Application detection method and device based on RASP system

Abstract

The invention provides an application detection method and device based on an RASP system, and relates to the technical field of computers. According to the method, whether the security logic of a current detection node is executed or not is dynamically determined by calculating the current detection time consumption (namely the accumulated time consumption of executed detection nodes) of a target request and a preset total detection time consumption upper limit in real time. And when accumulated time consumption approaches an upper limit, subsequent detection nodes are automatically skipped, dynamic decision of security detection is realized, and performance overhead can be remarkably reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technologies, and in particular, to an application detection method and device based on a RASP system. Background Art

[0002] As the security threats faced by network applications become increasingly complex, the Runtime Application Self-Protection (RASP) technology has gradually become the core means of application security protection due to its ability to embed in the application process and intercept attacks in real time. Traditional RASP systems inject security detection logic by instrumenting key detection nodes (such as file reading and writing, network requests, database operations, etc.) to perform full-link security detection on each passing request.

[0003] However, the security logic at each detection node of the existing RASP technology will generate calculations and consume a certain amount of computing resources. Considering that RASP products are usually deployed in the production environment with a large system throughput, in high-concurrency scenarios, full-scale detection will accumulate significant delays, resulting in the deterioration of the application response time and even triggering a service avalanche. Summary of the Invention

[0004] Embodiments of the present disclosure at least provide an application detection method and device based on a RASP system to solve the problem that security detection under the RASP system affects the system performance.

[0005] In a first aspect, embodiments of the present disclosure provide an application detection method based on a RASP system, which is applied to a Runtime Application Self-Protection (RASP) system. The method includes: Instrument multiple detection nodes of a target application and write the security detection logic corresponding to the detection nodes; When responding to a target request at a first detection node, determine the current detection time consumption of the target request and the upper limit of the total detection time consumption corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time consumption is the sum of the time consumed for detection when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node; Based on the current detection time consumption and the upper limit of the total detection time consumption, determine whether to detect the response process of the first detection node for the target request; In the case of determining to detect the response process of the first detection node for the target request, execute the security detection logic corresponding to the first detection node.

[0006] In an alternative embodiment, determining whether to detect the response process of the first detection node for the target request based on the current detection time consumption and the upper limit of the total detection time consumption includes: When the current detection time consumption is less than the upper limit of the total detection time consumption, determine to detect the response process of the first detection node for the target request.

[0007] In an alternative embodiment, determining whether to detect the response process of the first detection node for the target request based on the current detection time consumption and the upper limit of the total detection time consumption includes: When the current detection time consumption is less than the upper limit of the total detection time consumption, determine the detection priority corresponding to the target request; Based on the detection strategy corresponding to the detection priority, determine whether to detect the response process of the first detection node for the target request.

[0008] In an alternative embodiment, determining whether to detect the response process of the first detection node for the target request based on the detection strategy corresponding to the detection priority includes: Determine the upper limit of the single detection time consumption indicated by the detection strategy; and, based on the upper limit of the total detection time consumption and the current detection time consumption, determine the remaining detection duration of the target request; When the remaining detection duration is greater than or equal to the upper limit of the single detection time consumption, determine to detect the response process of the first detection node for the target request.

[0009] In an alternative embodiment, the method further includes: During the process of executing the security detection logic corresponding to the first detection node, monitor the target duration consumed by the first detection node to detect the target request; When the target duration is greater than or equal to the upper limit of the single detection time consumption, terminate the execution of the security detection logic; and / or, When the sum of the target duration and the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption, terminate the execution of the security detection logic.

[0010] In an alternative embodiment, determining whether to detect the response process of the first detection node for the target request based on the detection strategy corresponding to the detection priority includes: Based on the attribute information of the first detection node, determine whether the first detection node matches the target type detection node indicated by the detection strategy; In the case where the first detection node matches the target type detection node indicated by the detection policy, determine the response process of the first detection node for the target request.

[0011] In an alternative embodiment, the target type detection node includes at least one of the following: A detection node whose risk level meets a first preset condition; a detection node whose detection time length meets a second preset condition; a detection node whose historical hit frequency meets a third preset condition.

