first similarity and / or a second similarity; wherein:

[0024] The method for determining the first similarity includes:

[0025] Obtaining historical attributes of the object in the information to be detected from the historical deserialization request received by the interface to be processed;

[0026] Combining the acquired historical attributes with the attributes of the object in the information to be detected to obtain a sequence of attributes to be matched;

[0027] Calculating the similarity between the attribute sequence to be matched and the attribute sequence in the normal information to be used to obtain a first similarity;

[0028] The second similarity is determined in the following manner:

[0029] Calculating the similarity between the attribute of the object represented by the to-be-processed deserialization request and the attribute in the to-be-utilized normal information to obtain a second similarity;

[0030] and / or,

[0031] The method for determining the second matching result includes:

[0032] The similarity between the function sequence representing the calling order of the functions in the information to be detected and the function sequence representing the calling order of the functions in the normal information to be utilized is calculated to obtain a second matching result.

[0033] Optionally, determining the first sub-detection result based on the acquired matching result includes:

[0034] The obtained similarities are weighted added to obtain the total similarity;

[0035] When the total similarity is less than a preset similarity threshold, it is determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0036] Optionally, the method for determining the second sub-detection result comprises the following steps:

[0037] Performing vectorization processing on the data of each dimension in the information to be detected to obtain a vector to be used of each dimension in the information to be detected;

[0038] The obtained vectors to be used are fused to obtain fusion features;

[0039] The fusion feature is detected using the detection model to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal.

[0040] Optionally, the method further includes, when a preset model update condition is met, using deserialization requests received during historical detection processes and actual results indicating whether the deserialization requests are abnormal, to perform incremental training on the detection model to obtain an updated detection model.

[0041] Optionally, extracting information of a specified dimension indicated by the deserialization request to be processed as the information to be detected based on the serialized data carried by the deserialization request to be processed includes:

[0042] By calling the rewritten deserialization function, based on the serialized data carried by the deserialization request to be processed, the information of the specified dimension indicated by the deserialization request to be processed is extracted as the information to be detected; wherein the rewritten deserialization function is obtained by pre-inserting the code for reading the information carried by the deserialization request into the initial deserialization function.

[0043] The present application also provides a deserialization attack detection device, the device comprising:

[0044] An interface determination module, used to determine a business interface for receiving a deserialization request to be processed as an interface to be processed;

[0045] An information extraction module is used to extract information of a specified dimension indicated by a pending deserialization request based on serialized data carried by the pending deserialization request as information to be detected; wherein the specified dimension includes at least one of the following: a class to which an object represented by the deserialization request belongs, an attribute of the represented object, a calling sequence of functions required for a deserialization operation indicated by the deserialization request, and a user role that initiates the deserialization request;

[0046] An information detection module is used to detect the information to be detected based on the normal information to be used corresponding to the interface to be processed recorded in a preset behavior pattern library, and obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: the information of the specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

[0047] Optionally, the information detection module includes:

[0048] The detection result acquisition submodule is used to obtain the first sub-detection result and / or the second sub-detection result; wherein the first sub-detection result is obtained by matching the information to be detected with the normal information to be used; the second sub-detection result is obtained by detecting the information to be detected based on a pre-trained detection model; the detection model is obtained by training based on the information recorded in the behavior pattern library;

[0049] The detection result determination submodule is used to determine a final detection result representing whether the to-be-processed deserialization request is abnormal based on the acquired sub-detection results.

[0050] Optionally, the behavior pattern library also records the to-be-utilized exception information corresponding to the to-be-processed interface; the exception information corresponding to an interface is: information on the dimension of the exception obtained based on the serialized data carried by the abnormal deserialization request received by the interface;

[0051] The device further includes: an abnormal information matching module, configured to determine that the final detection result indicates that the deserialization request to be processed is abnormal if the information to be detected matches the abnormal information to be used before the detection result acquisition submodule acquires the first sub-detection result and / or the second sub-detection result;

[0052] The detection result acquisition submodule is specifically used for:

[0053] In the case that the information to be detected does not match the abnormal information to be used, a first sub-detection result and / or a second sub-detection result are obtained.

[0054] Optionally, the detection result acquisition submodule is specifically used to: if at least one of the following conditions is not met, determine that the first sub-detection result indicates that the deserialization request to be processed is abnormal: the information to be detected matches the permissions of the user role that initiates the deserialization request to be processed; the class to which the object in the information to be detected belongs is consistent with the class in the normal information to be used; if all of the above conditions are met, obtain the attributes of the object in the information to be detected, and a first matching result with the attributes in the normal information to be used, and / or, the calling order of the function in the information to be detected, and a second matching result with the calling order of the function in the normal information to be used; determine the first sub-detection result based on the obtained matching results.

[0055] Optionally, the first matching result includes: a first similarity and / or a second similarity; the detection result acquisition submodule is specifically used to: obtain historical attributes of the object in the information to be detected from the historical deserialization request received by the interface to be processed; combine the acquired historical attributes with the attributes of the object in the information to be detected to obtain a sequence of attributes to be matched; calculate the similarity between the sequence of attributes to be matched and the sequence of attributes in the normal information to be used to obtain a first similarity; calculate the similarity between the attributes of the object represented by the deserialization request to be processed and the attributes in the normal information to be used to obtain a second similarity;

[0056] and / or,

[0057] The detection result acquisition submodule is specifically used to calculate the similarity between the function sequence representing the calling order of the functions in the information to be detected and the function sequence representing the calling order of the functions in the normal information to be used, so as to obtain a second matching result.

[0058] Optionally, the detection result acquisition submodule is specifically used to:

[0059] The obtained similarities are weightedly added to obtain a total similarity; when the total similarity is less than a preset similarity threshold, it is determined that the first sub-detection result indicates that the to-be-processed deserialization request is abnormal.

[0060] Optionally, the detection result acquisition submodule includes:

[0061] A data vectorization unit, used for performing vectorization processing on the data of each dimension in the information to be detected, so as to obtain a vector to be used of each dimension in the information to be detected;

[0062] A fusion unit, used for fusing the obtained vectors to be used to obtain fusion features;

[0063] The detection unit is used to detect the fusion feature using the detection model to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal.

[0064] Optionally, the device also includes: a model update module, which is used to use the deserialization requests received during the historical detection process and the actual results indicating whether the deserialization request is abnormal to perform incremental training on the detection model to obtain an updated detection model when the preset model update conditions are met.

[0065] Optionally, the information extraction module is specifically used to:

[0066] By calling the rewritten deserialization function, based on the serialized data carried by the deserialization request to be processed, the information of the specified dimension indicated by the deserialization request to be processed is extracted as the information to be detected; wherein the rewritten deserialization function is obtained by pre-inserting the code for reading the information carried by the deserialization request into the initial deserialization function.

