Application detection method and device based on RASP system

Abstract

The present disclosure provides a kind of application detection method and device based on RASP system, it is related to computer technology field.Therein, the method is by real-time calculation current detection time consumption (i.e.the cumulative time consumption of the detection node that has been executed) of target request with the upper limit of total detection time consumption preset, dynamically decide whether the security logic of current detection node is executed.When cumulative time consumption approaches upper limit, subsequent detection node is automatically skipped, the dynamic decision of security detection is realized, and performance overhead can be significantly reduced.

Description

Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to an application detection method and device based on a RASP system. Background Art

[0002] As security threats facing network applications become increasingly complex, Runtime Application Self-Protection (RASP) technology, with its ability to embed itself into application processes and intercept attacks in real time, has become a core tool for application security protection. Traditional RASP systems inject security detection logic into key detection nodes (such as file reads and writes, network requests, and database operations), performing end-to-end security checks on every request.

[0003] However, existing RASP technology generates computations within the security logic of each detection node, consuming significant computing resources. Considering that RASP products are typically deployed in production environments with high system throughput, full detection in high-concurrency scenarios can accumulate significant latency, degrading application response times and even triggering service avalanches. Summary of the Invention

[0004] The embodiments of the present disclosure at least provide a method and device for application detection based on a RASP system, so as to solve the problem that security detection in a RASP system affects system performance.

[0005] In a first aspect, an embodiment of the present disclosure provides an application detection method based on a RASP system, which is applied to a runtime application self-protection RASP system. The method includes:

[0006] Instrument multiple detection nodes of the target application and write security detection logic corresponding to the detection nodes;

[0007] When a first detection node responds to a target request, determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node that currently responds to the target request; the current detection time is the sum of the detection times of each second detection node when responding to the target request; the second detection node is the detection node that responded to the target request before the first detection node;

[0008] Determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time;

[0009] In a case where it is determined to detect a response process of the first detection node to the target request, a security detection logic corresponding to the first detection node is executed.

[0010] In an optional implementation, determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time includes:

[0011] In a case where the current detection time consumption is less than the upper limit of the total detection time consumption, it is determined to detect a response process of the first detection node to the target request.

[0012] In an optional implementation, determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time includes:

[0013] When the current detection time is less than the upper limit of the total detection time, determining the detection priority corresponding to the target request;

[0014] Based on the detection policy corresponding to the detection priority, it is determined whether to detect a response process of the first detection node to the target request.

[0015] In an optional implementation, the determining whether to detect a response process of the first detection node to the target request based on the detection strategy corresponding to the detection priority includes:

[0016] Determine the upper limit of a single detection time indicated by the detection strategy; and, based on the upper limit of the total detection time and the current detection time, determine the remaining detection time of the target request;

[0017] When the remaining detection time is greater than or equal to the upper limit of the single detection time, it is determined to detect a response process of the first detection node to the target request.

[0018] In an optional implementation, the method further includes:

[0019] During execution of the security detection logic corresponding to the first detection node, monitoring a target duration consumed by the first detection node for detecting the target request;

[0020] When the target duration is greater than or equal to the upper limit of the single detection time, terminating the execution of the security detection logic; and / or,

[0021] When the sum of the target duration and the current detection time is greater than or equal to the upper limit of the total detection time, the execution of the security detection logic is terminated.

[0022] In an optional implementation, the determining whether to detect a response process of the first detection node to the target request based on the detection strategy corresponding to the detection priority includes:

[0023] determining, based on the attribute information of the first detection node, whether the first detection node matches a target type detection node indicated by the detection strategy;

[0024] In a case where the first detection node matches the target type detection node indicated by the detection policy, it is determined to detect a response process of the first detection node to the target request.

[0025] In an optional implementation, the target type detection node includes at least one of the following:

[0026] A detection node whose risk level meets the first preset condition; a detection node whose detection time meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

[0027] In an optional implementation, determining the detection priority corresponding to the target request includes:

[0028] Based on the ratio of the current detection time to the upper limit of the total detection time, the detection priority corresponding to the target request is determined.

[0029] In an optional implementation, the target request carries a detection context; the detection context includes at least one of the following:

[0030] The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; the detection priority corresponding to the target request; the detection strategy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection strategy; the target type detection node indicated by the detection strategy.