[0012] In an alternative embodiment, the determining the detection priority corresponding to the target request includes: Determine the detection priority corresponding to the target request based on the ratio of the current detection time to the upper limit of the total detection time.

[0013] In an alternative embodiment, the target request carries detection context; the detection context includes at least one of the following: The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; the detection priority corresponding to the target request; the detection policy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection policy; the target type detection node indicated by the detection policy.

[0014] In an alternative embodiment, the determining whether to detect the response process of the first detection node for the target request based on the current detection time and the upper limit of the total detection time includes: In the case where the current detection time is greater than or equal to the upper limit of the total detection time, determine not to detect the response process of the first detection node for the target request.

[0015] In a second aspect, an application detection device based on a RASP system provided by an embodiment of the present disclosure includes: An instrumentation module, configured to instrument multiple detection nodes of a target application and write the security detection logic corresponding to the detection nodes; A determination module, configured to determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request when a first detection node responds to the target request; the first detection node is the detection node currently responding to the target request; the current detection time is the sum of the detection time consumed when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node; A judgment module, configured to determine whether to detect the response process of the first detection node for the target request based on the current detection time consumption and the upper limit of the total detection time consumption; A detection module, configured to execute the security detection logic corresponding to the first detection node when it is determined to detect the response process of the first detection node for the target request.

[0016] In an optional implementation manner, the judgment module is specifically configured to: When the current detection time consumption is less than the upper limit of the total detection time consumption, determine to detect the response process of the first detection node for the target request.

[0017] In an optional implementation manner, the judgment module is specifically configured to: When the current detection time consumption is less than the upper limit of the total detection time consumption, determine the detection priority corresponding to the target request; Based on the detection strategy corresponding to the detection priority, determine whether to detect the response process of the first detection node for the target request.

[0018] In an optional implementation manner, the judgment module is specifically configured to: Determine the upper limit of the single detection time consumption indicated by the detection strategy; and, based on the upper limit of the total detection time consumption and the current detection time consumption, determine the remaining detection duration of the target request; When the remaining detection duration is greater than or equal to the upper limit of the single detection time consumption, determine to detect the response process of the first detection node for the target request.

[0019] In an optional implementation manner, the device further includes a termination module, configured to: During the process of executing the security detection logic corresponding to the first detection node, monitor the target duration consumed by the first detection node to detect the target request; When the target duration is greater than or equal to the upper limit of the single detection time consumption, terminate the execution of the security detection logic; and / or, when the sum of the target duration and the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption, terminate the execution of the security detection logic.

[0020] In an optional implementation manner, the judgment module is specifically configured to: Based on the attribute information of the first detection node, determine whether the first detection node matches the target type detection node indicated by the detection strategy; When the first detection node matches the target type detection node indicated by the detection strategy, determine to detect the response process of the first detection node for the target request.

[0021] In an alternative implementation, the target type detection node includes at least one of the following: A detection node whose risk level meets a first preset condition; a detection node whose detection time length meets a second preset condition; a detection node whose historical hit frequency meets a third preset condition.

[0022] In an alternative implementation, the determination module is specifically configured to: Determine the detection priority corresponding to the target request based on the ratio of the current detection time to the upper limit of the total detection time.

[0023] In an alternative implementation, the target request carries detection context; the detection context includes at least one of the following: The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; the detection priority corresponding to the target request; the detection strategy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection strategy; the target type detection node indicated by the detection strategy.

[0024] In an alternative implementation, the determination module is specifically configured to: In the case where the current detection time is greater than or equal to the upper limit of the total detection time, determine not to detect the response process of the first detection node for the target request.

[0025] In a third aspect, an alternative implementation of the present disclosure further provides a computer device, including a processor and a memory. The memory stores machine-readable instructions executable by the processor. The processor is configured to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the machine-readable instructions execute the steps in the first aspect or any possible implementation manner in the first aspect.

[0026] In a fourth aspect, an alternative implementation of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run, it executes the steps in the first aspect or any possible implementation manner in the first aspect.