[0067] The present application also provides an electronic device, including:

[0068] Memory, used to store computer programs;

[0069] The processor is used to implement any of the above-mentioned deserialization attack detection methods when executing the program stored in the memory.

[0070] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, any of the above-mentioned deserialization attack detection methods is implemented.

[0071] An embodiment of the present application also provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute any of the above-mentioned deserialization attack detection methods.

[0072] Beneficial effects of the embodiments of the present application:

[0073] The deserialization attack detection method provided in this embodiment pre-sets a behavior pattern library for the business interface, and the behavior pattern library records the information of the specified dimension indicated by the normal deserialization request, including the class to which the object represented by the deserialization request belongs, the attributes of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, and the user role that initiated the deserialization request; and when the deserialization request is a request for a deserialization attack, the information indicated by the deserialization request will not match the normal deserialization request in at least one of the above dimensions. Therefore, when the pending interface receives the pending deserialization request, this scheme detects the information to be detected indicated by the pending deserialization request based on the normal information to be used corresponding to the pending interface recorded in the preset behavior pattern library to determine whether the pending deserialization request is abnormal. When it is determined that the pending deserialization request is abnormal, it indicates that the pending deserialization request is likely to be a request for a deserialization attack. Therefore, this scheme can accurately detect deserialization attacks.

[0074] Of course, implementing any product or method of the present application does not necessarily require achieving all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0076] Figure 1 A schematic diagram of a process flow of a deserialization attack detection method provided in an embodiment of the present application;

[0077] Figure 2 Another schematic diagram of the process of detecting a deserialization attack provided by an embodiment of the present application;

[0078] Figure 3 Another flowchart of the deserialization attack detection method provided in the embodiment of the present application;

[0079] Figure 4 A framework diagram of the deserialization attack detection method provided in an embodiment of the present application;

[0080] Figure 5 A schematic diagram of the structure of a deserialization attack detection device provided in an embodiment of the present application;

[0081] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0082] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field based on the present application belong to the scope of protection of the present application.

[0083] In order to accurately detect deserialization attacks, the embodiments of the present application provide a deserialization attack detection method, device, and electronic device. The method can be applied to electronic devices with data processing capabilities, such as computers, servers, etc. In specific scenarios, the method can be applied to the deserialization attack detection program of the backend server. The method may include the following steps:

[0084] Determine the business interface that receives the pending deserialization request as the pending interface;

[0085] Based on the serialized data carried by the pending deserialization request, extract the information of the specified dimension indicated by the pending deserialization request as the information to be detected; wherein the specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the calling function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request;

[0086] Based on the normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library, the information to be detected is detected to obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: information of a specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

[0087] In this embodiment, a behavior pattern library is preset for the business interface in advance, and the behavior pattern library records the information of the specified dimension indicated by the normal deserialization request, including the class to which the object represented by the deserialization request belongs, the attributes of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, and the user role that initiated the deserialization request; and when the deserialization request is a request for a deserialization attack, the information indicated by the deserialization request will not match the normal deserialization request in at least one of the above dimensions. Therefore, when the pending interface receives the pending deserialization request, this scheme detects the information to be detected indicated by the pending deserialization request based on the normal information to be used corresponding to the pending interface recorded in the preset behavior pattern library to determine whether the pending deserialization request is abnormal. When it is determined that the pending deserialization request is abnormal, it indicates that the pending deserialization request is likely to be a request for a deserialization attack. Therefore, this scheme can accurately detect deserialization attacks.

[0088] The following first introduces the deserialization attack detection method provided by the embodiment of the present application in conjunction with the accompanying drawings. Figure 1 As shown, the method comprises the following steps:

[0089] S101, determining a business interface for receiving a to-be-processed deserialization request as the to-be-processed interface;

[0090] Among them, the business interface may refer to an interface provided by the business system to the business party for use in processing specific business logic. There may be multiple business components in a business system, and each business component may perform deserialization interaction through each other's business interface, that is, send deserialization requests to each other, and the business system may run in the backend server. When an interface receives a deserialization request, the deserialization request may be detected by the method provided in this embodiment.

[0091] S102, based on the serialized data carried by the deserialization request to be processed, extracting information of a specified dimension indicated by the deserialization request to be processed as information to be detected;

[0092] The specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request;

[0093] In this embodiment, the object represented by a deserialization request may refer to an object obtained after executing the deserialization operation indicated by the deserialization request. The attributes of the object may include the name and corresponding value of the attribute of the object, and may also include the state of the object.

[0094] Specifically, by calling the rewritten deserialization function, based on the serialized data carried by the deserialization request to be processed, the information of the specified dimension indicated by the deserialization request to be processed can be extracted as the information to be detected; wherein the rewritten deserialization function is obtained by inserting the code for reading the information indicated by the deserialization request into the initial deserialization function in advance.

[0095] Since the deserialization operation usually needs to be implemented by calling a deserialization function, for example, when the business component is running based on a Java (an object-oriented programming language) application, the deserialization function can be a readObject function (in the field of computer programming, the deserialization function in this embodiment can also be called a deserialization method, and the readObject function is also a readObject method. In order to distinguish it from the deserialization attack detection method in this embodiment, all of the deserialization functions and readObject functions are referred to in this embodiment hereinafter). The application will call the readObject function of the ObjectInputStream class by default to read bytes from the received serialized data stream and convert it into a Java object. When the application of the business component is started or running, the ObjectInputStream class can be extended through Java Agent (a technology that can dynamically modify Java bytecode) to rewrite its readObject function to insert logic code for reading the information indicated by the deserialization request into the readObject function. Therefore, after the business interface of the business component receives the deserialization request, when performing the deserialization operation, the readObject function will be automatically called to obtain the information of the specified dimension indicated by the deserialization request.

[0096] In one implementation, the extracting of information of a specified dimension indicated by the deserialization request to be processed based on the serialized data carried by the deserialization request to be processed includes:

[0097] By calling the rewritten deserialization function, the serialized data carried by the deserialization request to be processed is deserialized, and in the process of executing the deserialization operation, the information of the specified dimension indicated by the deserialization request to be processed is extracted as the information to be detected. In one implementation, the information of the specified dimension extracted by the deserialization function may include detecting the properties of the object represented by the deserialization request, and / or the calling order of the function required for the deserialization operation indicated by the deserialization request. The class to which the object represented by the deserialization request belongs, and / or the user role that initiated the deserialization request, can be parsed from the serialized data carried by the deserialization request to be processed.