[0031] In an optional implementation, determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time includes:

[0032] If the current detection time is greater than or equal to the upper limit of the total detection time, it is determined not to detect a response process of the first detection node to the target request.

[0033] In a second aspect, an embodiment of the present disclosure further provides an application detection device based on a RASP system, comprising:

[0034] An instrumentation module, used to instrument multiple detection nodes of a target application and write security detection logic corresponding to the detection nodes;

[0035] A determination module, configured to determine, when a first detection node responds to a target request, the current detection time of the target request and an upper limit of the total detection time corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time is the sum of the detection times when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node;

[0036] a judgment module, configured to determine whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time;

[0037] The detection module is configured to execute the security detection logic corresponding to the first detection node when it is determined to detect the response process of the first detection node to the target request.

[0038] In an optional implementation manner, the judgment module is specifically configured to:

[0039] In a case where the current detection time consumption is less than the upper limit of the total detection time consumption, it is determined to detect a response process of the first detection node to the target request.

[0040] In an optional implementation manner, the judgment module is specifically configured to:

[0041] When the current detection time is less than the upper limit of the total detection time, determining the detection priority corresponding to the target request;

[0042] Based on the detection policy corresponding to the detection priority, it is determined whether to detect a response process of the first detection node to the target request.

[0043] In an optional implementation manner, the judgment module is specifically configured to:

[0044] Determine the upper limit of a single detection time indicated by the detection strategy; and, based on the upper limit of the total detection time and the current detection time, determine the remaining detection time of the target request;

[0045] When the remaining detection time is greater than or equal to the upper limit of the single detection time, it is determined to detect a response process of the first detection node to the target request.

[0046] In an optional embodiment, the device further includes a termination module, configured to:

[0047] During execution of the security detection logic corresponding to the first detection node, monitoring a target duration consumed by the first detection node for detecting the target request;

[0048] When the target duration is greater than or equal to the upper limit of the single detection time, the execution of the safety detection logic is terminated; and / or when the sum of the target duration and the current detection time is greater than or equal to the upper limit of the total detection time, the execution of the safety detection logic is terminated.

[0049] In an optional implementation manner, the judgment module is specifically configured to:

[0050] determining, based on the attribute information of the first detection node, whether the first detection node matches a target type detection node indicated by the detection strategy;

[0051] In a case where the first detection node matches the target type detection node indicated by the detection policy, it is determined to detect a response process of the first detection node to the target request.

[0052] In an optional implementation, the target type detection node includes at least one of the following:

[0053] A detection node whose risk level meets the first preset condition; a detection node whose detection time meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

[0054] In an optional implementation manner, the judgment module is specifically configured to:

[0055] Based on the ratio of the current detection time to the upper limit of the total detection time, the detection priority corresponding to the target request is determined.

[0056] In an optional implementation, the target request carries a detection context; the detection context includes at least one of the following:

[0057] The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; the detection priority corresponding to the target request; the detection strategy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection strategy; the target type detection node indicated by the detection strategy.

[0058] In an optional implementation manner, the judgment module is specifically configured to:

[0059] If the current detection time is greater than or equal to the upper limit of the total detection time, it is determined not to detect a response process of the first detection node to the target request.

[0060] In a third aspect, an optional implementation of the present disclosure further provides a computer device, a processor, and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the machine-readable instructions perform the steps of the above-mentioned first aspect, or any possible implementation of the first aspect.

[0061] In a fourth aspect, an optional implementation of the present disclosure further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed, it executes the steps of the above-mentioned first aspect or any possible implementation of the first aspect.

[0062] For a description of the effects of the above-mentioned application detection device, computer equipment, and computer-readable storage medium based on the RASP system, please refer to the description of the application detection method based on the RASP system, which will not be repeated here.

[0063] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present disclosure.

[0064] The RASP-based application detection method and device provided in the disclosed embodiments dynamically determine whether to execute the security logic of the current detection node by calculating the current detection duration of the target request (i.e., the cumulative duration of executed detection nodes) and a preset upper limit for the total detection duration in real time. When the cumulative duration approaches the upper limit, subsequent detection nodes are automatically skipped, enabling dynamic decision-making for security detection and significantly reducing performance overhead.

[0065] In order to make the above-mentioned objectives, features and advantages of the present disclosure more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following briefly introduces the drawings required for use in the embodiments. The drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to illustrate the technical solutions of the present disclosure. It should be understood that the following drawings only illustrate certain embodiments of the present disclosure and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without inventive effort.