[0027] For the effect description of the above application detection device, computer device, and computer-readable storage medium based on the RASP system, refer to the description of the application detection method based on the RASP system, which will not be elaborated here.

[0028] It should be understood that the above general description and subsequent detailed description are only exemplary and explanatory, and do not limit the technical solution of the present disclosure.

[0029] The application detection method and device based on the RASP system provided by the embodiments of the present disclosure dynamically determine whether to execute the security logic of the current detection node by calculating the current detection time consumption of the target request (i.e., the cumulative time consumption of the executed detection nodes) in real time and the preset upper limit of the total detection time consumption. When the cumulative time consumption approaches the upper limit, the subsequent detection nodes are automatically skipped, realizing the dynamic decision-making of security detection and significantly reducing the performance overhead.

[0030] To make the above objects, features, and advantages of the present disclosure more obvious and understandable, the following specific preferred embodiments are given in conjunction with the accompanying drawings and described in detail as follows. Description of the Drawings

[0031] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the accompanying drawings required for use in the embodiments will be briefly introduced below. The accompanying drawings herein are incorporated into the specification and form a part of this specification. These drawings show embodiments that conform to the present disclosure and are used together with the specification to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only show some embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative efforts.

[0032] Figure 1 Shows the flowchart of an application detection method based on the RASP system provided by some embodiments of the present disclosure; Figure 2 Shows the flowchart of another application detection method based on the RASP system provided by some embodiments of the present disclosure; Figure 3 Shows the schematic diagram of an application detection device based on the RASP system provided by some embodiments of the present disclosure; Figure 4 Shows the schematic diagram of a computer device provided by some embodiments of the present disclosure. Detailed Embodiments

[0033] To make the objects, technical solutions, and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all the embodiments. Usually, the components of the embodiments of the present disclosure described and shown here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure is not intended to limit the scope of the present disclosure to be protected, but only represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present disclosure.

[0034] It has been found through research that the security logic of existing RASP technologies generates computations at each detection node, consuming a certain amount of computing resources. Considering that RASP products are usually deployed in production environments with high system throughput, in high-concurrency scenarios, full-scale detection will accumulate significant delays, leading to deterioration of application response time and even triggering service avalanches.

[0035] Furthermore, due to the complexity of applications and RASP systems, it is difficult to evaluate the impact of each detection node on the system's execution performance, and it is also not easy to evaluate the detection nodes that a request will pass through, making it impossible to individually restrict specific detection nodes. When performing rate-limiting detection based on the number of Hooks for a single request, after reaching the rate-limiting threshold, all subsequent detection nodes that the request passes through are skipped, resulting in a serious decline in the protection performance of the RASP system in a short period of time and even rendering security detection unavailable.

[0036] Based on the above research, the present disclosure provides an application detection method and device based on a RASP system, which dynamically determines whether to execute the security logic of the current detection node by calculating in real time the current detection time consumption of the target request (i.e., the cumulative time consumption of the executed detection nodes) and the preset upper limit of the total detection time consumption. When the cumulative time consumption approaches the upper limit, subsequent detection nodes can be automatically skipped, realizing dynamic decision-making for security detection and significantly reducing performance overhead.

[0037] Regarding the defects existing in the above solutions, they are all the results obtained by the inventors through practice and careful research. Therefore, the process of discovering the above problems and the solutions proposed by the present disclosure for the above problems in the following text should both be the contributions made by the inventors to the present disclosure during the process of the present disclosure.

[0038] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0039] To facilitate the understanding of this embodiment, first, a detailed introduction is given to an application detection method based on a RASP system disclosed in the embodiments of the present disclosure. The execution subject of the application detection method based on a RASP system provided in the embodiments of the present disclosure is generally a computer device with certain computing capabilities, such as a terminal device, a server, or other processing devices. In some possible implementation manners, the application detection method based on a RASP system can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0040] The following takes the execution subject as a server as an example to illustrate the application detection method based on a RASP system provided in the embodiments of the present disclosure.

[0041] SeeFigure 1 As shown in the figure, it is a flowchart of an application detection method based on the RASP system provided by an embodiment of the present disclosure. The method can be applied to the RASP system, and the method includes steps S101 to S104, where: S101: Instrument multiple detection nodes of the target application and write the security detection logic corresponding to the detection nodes.