[0098] This embodiment rewrites the deserialization function. The rewritten deserialization function not only executes the deserialization process of converting the serialized data stream into an object, but also detects the behavior generated by the execution of the deserialization process in real time during the process. That is, this solution is a dynamic analysis method. One detection method is to analyze the data carried by the deserialization request, or to determine whether the initiator of the deserialization request is in the black and white list, and this method is a static analysis method. In contrast, this solution focuses on detecting whether abnormal behavior changes occur during the deserialization process, not just changes in the bytecode, and can capture more complex and hidden forms of attacks, especially attacks that carry legal serialized data but perform abnormal behaviors. Therefore, this solution can effectively reduce the possibility of attackers bypassing the protection mechanism and improve the comprehensiveness of detection.

[0099] In addition, this solution inserts code for reading the information indicated by the deserialization request in the deserialization function to obtain the information of the specified dimension indicated by the deserialization request. Every time a deserialization operation needs to be performed, the deserialization operation can be detected. This is a non-invasive method that does not require modification of business code or major changes to existing business systems. At the same time, it can reduce dependence on existing code and improve compatibility and flexibility.

[0100] S103, based on the normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library, the information to be detected is detected to obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: information of a specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

[0101] The normal information to be utilized corresponding to the interface to be processed recorded in the behavior pattern library may include only one set of information or multiple sets of information; wherein each set of information may include information of each specified dimension obtained based on the serialized data carried by a normal deserialization request.

[0102] The behavior pattern library can store an interface list, which includes business interfaces that need to be detected. In the behavior pattern library, normal information indicated by serialized data carried by a corresponding normal deserialization request can also be recorded for each business interface.

[0103] In one implementation, the above-mentioned normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library is used to detect the information to be detected, and a final detection result characterizing whether the deserialization request to be processed is abnormal is obtained, including:

[0104] Step A1, obtaining a first sub-detection result and / or a second sub-detection result; wherein the first sub-detection result is obtained by matching the information to be detected with the normal information to be used; the second sub-detection result is obtained by detecting the information to be detected based on a pre-trained detection model; the detection model is obtained by training based on the information recorded in the behavior pattern library;

[0105] Step A2: Based on the obtained sub-detection results, determine a final detection result indicating whether the deserialization request to be processed is abnormal.

[0106] In one implementation, if the first sub-detection result and the second sub-detection result are obtained at the same time, in order to detect the received abnormal deserialization requests as much as possible and improve the recall rate, if one of the first sub-detection result and the second sub-detection result represents the abnormality of the deserialization request to be processed, the final detection result can be determined to be the abnormality of the deserialization request to be processed.

[0107] In one implementation, when matching the information to be detected with the normal information to be used, if the normal information to be used corresponding to the interface to be processed is multiple groups of information, the information to be detected can be matched with each group of information respectively. If the information to be detected matches any of the groups of information, it can be regarded as matching the information to be detected with the normal information to be used. In order to improve the efficiency of matching, a priority can be set for each group of information according to its importance or credibility, so as to preferentially match a group of information with a higher priority.

[0108] The following first introduces the process of determining the first sub-test result. The method of determining the first sub-test result includes:

[0109] If at least one of the following conditions is not met, it is determined that the first sub-detection result indicates that the pending deserialization request is abnormal:

[0110] Condition 1: The information to be detected matches the permissions of the user role that initiates the deserialization request to be processed;

[0111] For example, the information to be detected indicates that an operation that should only be performed by an administrator role (such as deleting information in a database) needs to be performed, but the user role that initiates the pending deserialization request is not an administrator and does not have the corresponding authority. Therefore, the pending deserialization request may be an attack. Therefore, this embodiment can detect whether the information to be detected matches the authority of the user role that initiates the pending deserialization request. If they do not match, it can be determined that the first sub-detection result indicates that the pending deserialization request is abnormal.

[0112] Specifically, in the behavior pattern library, the correct permission level corresponding to the operations that can be performed through the interface to be processed can be recorded. In this way, the permission level of the user role that initiates the deserialization request to be processed can be compared with the correct permission level. If the correct permission level corresponding to the operation indicated by the information to be detected exceeds the permission level of the user role that initiates the deserialization request to be processed, it can be determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0113] Condition 2: The class to which the object in the information to be detected belongs is consistent with the class in the normal information to be used;

[0114] For example, under normal circumstances, the normal class corresponding to a business interface is User or Order, etc., and if the class to which the object in the information to be detected belongs is java.lang.Runtime or ProcessBuilder, etc., it indicates that the deserialization request may be a deserialization attack. Therefore, the class to which the object in the information to be detected belongs is inconsistent with the class in the normal information to be used, and it can be determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0115] If all the above conditions are met, the first matching result between the attributes of the object in the information to be detected and the attributes in the normal information to be used, and / or the second matching result between the calling order of the function in the information to be detected and the calling order of the function in the normal information to be used can be obtained; and the first sub-detection result is determined based on the obtained matching results.

[0116] Since deserialization attacks may destroy the system's operating logic or implant malicious code by manipulating the values ​​of object attributes, deserialization attacks can be detected based on object attributes.

[0117] The attributes in the normal information to be used may include: the type of the attribute, the numerical range of the attribute, the correct assignment of the attribute, the default value of the attribute, etc. In one implementation, when the attributes in the normal information to be used include the correct assignment, it can be determined whether the attribute of the object represented by the deserialization request to be processed is the correct assignment. For example, in the object User generated by deserialization, the correct assignment of the role attribute is "user" or "admin", but if the attribute of the object User represented by the deserialization request to be processed is "root" or other illegal values, the deserialization request to be processed may be an attack behavior, and it can be determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0118] In the case where the attributes in the normal information to be used include a numerical range, it can be determined whether the attributes of the object in the information to be detected are within the numerical range. For example, the object in the information to be detected is a shopping cart object Cart. If its totalAmount attribute is a negative number or an unreasonable and extremely large value (such as 999999999), the pending deserialization request may be using deserialization to manipulate field values ​​and conduct business logic attacks. Therefore, a numerical range can be set for the attributes of the object, such as 0-99. In this case, if the attributes of the object in the information to be detected are not within the numerical range, it can be determined that the first sub-detection result indicates that the pending deserialization request is abnormal.

[0119] In one implementation, historical attributes of the object can also be obtained, for example, from historical deserialization requests received from the interface to be processed, so as to obtain the attribute changes of the attributes in the current information to be detected compared with the historical attributes, and then accurately match the attribute changes with the attribute changes in the normal information to be used, that is, to determine whether the attribute changes are completely consistent with the attribute changes in the normal information to be used; if they are not completely consistent, it can be determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal. The so-called attribute changes in this embodiment can include changes in the assignment of attributes, and also include changes in the state of the object.