[0067] Figure 1 A flowchart of an application detection method based on a RASP system provided in some embodiments of the present disclosure is shown;

[0068] Figure 2 A flowchart of another RASP system-based application detection method provided by some embodiments of the present disclosure is shown;

[0069] Figure 3 A schematic diagram of an application detection device based on a RASP system provided in some embodiments of the present disclosure is shown;

[0070] Figure 4 A schematic diagram of a computer device provided by some embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0071] In order to make the purpose, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The components of the embodiments of the present disclosure generally described and shown here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present disclosure is not intended to limit the scope of the present disclosure for protection, but merely represents the selected embodiments of the present disclosure. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present disclosure.

[0072] Research has found that existing RASP technology generates computational computations within the security logic of each detection node, consuming significant computing resources. Considering that RASP products are typically deployed in production environments with high system throughput, full-scale detection in high-concurrency scenarios can accumulate significant latency, degrading application response times and even triggering service avalanches.

[0073] Furthermore, due to the complexity of applications and RASP systems, it's difficult to assess the impact of individual detection nodes on system performance. It's also difficult to assess the detection nodes that a request will pass through, making it impossible to individually restrict specific detection nodes. When performing throttling based on the number of hooks on a single request, once the throttling threshold is reached, all subsequent detection nodes along the request's path are skipped, causing a significant drop in the RASP system's protection performance in a short period of time, and even rendering security detection unavailable.

[0074] Based on the above research, this disclosure provides a RASP-based application detection method and device. This method dynamically determines whether to execute the security logic for the current detection node by calculating the current detection duration of a target request (i.e., the cumulative duration of executed detection nodes) against a preset upper limit for the total detection duration in real time. When the cumulative duration approaches the upper limit, subsequent detection nodes are automatically skipped, enabling dynamic decision-making for security detection and significantly reducing performance overhead.

[0075] The defects in the above solutions are the results obtained by the inventors after practice and careful research. Therefore, the process of discovering the above problems and the solutions proposed by this disclosure for the above problems below should be the contributions made by the inventors to this disclosure during the disclosure process.

[0076] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0077] To facilitate understanding of this embodiment, we first provide a detailed introduction to a RASP-based application detection method disclosed in this embodiment. The RASP-based application detection method provided in this embodiment is generally executed by a computer device with certain computing capabilities, such as a terminal device, a server, or other processing device. In some possible implementations, this RASP-based application detection method can be implemented by a processor invoking computer-readable instructions stored in a memory.

[0078] The following describes the application detection method based on the RASP system provided by the embodiment of the present disclosure by taking the execution subject as a server as an example.

[0079] See also Figure 1 FIG. 1 is a flowchart of an application detection method based on a RASP system provided by an embodiment of the present disclosure. The method can be applied to a RASP system. The method includes steps S101 to S104, wherein:

[0080] S101 , inserting multiple detection nodes of a target application, and writing security detection logic corresponding to the detection nodes.

[0081] The target application may refer to an application deployed with the RASP system, such as a web application, an application programming interface (API) service, or a microservice exposed to the Internet.

[0082] RASP (Runtime Application Self-Protection) is a security technology built into applications. It analyzes runtime behavior and context to identify and block attacks in real time. This system typically features real-time monitoring and defense, contextual awareness, digital supply chain risk monitoring, and API security enhancements.

[0083] These detection nodes can be key locations in the application execution flow (e.g., method calls, system API access points), serving as anchor points for embedding security detection logic. Examples include input / output nodes (e.g., HTTP request entry points), data processing nodes, system command nodes (e.g., process creation points), and file operation nodes (e.g., file read / write points). Based on an attack surface analysis of the application architecture, high-risk operation paths can be prioritized for coverage.

[0084] Instrumentation refers to the dynamic insertion of monitoring code into detection nodes through bytecode manipulation techniques, without modifying the original source code. For example, instrumentation can be performed by rewriting the bytecode of class files, rewriting intermediate language instructions, or importing hooks.

[0085] The above-mentioned security detection logic may refer to a dynamic protection algorithm executed at a detection node, which can realize functions such as generating security detection files, identifying and blocking attack behaviors, etc.