[0042] Among them, the target application can refer to an application program deployed with the RASP system. For example, it can be a Web application, an Application Programming Interface (API) service, or a microservice exposed to the Internet environment, etc.

[0043] The RASP system is a Runtime Application Self-Protection system. RASP is a security protection technology built into the application program. By analyzing the behavior and context of the application during runtime, it can identify and block attacks in real time. This system usually has functions such as real-time monitoring and defense, context awareness, digital supply chain risk monitoring, and API security enhancement.

[0044] The above detection nodes can refer to anchor points for implanting security detection logic at key positions in the application execution flow (such as method calls, system API access points). Exemplarily, it can include input / output nodes (such as HTTP request entrances), data processing nodes, system command nodes (such as process creation points), file operation nodes (such as file read / write points), etc. The high-risk operation paths can be preferentially covered according to the attack surface analysis of the application architecture.

[0045] Instrumentation can refer to a deployment method of dynamically implanting monitoring code at the detection nodes through bytecode operation technology without modifying the original source code. Exemplarily, it can be achieved by rewriting the bytecode of the Class file, rewriting intermediate language instructions, importing hooks (Hook), etc.

[0046] The above security detection logic can refer to a dynamic protection algorithm executed at the detection nodes, which can realize functions such as generating security detection files, identifying and blocking attack behaviors.

[0047] In this step, the instrumentation function of the RASP system can be used to instrument multiple detection nodes of the target application.

[0048] S102. When responding to a target request at a first detection node, determine the current detection time consumed by the target request and the upper limit of the total detection time consumed corresponding to the target request. The first detection node is the detection node currently responding to the target request. The current detection time consumed is the sum of the detection times consumed when each second detection node responds to the target request. The second detection node is the detection node that responded to the target request before the first detection node.

[0049] Among them, the above target request can be any request that the target application is currently responding to or preparing to respond to. This request can come from the client corresponding to the target application. Specifically, the target request can also refer to an application request instance being monitored by the RASP system (such as an HTTP request, a Remote Procedure Call (RPC)).

[0050] The above first detection node can refer to the node position in the target request execution flow where security detection is about to be triggered. The second detection node can refer to the sequence of detection nodes that have completed the execution of the target request before the first detection node.

[0051] The above current detection time consumed can refer to the cumulative value of the execution time consumed by the security logic of all second detection nodes from the start of the target request to the trigger of the current first detection node. The upper limit of the total detection time consumed can refer to the maximum time threshold allowed for the security detection logic to consume for a single request. This upper limit of the total detection time consumed can be configured in advance or set dynamically according to the actual situation.

[0052] The above current detection time consumed and the upper limit of the total detection time consumed can be calculated in real time or determined by means such as looking up a table and reading. In a possible implementation manner, a detection context can be deployed for the target request. The detection context can store relevant information about the target request (such as the current detection time consumed and the upper limit of the total detection time consumed). At each detection node, the content of the detection context of the target request can be read and maintained through security detection logic or other code.

[0053] S103. Based on the current detection time consumed and the upper limit of the total detection time consumed, determine whether to detect the response process of the first detection node for the target request.

[0054] In this step, it can be determined whether it is necessary to detect the target request at this first detection node according to the current detection time consumed and the upper limit of the total detection time consumed. Exemplarily, it can be determined according to the difference between the upper limit of the total detection time consumed and the current detection time consumed, or the ratio of the current detection time consumed to the upper limit of the total detection time consumed.

[0055] For example, when the current detection time consumption is less than the upper limit of the total detection time consumption, it is possible to directly determine the response process of detecting the first detection node for the target request.

[0056] Alternatively, when the current detection time consumption is less than the upper limit of the total detection time consumption, it is also possible to first determine the detection priority corresponding to the target request; and then, based on the detection strategy corresponding to the detection priority, determine whether to detect the response process of the first detection node for the target request.