[0120] For example, the information to be detected contains a shopping cart object Order. Under normal circumstances, the attribute changes of this object should be: "to be paid", "payment successful". However, if there is only one attribute "order completed" in the attribute sequence to be matched for this object, but no "to be paid", it may indicate that the attacker is trying to bypass the payment process, that is, the pending deserialization request is abnormal.

[0121] For another example, the pending deserialization request represents a bank account object Account, and the balance attribute of the object should be gradually increased or decreased. Therefore, it can be determined whether the change in the balance attribute in the current pending deserialization request compared with the historical balance attribute is greater than the preset change threshold. If it is greater, it can be determined that the attribute change does not match the attribute change in the normal information to be used, that is, it is determined that the first sub-detection result indicates that the pending deserialization request is abnormal.

[0122] For another example, if the pending deserialization request represents a User object, and the role attribute of the object suddenly changes from "role" to "admin" or "superuser", this may mean that an attacker attempts to use the deserialization operation to conduct an unauthorized attack. In this case, the attribute change in the normal information to be used can represent that the attribute is not allowed to change. Therefore, when the attribute in the current pending deserialization request changes compared to the historical attribute, it can be determined that the first sub-detection result indicates that the pending deserialization request is abnormal.

[0123] In one implementation, the calling order of the functions in the information to be detected can be accurately matched with the calling order of the functions in the normal information to be used, that is, to determine whether the functions required to be called and their calling order in the process of the deserialization operation represented by the deserialization request to be processed are completely consistent with the functions and the calling order in the normal information to be used. If not completely consistent, it can be determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0124] During the deserialization process, some methods (such as the object's constructor, readObject function, readResolve function, etc.) will be automatically called, and attackers may use the order of these functions to tamper with the execution process. In addition, attackers may also use the classes in the Commons Collections (an open source project that provides additional collection classes and algorithms for the Java collection framework) library, such as InvokerTransformer, MethodInvoker, ChainedTransformer, etc., to construct malicious chains (i.e., a sequence of functions that need to be called in the order of calling), and trigger dangerous operations by calling the readObject function or the reflection mechanism. Therefore, it is necessary to detect whether the calling order of functions during the deserialization process conforms to the predefined standard pattern, that is, the function calling order in the correct information.

[0125] For example, during a serialization operation, objects of the Order class should usually be executed in the function call sequence of "reading goods, calculating total price, and checking inventory". If the function call sequence of "reading goods, checking inventory, and calculating total price" appears during the deserialization process, it may mean that the business logic has been tampered with. Therefore, this embodiment can determine whether the call sequence of the functions required to be called during the deserialization operation represented by the pending deserialization request matches the function call sequence in the normal information to be used; if they do not match, it can be determined that the first sub-detection result indicates that the pending deserialization request is abnormal.

[0126] Moreover, through the rewritten deserialization function, the calling order of the functions required for the deserialization operation indicated by the pending deserialization request can be obtained from the relevant stack before the deserialization operation is completed. Therefore, the deserialization attack can be successfully detected before it achieves its attack purpose, and then the execution of the deserialization operation can be terminated, thereby intercepting the deserialization attack.

[0127] If it is determined that the final detection result indicates that the pending deserialization request is abnormal, the deserialization operation indicated by the pending deserialization request can be terminated to avoid losses caused by deserialization attacks. This solution can judge the data carried in the deserialization request before executing the deserialization operation to prevent malicious objects or data with abnormal attributes from being successfully deserialized, thereby preventing malicious code from being executed. At the same time, an abnormal notification can also be issued to the staff.

[0128] In this embodiment, a behavior pattern library is preset for the business interface in advance, and the behavior pattern library records the information of the specified dimension indicated by the normal deserialization request, including the class to which the object represented by the deserialization request belongs, the attributes of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request; and when the deserialization request is a request for a deserialization attack, the information indicated by the deserialization request will not match the normal deserialization request in at least one of the above dimensions. Therefore, when the pending interface receives the pending deserialization request, the present scheme detects the information to be detected indicated by the pending deserialization request based on the normal information to be used corresponding to the pending interface recorded in the preset behavior pattern library to determine whether the pending deserialization request is abnormal. When it is determined that the pending deserialization request is abnormal, it indicates that the pending deserialization request is likely to be a request for a deserialization attack. Therefore, the present scheme can accurately detect deserialization attacks. Prevent data leakage and business logic damage caused by deserialization attacks.

[0129] In addition, the information recorded in the behavior pattern library in this solution is associated with the business interface, so that the business interface can be monitored and abnormal deserialization requests received by the business interface can be detected in time. Therefore, this solution can also be applied to the deserialization interaction scenarios between business modules.

[0130] In an embodiment of the present application, the first matching result and / or the second matching result may also be determined by fuzzy matching. The first matching result includes: a first similarity and / or a second similarity; wherein:

[0131] Methods for determining the first similarity include:

[0132] Step B1, obtaining historical attributes of the object in the information to be detected from the historical deserialization request received by the interface to be processed;

[0133] For an object, multiple deserialization requests may be received, causing the object's properties to change, such as changing from uninitialized to initialized.

[0134] Step B2, combining the acquired historical attributes with the attributes of the object in the information to be detected to obtain a sequence of attributes to be matched;

[0135] Specifically, the historical attributes obtained historically can be combined with the attributes of the object in the information to be detected, and sequence encoding can be performed to obtain the attribute sequence to be matched. For example, the historical attributes and the current attributes can be vectorized first, and then the obtained vectors can be concatenated in sequence to obtain the attribute sequence to be matched.

[0136] Step B3: Calculate the similarity between the attribute sequence to be matched and the attribute sequence in the normal information to be used to obtain a first similarity.

[0137] The behavior pattern library can also record the correct attribute sequence, so that the similarity between the attribute sequence to be matched and the attribute sequence in the normal information to be used can be calculated to obtain the first matching result. Specifically, the similarity of the attribute sequence can be obtained by calculating the cosine distance or the Euclidean distance.

[0138] The second similarity is determined by:

[0139] The similarity between the object in the information to be detected and the attribute in the normal information to be used is calculated to obtain a second similarity.

[0140] For example, if the attribute of the object in the information to be detected is a numerical value, the difference between the attribute of the object in the information to be detected and the attribute in the normal information to be used can be calculated to obtain the first matching result.

[0141] When the attribute of the object represented by the deserialization request to be processed includes multiple values, the Manhattan distance between the attribute of the object represented by the deserialization request to be processed and the attribute in the normal information to be used can also be calculated to obtain a first matching result.

[0142] The second matching result is determined by:

[0143] The similarity between the function sequence representing the calling order of the functions in the information to be detected and the function sequence representing the calling order of the functions in the normal information to be utilized is calculated to obtain a second matching result.

[0144] Similarly, the similarity of the function sequence may also be calculated to obtain a second matching result.