[0057] Exemplarily, it is possible to first determine the upper limit of the single detection time consumption indicated by the detection strategy; and, based on the upper limit of the total detection time consumption and the current detection time consumption, determine the remaining detection duration of the target request. When the remaining detection duration is greater than or equal to the upper limit of the single detection time consumption, determine to detect the response process of the first detection node for the target request.

[0058] Among them, multiple detection priorities can be preset in advance, and different detection priorities can correspond to different detection strategies. The detection priority of the target request can be pre-configured or dynamically configured according to specific circumstances.

[0059] The detection strategy of the above detection priority can indicate the upper limit of the single detection time consumption. The upper limit of the single detection time consumption can refer to the maximum time budget allowed for a single detection node to execute the security detection logic. When the detection time consumption of this detection node exceeds this threshold, a dynamic fusing mechanism can be triggered. When determining whether a detection node needs to be detected, it is possible to first determine whether the remaining detection duration of the target request meets the upper limit of the single detection time consumption, that is, to predict whether the current detection node can complete the current security detection.

[0060] In another possible implementation manner, the detection strategy can indicate the type of the detection node that needs to perform security detection. The detection strategy can directly indicate the target type detection node. According to the attribute information of the first detection node, it can be determined whether the first detection node matches the target type detection node indicated by the detection strategy. When the first detection node matches the target type detection node indicated by the detection strategy, determine to detect the response process of the first detection node for the target request.

[0061] Exemplarily, the target type detection node includes at least one of the following: A detection node whose risk level meets the first preset condition; a detection node whose detection time consumption length meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

[0062] Correspondingly, the attribute information of the first detection node can include any one of the risk level, the detection time consumption length, and the historical hit frequency.

[0063] In this way, by dividing the detection priorities, the detection nodes can be classified according to different dimensions, so as to select the detection nodes that need to be detected.

[0064] In a possible implementation manner, one or more of the detection priorities corresponding to the above target request, the detection strategies corresponding to the detection priorities, the upper limit of the single detection time consumed indicated by the detection strategies, and the detection nodes of the target type indicated by the detection strategies may also be stored in the detection context of the target request. The above information can also be modified in real time.

[0065] S104. When it is determined to detect the response process of the first detection node for the target request, execute the security detection logic corresponding to the first detection node.

[0066] When it is determined to detect the first detection node, the security detection logic corresponding to the first detection node can be executed, thereby realizing functions such as generating a security detection file, identifying and blocking attack behaviors.

[0067] Correspondingly, when the current detection time is greater than or equal to the total detection time upper limit, it can be determined not to detect the response process of the first detection node for the target request.

[0068] Alternatively, when the current detection time is greater than or equal to the total detection time upper limit, it is also possible to further determine whether detection is required according to one or more of the information such as the time margin ratio, the node risk level, the request threat index, and the system load pressure.

[0069] In a possible implementation manner, when executing the security detection logic corresponding to the first detection node, the target time consumed by the first detection node for detecting the target request can be monitored in real time. When the target time is greater than or equal to the upper limit of the single detection time consumed, the execution of the security detection logic can be terminated. Specifically, the above termination of the execution of the security monitoring logic may mean that after completing the security monitoring logic corresponding to the first monitoring node, the security monitoring logic corresponding to the subsequent monitoring nodes is no longer executed.

[0070] When the sum of the above target time and the above current detection time is greater than or equal to the total detection time upper limit, the execution of the security detection logic can also be terminated.

[0071] Furthermore, when the system determines not to perform detection, or terminate detection, or perform normal testing, a structured log can be generated for offline analysis, so as to optimize parameters such as the current detection time of the target request, the total detection time upper limit corresponding to the target request, the detection priority corresponding to the target request, the detection strategy corresponding to the detection priority, the upper limit of the single detection time consumed indicated by the detection strategy, and the detection nodes of the target type indicated by the detection strategy.

[0072] In this way, by calculating in real time the current detection time consumption of the target request (i.e., the cumulative time consumption of the executed detection nodes) and the preset upper limit of the total detection time consumption, it is dynamically determined whether to execute the security logic of the current detection node. When the cumulative time consumption approaches the upper limit, subsequent detection nodes can be automatically skipped to achieve dynamic decision-making for security detection, which can significantly reduce performance overhead.

[0073] Moreover, it can ensure that the protection ability of the RASP system is maximally retained without seriously affecting the target application.

[0074] See Figure 2 As shown, it is a flowchart of another application detection method based on the RASP system provided by an embodiment of the present disclosure. When receiving a request, the method first initializes the detection context of the request according to the preset configuration. When the request enters a detection node, it first determines whether time-consuming fusing has occurred (i.e., whether the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption). If time-consuming fusing has occurred, the detection of this detection node is directly skipped; if time-consuming fusing has not occurred, the execution level (i.e., detection priority) of the detection can be determined from the detection context information, and it is judged whether the remaining time meets the conditions for executing the test. If the remaining time is insufficient, the detection of this detection node is directly skipped; if the remaining time is sufficient, the detection is executed. During the execution of the detection, the execution time can be monitored in real time. If the single-detection time consumption upper limit is exceeded, time-consuming fusing can be entered; if the execution time exceeds the upper limit of the total detection time consumption, time-consuming fusing can also be entered. Finally, the logs of the entire protection process can be collected for offline use.

[0075] Those skilled in the art can understand that in the above method of the specific implementation manner, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined according to its function and possible internal logic.

[0076] Based on the same inventive concept, an application detection device based on the RASP system corresponding to the application detection method based on the RASP system is also provided in an embodiment of the present disclosure. Since the principle of solving problems by the device in the embodiment of the present disclosure is similar to that of the above application detection method based on the RASP system in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be described again.

[0077] Refer to Figure 3 As shown, it is a schematic diagram of an application detection device based on the RASP system provided by an embodiment of the present disclosure. The device includes: A stubbing module 310, configured to stub multiple detection nodes of a target application and write the security detection logic corresponding to the detection nodes; A determination module 320, configured to determine the current detection time taken for a target request when a first detection node responds to the target request, and the upper limit of the total detection time taken corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time taken is the sum of the detection times taken when each second detection node responds to the target request; the second detection node is the detection node that responded to the target request before the first detection node. A judgment module 330, configured to determine whether to detect the response process of the first detection node for the target request based on the current detection time taken and the upper limit of the total detection time taken. A detection module 340, configured to execute the security detection logic corresponding to the first detection node when it is determined to detect the response process of the first detection node for the target request.

[0078] In an optional implementation manner, the judgment module 330 is specifically configured to: When the current detection time taken is less than the upper limit of the total detection time taken, determine to detect the response process of the first detection node for the target request.

[0079] In an optional implementation manner, the judgment module 330 is specifically configured to: When the current detection time taken is less than the upper limit of the total detection time taken, determine the detection priority corresponding to the target request; Based on the detection strategy corresponding to the detection priority, determine whether to detect the response process of the first detection node for the target request.

[0080] In an optional implementation manner, the judgment module 330 is specifically configured to: Determine the upper limit of the single detection time taken indicated by the detection strategy; and, based on the upper limit of the total detection time taken and the current detection time taken, determine the remaining detection time of the target request; When the remaining detection time is greater than or equal to the upper limit of the single detection time taken, determine to detect the response process of the first detection node for the target request.

[0081] In an optional implementation manner, the device further includes a termination module, configured to: During the process of executing the security detection logic corresponding to the first detection node, monitor the target time taken for the first detection node to detect the target request. When the target duration is greater than or equal to the upper limit of the single detection time consumption, terminate the execution of the security detection logic; and / or, when the sum of the target duration and the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption, terminate the execution of the security detection logic.

[0082] In an alternative embodiment, the determining module 330 is specifically configured to: Based on the attribute information of the first detection node, determine whether the first detection node matches the target type detection node indicated by the detection policy; When the first detection node matches the target type detection node indicated by the detection policy, determine the response process of the first detection node for the target request.

[0083] In an alternative embodiment, the target type detection node includes at least one of the following: A detection node whose risk level meets the first preset condition; a detection node whose detection time consumption length meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

[0084] In an alternative embodiment, the determining module 330 is specifically configured to: Based on the ratio of the current detection time consumption to the upper limit of the total detection time consumption, determine the detection priority corresponding to the target request.