[0145] In this case, determining the first sub-detection result based on the determined similarity includes:

[0146] Step C1, performing weighted addition on the obtained similarities to obtain a total similarity;

[0147] The weight of the similarity of each dimension can be set according to experience and needs, for example, it can be set according to the permission level of the user role that initiated the pending deserialization request. In other words, corresponding weights can be set for different permission levels according to actual conditions, so that after receiving the pending deserialization request, the weight corresponding to each dimension is determined according to the permission level of the user role that initiated the pending deserialization request.

[0148] Step C2: when the total similarity is less than a preset similarity threshold, determining that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

[0149] When the total similarity is not less than the preset similarity threshold, it can be determined that the first sub-detection result indicates that the to-be-processed deserialization request is normal.

[0150] The preset similarity threshold can also be set and adjusted in real time according to experience and needs. For example, it can be set to 0.7. It can also be set according to the permission level of the user role that initiates the deserialization request to be processed. Alternatively, the detection results of the detection model can be analyzed based on statistical methods such as cluster analysis, so as to adjust the preset similarity threshold in real time to ensure the accuracy and recall rate of detecting abnormal deserialization requests.

[0151] In addition, the information in the behavior pattern library can be continuously updated and optimized to continuously adapt to new attacks and improve overall defense capabilities.

[0152] In this embodiment, considering that the information to be detected of a normal deserialization request may deviate from the data recorded in the behavior pattern library within a certain range, this solution also provides a method for calculating similarity to determine the detection result to adapt to the changes in normal deserialization requests, thereby further improving the accuracy of detecting deserialization attacks.

[0153] In one embodiment of the present application, the behavior pattern library also records the exception information to be used corresponding to the interface to be processed; the exception information corresponding to an interface is: information on the dimension of the exception obtained based on the serialized data carried by the abnormal deserialization request received by the interface. Figure 2 As shown, the deserialization attack detection method may also include the following steps:

[0154] S201, determining a business interface that receives a deserialization request to be processed as the interface to be processed;

[0155] S202, based on the serialized data carried by the deserialization request to be processed, extracting information of a specified dimension indicated by the deserialization request to be processed as information to be detected;

[0156] The specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request;

[0157] S203, if the information to be detected matches the abnormal information to be utilized, determining that the deserialization request to be processed is an abnormal request;

[0158] The behavior pattern library can also record the information indicated by the serialized data carried by abnormal deserialization requests, and the information indicated by the serialized data carried by deserialization requests known to be deserialization attacks. Abnormal deserialization requests are requests that may be risky. Both types of deserialization requests can be regarded as abnormal deserialization requests, and the information indicated by the serialized data carried by both types of deserialization requests can be regarded as abnormal information. The behavior pattern library can perform structured storage of normal information and abnormal information, and each piece of information can be stored in a preset standard format to improve the efficiency of subsequent information matching.

[0159] The abnormal information corresponding to an interface may include: abnormal class, abnormal attribute, abnormal function call sequence, abnormal user role, etc. In this embodiment, the information to be detected can be matched with the abnormal information to be used. If there is information of a certain dimension in the information to be detected that matches the information of the dimension in the abnormal information to be used, it can be directly determined that the final detection result indicates that the deserialization request to be processed is abnormal without matching it with normal information.

[0160] For example, if a user role has been determined in advance to be an abnormal user role, the user role can be recorded in the behavior pattern library. In this way, when a pending deserialization request initiated by the user role is received, it can be directly determined that the final detection result represents the pending deserialization request as abnormal. For another example, the normal class corresponding to a business interface is User or Order, etc., and the abnormal class has been determined in advance to be java.lang.Runtime, ProcessBuilder. The abnormal class can be recorded in the behavior pattern library corresponding to the business interface, so that when the class of the object represented by the deserialization request is java.lang.Runtime or ProcessBuilder, it can be directly determined that the final detection result represents the pending deserialization request as abnormal.

[0161] Similarly, information such as the attributes of exceptions, the order of abnormal function calls, etc. can also be recorded in the behavior pattern library.

[0162] When matching the abnormal information, the abnormal user role, abnormal class, abnormal attribute, and abnormal function call sequence may be matched in sequence, and the current matching sequence may not be limited thereto. For example, the matching may be performed in the above-mentioned exact matching manner, or in the above-mentioned fuzzy matching manner. Moreover, each item in the abnormal information may also be prioritized according to importance or credibility, so as to preferentially match an item with a higher priority, thereby improving the matching efficiency.

[0163] S204, when the information to be detected does not match the abnormal information to be used, obtaining a first sub-detection result and / or a second sub-detection result;

[0164] S205: Based on the obtained sub-detection results, determine a final detection result indicating whether the deserialization request to be processed is abnormal.

[0165] This step is similar to the previous one and will not be repeated here.

[0166] In this embodiment, by first matching the information to be detected with the abnormal information to be used, it is determined that the final detection result indicates that the deserialization request to be processed is abnormal. At this time, there is no need to match it with the normal information to be used, which can improve the efficiency of the detection of the deserialization request of this solution. In addition, the information recorded in the behavior pattern library in this embodiment is relatively rich, and the deserialization request can be detected from multiple angles to improve the accuracy of detecting deserialization attacks.

[0167] In one embodiment of the present application, Figure 3 As shown, the method for determining the second sub-detection result includes the following steps:

[0168] S301, vectorizing the data of each dimension in the information to be detected to obtain a vector to be utilized in each dimension of the information to be detected, and vectorizing the user information of the user role that initiates the deserialization request to be processed to obtain a vector to be utilized in the user dimension;

[0169] Specifically, one-hot encoding can be used to convert the class to which the object belongs, the type of the attribute, and the user information into a vector to be used; sequence encoding can be used to convert the function call order and the attribute sequence into a vector to be used; and the attribute values ​​can be directly combined to obtain the vector to be used.

[0170] S302, fusing the obtained vectors to be used to obtain a fusion feature;

[0171] In one implementation, the obtained vectors to be used may be concatenated to obtain fused features. In another implementation, the detection model may include a fusion network, so that the vectors to be used may be input into the fusion network to obtain fused features.

[0172] S303: Use the detection model to detect the fused features to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal.

[0173] This step is similar to the above-mentioned embodiment and will not be described again here.

[0174] In one implementation, the detection model may be a machine learning model, such as a random forest algorithm model, which has good classification performance and anti-overfitting capabilities.

[0175] When training the detection model, a random forest model can be constructed using the machine learning library (scikit-learn) of python (a computer programming language), and the following parameters are set: the number of trees (n_estimators) is set to 100, the maximum depth (max_depth) is set to None, the minimum number of sample splits (min_samples_split) is set to 2, the minimum number of leaf node samples (min_samples_leaf) is set to 1, and the maximum number of features (max_features): set to auto. And the sample information is divided into a training set and a test set (usually in a ratio of 80 / 20 or 70 / 30), where the sample information can contain information of a specified dimension indicated by a deserialized request for which a true result has been determined, including normal information and abnormal information recorded in a behavior pattern library.

[0176] After that, you can perform the following steps:

[0177] For any sample information in the training set, the data of each dimension of the sample information is vectorized to obtain a sample vector of each dimension of the sample information, and the user information of the user role that initiates the deserialization request corresponding to the sample information is vectorized to obtain a sample vector of the user dimension; the obtained sample vectors are fused to obtain fused sample features; the fused sample features are detected using the detection model of the initial structure to obtain a detection result indicating whether the deserialization request corresponding to the sample information is abnormal; the model loss is calculated based on the detection result of the deserialization request corresponding to the sample information and the actual result indicating whether the deserialization request is abnormal; the detection model is adjusted based on the obtained model loss until the model converges to obtain a trained detection model.

[0178] This embodiment introduces a machine learning algorithm that can automatically analyze and learn normal deserialization behavior patterns to detect unknown attacks. In this way, this solution can not only rely on predefined rules, but also discover abnormal behaviors through machine learning models, thereby improving the adaptability and scalability of the business system and being able to detect new or variant attack patterns, especially zero-day attacks, in a timely manner. In addition, through machine learning, the business system has the ability to self-learn and optimize, making protection more intelligent and dynamic.

[0179] In one embodiment of the present application, the deserialization attack detection method also includes, when the preset model update conditions are met, using the deserialization request received during the historical detection process as incremental sample information, and a label indicating whether the deserialization request is abnormal, to perform incremental training on the detection model to obtain an updated detection model, and the labels of these deserialization requests can be manually marked. Incremental Training, also known as Continual Learning or Online Learning, is a machine learning method that refers to the ability of a model to update when new data is received without losing previously learned knowledge. In order to improve the training effect, the incremental sample information may include, during the historical detection process, deserialization requests that were manually determined to be detected by the detection model errors.

[0180] For example, this embodiment can periodically evaluate the performance of the detection model. Specifically, the detection model can be tested with manually determined abnormal deserialization requests and / or normal deserialization requests to determine the accuracy, recall, F1-score and other indicators of the detection model. Alternatively, each time the performance of the detection model is evaluated, the accuracy of the detection model for detecting the received deserialization requests within a preset time period between the current detection moments can be obtained. When the accuracy does not reach a preset threshold, it can be determined that the performance of the detection model does not meet the requirements, and the detection model is then incrementally trained.

[0181] Exemplarily, the incremental training process may include the following steps:

[0182] For each acquired incremental sample information and a label indicating whether the incremental sample information is normal, the data of each dimension contained in the incremental sample information is vectorized to obtain an incremental sample vector of each dimension of the incremental sample information, and the user information of the user role that initiates the deserialization request corresponding to the incremental sample information is vectorized to obtain an incremental sample vector of the user dimension; the obtained incremental sample vectors are fused to obtain fused incremental sample features; the fused incremental sample features are detected using the current detection model to obtain a detection result indicating whether the deserialization request corresponding to the incremental sample information is abnormal; the model loss is calculated based on the detection result of the deserialization request corresponding to the incremental sample information and the label of the incremental sample information; the detection model is parameterized based on the obtained model loss to obtain an updated detection model.

[0183] When it is determined through evaluation that the performance of the detection model does not meet the requirements, the detection model can be incrementally trained. The deserialization request used in each incremental training can be the deserialization request received during the time period from the last incremental training to the current incremental training, but it is not limited to this.

[0184] Furthermore, the performance of the updated detection model can be evaluated. If the performance of the updated detection model is significantly improved,

[0185] The updated detection model is used for subsequent detection, otherwise, the detection model before the update is continued to be used. The updated model version can also be recorded in the model management module to ensure the traceability and flexibility of the model.

[0186] The self-optimization of the model and the detection of the model in this embodiment form a closed loop, which can continuously receive feedback, evaluate performance and optimize the model to deal with new threats and attacks. By dynamically updating and improving the detection model, it can adapt to the ever-changing environment and emerging threats, and improve the accuracy of detecting deserialization attacks.

[0187] In this embodiment, by vectorizing the data of each dimension in the information to be detected, the vector to be used in each dimension of the information to be detected is obtained, and then the obtained vectors to be used are fused to obtain fused features. Finally, the fused features are detected using the detection model to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal, which can realize the detection of the deserialization request to be processed using the model. It can be seen that this scheme performs deserialization attack detection by combining behavioral pattern library matching and machine learning models. The scheme is more flexible and can dynamically detect and prevent malicious deserialization operations, reducing false alarm rates and missed alarm rates. Therefore, this scheme can further improve the accuracy and efficiency of detecting deserialization attacks.

[0188] For ease of understanding, the following takes the deserialization attack detection method applied to the deserialization attack detection program of the backend server as an example. Figure 4 The embodiments of the present application are introduced as follows:

[0189] like Figure 4 As shown, the deserialization attack detection program may include: a behavior pattern standard process module, an information extraction module, a behavior pattern matching module, a machine learning detection module, an online machine learning self-optimization module, a model management module, and a data storage module.

[0190] The behavior pattern standard process module may include the above-mentioned behavior pattern library. The behavior pattern standard process module may also provide a user interface and related API (Application Programming Interface) so that staff can easily add, modify or delete information in the behavior pattern library. A verification mechanism may also be set in the behavior pattern standard process module to ensure the rationality and validity of information when adding or modifying information in the behavior pattern library. The verification mechanism may be set by the developer according to actual conditions.

[0191] The information extraction module is used to rewrite the deserialization function when the application of the business component in the back-end server is started or running, and insert the code for reading the information carried by the deserialization request into the deserialization function. When receiving the pending deserialization request, that is, receiving the serialized data carried by the pending deserialization request, the information of the specified dimension indicated by the pending deserialization request is obtained through the rewritten deserialization function as the information to be detected, including: the class to which the object represented by the pending deserialization request belongs, the attributes of the represented object, the calling order of the function required for the deserialization operation indicated by the deserialization request, the user role that initiated the deserialization request, etc.; then send the recorded behavior to the behavior pattern matching module and the machine learning detection module to support subsequent detection and learning; in addition, the information extraction module can also record any abnormal situation during the deserialization operation, record related error information, and persistently store the obtained information to generate logs for subsequent analysis and auditing to ensure the integrity and traceability of the data.