[0085] In an alternative embodiment, the target request carries detection context; the detection context includes at least one of the following: The current detection time consumption of the target request; the upper limit of the total detection time consumption corresponding to the target request; the detection priority corresponding to the target request; the detection policy corresponding to the detection priority; the upper limit of the single detection time consumption indicated by the detection policy; the target type detection node indicated by the detection policy.

[0086] In an alternative embodiment, the determining module 330 is specifically configured to: When the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption, determine not to detect the response process of the first detection node for the target request.

[0087] For the processing flow of each module in the device and the interaction flow between modules, reference can be made to the relevant descriptions in the above method embodiments, which will not be elaborated here.

[0088] This disclosure embodiment also provides a computer device, as Figure 4 shown, which is the structural schematic diagram of the computer device provided by this disclosure embodiment, including: A processor 41 and a memory 42; the memory 42 stores machine-readable instructions executable by the processor 41. The processor 41 is configured to execute the machine-readable instructions stored in the memory 42. When the machine-readable instructions are executed by the processor 41, the processor 41 performs the following steps: Instrument multiple detection nodes of the target application and write the security detection logic corresponding to the detection nodes. When the first detection node responds to a target request, determine the current detection time consumption of the target request and the upper limit of the total detection time consumption corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time consumption is the sum of the detection time consumed when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node. Based on the current detection time consumption and the upper limit of the total detection time consumption, determine whether to detect the response process of the first detection node to the target request. In the case of determining to detect the response process of the first detection node to the target request, execute the security detection logic corresponding to the first detection node.

[0089] The above-mentioned memory 42 includes a memory 421 and an external memory 422; here, the memory 421 is also called an internal memory, which is used to temporarily store the operation data in the processor 41 and the data exchanged with the external memory 422 such as a hard disk. The processor 41 exchanges data with the external memory 422 through the memory 421.

[0090] For the specific execution process of the above instructions, reference can be made to the steps of the application detection method based on the RASP system described in the embodiments of the present disclosure, which will not be elaborated here.

[0091] The embodiments of the present disclosure further provide a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the steps of the application detection method based on the RASP system described in the above method embodiments. Among them, the storage medium can be a volatile or non-volatile computer-readable storage medium.

[0092] The embodiments of the present disclosure further provide a computer program product, which carries program codes. The instructions included in the program codes can be used to execute the steps of the application detection method based on the RASP system described in the above method embodiments. For details, reference can be made to the above method embodiments, which will not be elaborated here.

[0093] Among them, the above computer program product can be specifically implemented in the form of hardware, software, or a combination thereof. In an alternative embodiment, the computer program product is specifically embodied as a computer storage medium. In another alternative embodiment, the computer program product is specifically embodied as a software product, such as a Software Development Kit (SDK), etc.

[0094] For the solutions described in this specification and the embodiments, if they involve the processing of personal information, they will be processed on the premise of having a legal basis (such as obtaining the consent of the personal information subject, or being necessary for the performance of a contract, etc.), and will only be processed within the specified or agreed scope. If a user refuses to process personal information other than the necessary information required for the basic functions, it will not affect the user's use of the basic functions.

[0095] Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems and devices described above can refer to the corresponding processes in the foregoing method embodiments, and will not be described herein again. In the several embodiments provided in this disclosure, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some communication interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms.

[0096] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0097] In addition, in each embodiment of this disclosure, the functional units can be integrated into one processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.

[0098] When the above-described functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium executable by a processor. Based on this understanding, the technical solution of the present disclosure, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure. The foregoing storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks, or optical discs.

[0099] Finally, it should be noted that the above-described embodiments are only specific implementation manners of the present disclosure, used to illustrate the technical solutions of the present disclosure, rather than limiting them. The protection scope of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: any person skilled in the art within the technical scope disclosed by the present disclosure can still modify the technical solutions recorded in the foregoing embodiments or can easily think of changes, or perform equivalent replacements on some of the technical features; and these modifications, changes, or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should all be covered by the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be subject to the protection scope of the claims.