[0192] The behavior pattern matching module is used to receive data from the information extraction module and confirm the integrity and accuracy of the data; then, the information to be detected is matched with the normal information to be used and the normal information to be used to determine whether the deserialization request to be processed is abnormal. If the information to be detected fails to match the normal information, the deserialization request to be processed is determined to be abnormal. A response mechanism can also be set in the behavior pattern matching module to terminate the current deserialization operation when an abnormality is detected in the deserialization request to be processed, and record a detailed audit log including the received behavior data, matching results, and detection results, etc. At the same time, a notification is sent to the security team, and the acquired information to be detected and the detection results are fed back to the online machine learning self-optimization module.

[0193] The machine learning detection module is used to receive the information to be detected, and to extract and preprocess the features of the information to be detected to obtain the features to be detected, such as vectorizing the data of each dimension in the information to be detected to obtain the vector to be used in each dimension of the information to be detected; fusing the obtained vectors to be used to obtain the fused features, and then inputting the features to be detected into the pre-trained detection model to obtain the detection results of the model; finally, according to the detection results of the model, taking corresponding measures, such as recording logs, sending notifications to the security team, terminating the current deserialization operation, etc. when detecting anomalies, and feeding back the obtained information to be detected and the detection results of the model to the online machine learning self-optimization module, which can also be fed back to the detection model. In addition, the machine learning detection module can also divide the data set used to train the detection model into a training set and a test set according to a preset ratio.

[0194] When the machine learning detection module detects that the deserialization request to be processed is normal, and the behavior pattern matching module successfully matches the information to be detected with the normal information, it can be determined to continue the deserialization operation.

[0195] The online machine learning self-optimization module is used to collect information fed back from the behavior pattern matching module and the machine learning detection module, and regularly analyze the collected information to evaluate the performance of the current detection model; and when it is determined that incremental training is required, fine-tune the parameters of the detection model to obtain an updated model; in addition, the updated detection model can also be evaluated.

[0196] The online machine learning self-optimization module and the machine learning detection module can form a closed loop to continuously receive feedback, evaluate performance and optimize the detection model to respond to new threats and attacks.

[0197] The model management module is used to manage the detection model. The data storage module is used to store the data required by the program, such as information in the behavior pattern library, logs, etc.

[0198] In this embodiment, the deserialization attack detection program can automatically execute the deserialization attack detection method provided in the embodiment of the present application to achieve the detection of deserialization attacks.

[0199] Based on the same inventive concept, the embodiment of the present application also provides a deserialization attack detection device, such as Figure 5 As shown, the device comprises:

[0200] An interface determination module 501 is used to determine a business interface for receiving a to-be-processed deserialization request as an interface to be processed;

[0201] The information extraction module 502 is used to extract information of a specified dimension indicated by the deserialization request to be processed as the information to be detected based on the serialized data carried by the deserialization request to be processed; wherein the specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the calling function required for the deserialization operation indicated by the deserialization request, and the user role initiating the deserialization request;

[0202] The information detection module 503 is used to detect the information to be detected based on the normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library, and obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: the information of the specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

[0203] Optionally, the information detection module 503 includes:

[0204] The detection result acquisition submodule is used to obtain the first sub-detection result and / or the second sub-detection result; wherein the first sub-detection result is obtained by matching the information to be detected with the normal information to be used; the second sub-detection result is obtained by detecting the information to be detected based on a pre-trained detection model; the detection model is obtained by training based on the information recorded in the behavior pattern library;

[0205] The detection result determination submodule is used to determine a final detection result representing whether the to-be-processed deserialization request is abnormal based on the acquired sub-detection results.

[0206] Optionally, the behavior pattern library also records the to-be-utilized exception information corresponding to the to-be-processed interface; the exception information corresponding to an interface is: information on the dimension of the exception obtained based on the serialized data carried by the abnormal deserialization request received by the interface;

[0207] The device further includes: an abnormal information matching module, configured to determine that the final detection result indicates that the deserialization request to be processed is abnormal if the information to be detected matches the abnormal information to be used before the detection result acquisition submodule acquires the first sub-detection result and / or the second sub-detection result;

[0208] The detection result acquisition submodule is specifically used for:

[0209] In the case that the information to be detected does not match the abnormal information to be used, a first sub-detection result and / or a second sub-detection result are obtained.

[0210] Optionally, the detection result acquisition submodule is specifically used to: if at least one of the following conditions is not met, determine that the first sub-detection result indicates that the deserialization request to be processed is abnormal: the information to be detected matches the permissions of the user role that initiates the deserialization request to be processed; the class to which the object in the information to be detected belongs is consistent with the class in the normal information to be used; if all of the above conditions are met, obtain the attributes of the object in the information to be detected, and a first matching result with the attributes in the normal information to be used, and / or, the calling order of the function in the information to be detected, and a second matching result with the calling order of the function in the normal information to be used; determine the first sub-detection result based on the obtained matching results.

[0211] Optionally, the first matching result includes: a first similarity and / or a second similarity; the detection result acquisition submodule is specifically used to: obtain historical attributes of the object in the information to be detected from the historical deserialization request received by the interface to be processed; combine the acquired historical attributes with the attributes of the object in the information to be detected to obtain a sequence of attributes to be matched; calculate the similarity between the sequence of attributes to be matched and the sequence of attributes in the normal information to be used to obtain a first similarity; calculate the similarity between the attributes of the object represented by the deserialization request to be processed and the attributes in the normal information to be used to obtain a second similarity.

[0212] Optionally, the detection result acquisition submodule is specifically used to: calculate the similarity between the function sequence representing the calling order of the functions in the information to be detected and the function sequence representing the calling order of the functions in the normal information to be used, to obtain a second matching result.

[0213] Optionally, the detection result acquisition submodule is specifically used to:

[0214] The obtained similarities are weightedly added to obtain a total similarity; when the total similarity is less than a preset similarity threshold, it is determined that the first sub-detection result indicates that the to-be-processed deserialization request is abnormal.

[0215] Optionally, the detection result acquisition submodule includes:

[0216] A data vectorization unit, used for performing vectorization processing on the data of each dimension in the information to be detected, so as to obtain a vector to be used of each dimension in the information to be detected;

[0217] A fusion unit, used for fusing the obtained vectors to be used to obtain fusion features;

[0218] The detection unit is used to detect the fusion feature using the detection model to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal.

[0219] Optionally, the device also includes: a model update module, which is used to use the deserialization requests received during the historical detection process and the actual results indicating whether the deserialization request is abnormal to perform incremental training on the detection model to obtain an updated detection model when the preset model update conditions are met.

[0220] Optionally, the information extraction module 502 is specifically configured to:

[0221] By calling the rewritten deserialization function, based on the serialized data carried by the deserialization request to be processed, the information of the specified dimension indicated by the deserialization request to be processed is extracted as the information to be detected; wherein the rewritten deserialization function is obtained by pre-inserting the code for reading the information carried by the deserialization request into the initial deserialization function.