Claims

1. An application detection method based on the RASP system, characterized in that, Applied to a runtime application self - protection RASP system, the method includes: Instrument multiple detection nodes of a target application and write the security detection logic corresponding to the detection nodes; When a first detection node responds to a target request, determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time is the sum of the detection times consumed when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node; Based on the current detection time and the upper limit of the total detection time, determine whether to detect the response process of the first detection node for the target request; When it is determined to detect the response process of the first detection node for the target request, execute the security detection logic corresponding to the first detection node.

2. The method according to claim 1, wherein The determining whether to detect the response process of the first detection node for the target request based on the current detection time and the upper limit of the total detection time includes: When the current detection time is less than the upper limit of the total detection time, determine to detect the response process of the first detection node for the target request.

3. The method according to claim 1, wherein The determining whether to detect the response process of the first detection node for the target request based on the current detection time and the upper limit of the total detection time includes: When the current detection time is less than the upper limit of the total detection time, determine the detection priority corresponding to the target request; Based on the detection strategy corresponding to the detection priority, determine whether to detect the response process of the first detection node for the target request.

4. The method according to claim 3, characterized in that, The determining whether to detect the response process of the first detection node for the target request based on the detection strategy corresponding to the detection priority includes: Determine the upper limit of the single - detection time indicated by the detection strategy; and, based on the upper limit of the total detection time and the current detection time, determine the remaining detection time of the target request; When the remaining detection time is greater than or equal to the upper limit of the single - detection time, determine to detect the response process of the first detection node for the target request.

5. The method according to claim 4, wherein The method further includes: During the execution of the security detection logic corresponding to the first detection node, monitor the target time consumed by the first detection node to detect the target request; When the target time is greater than or equal to the upper limit of the single - detection time, terminate the execution of the security detection logic; and / or, when the sum of the target time and the current detection time is greater than or equal to the upper limit of the total detection time, terminate the execution of the security detection logic.

6. The method according to claim 3, wherein The determining whether to detect the response process of the first detection node for the target request based on the detection strategy corresponding to the detection priority includes: Based on the attribute information of the first detection node, determine whether the first detection node matches the target - type detection node indicated by the detection strategy; When the first detection node matches the target type detection node indicated by the detection policy, determine the response process of the first detection node for the target request.

7. The method according to claim 6, wherein The target type detection node includes at least one of the following: A detection node whose risk level meets the first preset condition; a detection node whose detection time length meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

8. The method according to claim 3, characterized in that The determination of the detection priority corresponding to the target request includes: Based on the ratio of the current detection time to the upper limit of the total detection time, determine the detection priority corresponding to the target request.

9. The method according to any one of claims 1 to 8, characterized in that, The target request carries detection context; the detection context includes at least one of the following: The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; The detection priority corresponding to the target request; the detection policy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection policy; The target type detection node indicated by the detection policy.

10. The method according to claim 1, characterized in that, The determination of whether to detect the response process of the first detection node for the target request based on the current detection time and the upper limit of the total detection time includes: When the current detection time is greater than or equal to the upper limit of the total detection time, determine not to detect the response process of the first detection node for the target request.

11. An application detection device based on the RASP system, characterized in that, Includes: An instrumentation module for instrumenting multiple detection nodes of the target application and writing the security detection logic corresponding to the detection nodes; A determination module for determining the current detection time of the target request and the upper limit of the total detection time corresponding to the target request when the first detection node responds to the target request; The first detection node is the detection node currently responding to the target request; The current detection time is the sum of the detection times consumed when each second detection node responds to the target request; The second detection node is the detection node that responds to the target request before the first detection node; A judgment module for determining whether to detect the response process of the first detection node for the target request based on the current detection time and the upper limit of the total detection time; A detection module for executing the security detection logic corresponding to the first detection node when it is determined to detect the response process of the first detection node for the target request.

12. A computer device, characterized in that, Includes: A processor and a memory, the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor executes the steps of the application detection method based on the RASP system according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium. When the computer program is run by a computer device, the computer device executes the steps of the application detection method based on the RASP system according to any one of claims 1 to 10.

Images