[0222] The present application also provides an electronic device, such as Figure 6 As shown, including:

[0223] Memory 601, used for storing computer programs;

[0224] The processor 602 is configured to implement any of the steps of the above-mentioned deserialization attack detection method when executing the program stored in the memory 601.

[0225] Furthermore, the electronic device may further include a communication bus and / or a communication interface, and the processor 602, the communication interface, and the memory 601 communicate with each other via the communication bus.

[0226] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0227] The communication interface is used for communication between the above electronic device and other devices.

[0228] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0229] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0230] In another embodiment provided by the present application, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned deserialization attack detection methods are implemented.

[0231] In another embodiment provided by the present application, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute any deserialization attack detection method in the above embodiments.

[0232] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a solid-state hard disk (SSD), etc.

[0233] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0234] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, electronic device, and readable storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0235] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. A deserialization attack detection method, characterized in that: The method comprises: Determine the business interface that receives the pending deserialization request as the pending interface; Based on the serialized data carried by the pending deserialization request, extract the information of the specified dimension indicated by the pending deserialization request as the information to be detected; wherein the specified dimension includes at least one of the following: the class to which the object represented by the deserialization request belongs, the attribute of the represented object, the calling order of the calling function required for the deserialization operation indicated by the deserialization request, and the user role that initiates the deserialization request; Based on the normal information to be used corresponding to the interface to be processed recorded in the preset behavior pattern library, the information to be detected is detected to obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: the information of the specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

2. The method according to claim 1, characterized in that The normal information to be utilized corresponding to the interface to be processed recorded in the preset behavior pattern library is used to detect the information to be detected, and a final detection result characterizing whether the deserialization request to be processed is abnormal is obtained, including: Obtaining a first sub-detection result and / or a second sub-detection result; wherein the first sub-detection result is obtained by matching the information to be detected with the normal information to be used; the second sub-detection result is obtained by detecting the information to be detected based on a pre-trained detection model; the detection model is obtained by training based on the information recorded in the behavior pattern library; Based on the obtained sub-detection results, a final detection result characterizing whether the to-be-processed deserialization request is abnormal is determined.

3. The method according to claim 2, characterized in that The behavior pattern library also records the to-be-used exception information corresponding to the to-be-processed interface; the exception information corresponding to an interface is: information on the dimension of the exception obtained based on the serialized data carried by the abnormal deserialization request received by the interface; Before obtaining the first sub-detection result and / or the second sub-detection result, the method further includes: If the information to be detected matches the abnormal information to be utilized, determining that the final detection result indicates that the deserialization request to be processed is abnormal; The obtaining of the first sub-detection result and / or the second sub-detection result includes: In the case that the information to be detected does not match the abnormal information to be used, a first sub-detection result and / or a second sub-detection result are obtained.

4. The method according to claim 2 or 3, characterized in that: The method for determining the first sub-detection result comprises the following steps: If at least one of the following conditions is not met, it is determined that the first sub-detection result indicates that the pending deserialization request is abnormal: The information to be detected matches the authority of the user role that initiates the deserialization request to be processed; The class to which the object in the information to be detected belongs is consistent with the class in the normal information to be used; If all the above conditions are met, a first matching result between the attribute of the object in the information to be detected and the attribute in the normal information to be used, and / or a second matching result between the calling sequence of the function in the information to be detected and the calling sequence of the function in the normal information to be used is obtained; A first sub-detection result is determined based on the acquired matching result.

5. The method according to claim 4, characterized in that The first matching result includes: a first similarity and / or a second similarity; wherein: The method for determining the first similarity includes: Obtaining historical attributes of the object in the information to be detected from the historical deserialization request received by the interface to be processed; Combining the acquired historical attributes with the attributes of the object in the information to be detected to obtain a sequence of attributes to be matched; Calculating the similarity between the attribute sequence to be matched and the attribute sequence in the normal information to be used to obtain a first similarity; The second similarity is determined in the following manner: Calculating the similarity between the attribute of the object in the information to be detected and the attribute in the normal information to be used to obtain a second similarity; and / or, The method for determining the second matching result includes: The similarity between the function sequence representing the calling order of the functions in the information to be detected and the function sequence representing the calling order of the functions in the normal information to be utilized is calculated to obtain a second matching result.

6. The method according to claim 5, characterized in that The determining the first sub-detection result based on the acquired matching result includes: The obtained similarities are weighted added to obtain the total similarity; When the total similarity is less than a preset similarity threshold, it is determined that the first sub-detection result indicates that the deserialization request to be processed is abnormal.

7. The method according to claim 2, characterized in that: The method for determining the second sub-detection result comprises the following steps: Performing vectorization processing on the data of each dimension in the information to be detected to obtain a vector to be used of each dimension in the information to be detected; The obtained vectors to be used are fused to obtain fusion features; The fusion feature is detected using the detection model to obtain a second sub-detection result indicating whether the deserialization request to be processed is abnormal.

8. The method according to claim 7, characterized in that The method also includes, when a preset model update condition is met, using a deserialization request received during a historical detection process and a real result indicating whether the deserialization request is abnormal, to perform incremental training on the detection model to obtain an updated detection model.

9. The method according to claim 1, characterized in that: The extracting, based on the serialized data carried by the deserialization request to be processed, information of a specified dimension indicated by the deserialization request to be processed as information to be detected includes: By calling the rewritten deserialization function, based on the serialized data carried by the deserialization request to be processed, the information of the specified dimension indicated by the deserialization request to be processed is extracted as the information to be detected; wherein the rewritten deserialization function is obtained by pre-inserting the code for reading the information carried by the deserialization request into the initial deserialization function.

10. A deserialization attack detection device, characterized in that: The device comprises: An interface determination module, used to determine a business interface for receiving a deserialization request to be processed as an interface to be processed; An information extraction module is used to extract information of a specified dimension indicated by a pending deserialization request based on serialized data carried by the pending deserialization request as information to be detected; wherein the specified dimension includes at least one of the following: a class to which an object represented by the deserialization request belongs, an attribute of the represented object, a calling sequence of functions required for a deserialization operation indicated by the deserialization request, and a user role that initiates the deserialization request; An information detection module is used to detect the information to be detected based on the normal information to be used corresponding to the interface to be processed recorded in a preset behavior pattern library, and obtain a final detection result characterizing whether the deserialization request to be processed is abnormal; wherein, the normal information corresponding to an interface is: the information of the specified dimension obtained based on the serialized data carried by the normal deserialization request received by the interface.

11. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 1-9 when executing a program stored in a memory.

12. A computer program product comprising instructions, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the method according to any one of claims 1 to 9.

Images