[0086] In this step, the instrumentation function of the RASP system can be used to instrument multiple detection nodes of the target application.

[0087] S102. When the first detection node responds to the target request, determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node that currently responds to the target request; the current detection time is the sum of the detection times when each second detection node responds to the target request; the second detection node is the detection node that responds to the target request before the first detection node.

[0088] The target request can be any request that the target application is currently responding to or preparing to respond to. The request can originate from a client corresponding to the target application. Specifically, the target request can also refer to an application request instance (e.g., an HTTP request or a Remote Procedure Call (RPC)) being monitored by the RASP system.

[0089] The first detection node may refer to a node position in the target request execution flow that is about to trigger a security check. The second detection node may refer to a detection node sequence where the target request has been executed before the first detection node.

[0090] The current detection duration mentioned above can refer to the cumulative execution time of the security logic of all second detection nodes from the start of the target request to the triggering of the current first detection node. The total detection time limit can refer to the maximum time threshold allowed for the security detection logic to consume in a single request. This total detection time limit can be pre-configured or dynamically set based on actual conditions.

[0091] The current detection time and the upper limit of the total detection time can be calculated in real time or determined by table lookup, reading, etc. In one possible implementation, a detection context can be deployed for the target request. The detection context can store relevant information about the target request (such as the current detection time and the upper limit of the total detection time). At each detection node, the content of the detection context of the target request can be read and maintained by security detection logic or other code.

[0092] S103: Determine whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time.

[0093] In this step, whether the target request needs to be detected at the first detection node can be determined based on the current detection time and the upper limit of the total detection time. For example, the determination can be made based on the difference between the upper limit of the total detection time and the current detection time, or the ratio between the current detection time and the upper limit of the total detection time.

[0094] For example, when the current detection time consumption is less than the upper limit of the total detection time consumption, it may be directly determined to detect the response process of the first detection node to the target request.

[0095] Alternatively, when the current detection time is less than the upper limit of the total detection time, the detection priority corresponding to the target request can be determined first; and then, based on the detection strategy corresponding to the detection priority, it can be determined whether to detect the response process of the first detection node to the target request.

[0096] For example, the detection strategy may first determine an upper limit on a single detection time, and then determine a remaining detection duration for the target request based on the upper limit on the total detection time and the current detection time. If the remaining detection duration is greater than or equal to the upper limit on a single detection time, a process of detecting a response of the first detection node to the target request is determined.

[0097] Among them, multiple detection priorities can be pre-set, and different detection priorities can correspond to different detection strategies. The detection priority of the target request can be pre-configured or dynamically configured according to the specific situation.

[0098] The detection strategy for the aforementioned detection priority can indicate an upper limit on the duration of a single detection. This upper limit refers to the maximum time budget allowed for a single detection node to execute security detection logic. When the detection time of the detection node exceeds this threshold, a dynamic circuit breaker mechanism can be triggered. When determining whether a detection node needs to be detected, it can first determine whether the remaining detection time of the target request meets the upper limit of the single detection time, that is, predict whether the current detection node can complete this security detection.

[0099] In another possible implementation, the detection policy may indicate the type of detection node requiring security detection. The detection policy may directly indicate a target type detection node, and a determination may be made based on attribute information of the first detection node whether the first detection node matches the target type detection node indicated by the detection policy. If the first detection node matches the target type detection node indicated by the detection policy, a determination may be made regarding the process of detecting the first detection node's response to the target request.

[0100] Exemplarily, the target type detection node includes at least one of the following:

[0101] A detection node whose risk level meets the first preset condition; a detection node whose detection time meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

[0102] Correspondingly, the attribute information of the first detection node may include any one of the risk level, detection time length, and historical hit frequency.

[0103] In this way, by dividing the detection priorities, the detection nodes can be classified according to different dimensions, so as to select the detection nodes that need to be detected.

[0104] In one possible implementation, one or more of the detection priority corresponding to the target request, the detection policy corresponding to the detection priority, the upper limit of a single detection time indicated by the detection policy, and the target type detection node indicated by the detection policy may also be stored in the detection context of the target request. This information may also be modified in real time.

[0105] S104: When it is determined to detect a response process of the first detection node to the target request, execute security detection logic corresponding to the first detection node.

[0106] When it is determined to detect the first detection node, the security detection logic corresponding to the first detection node can be executed, thereby realizing functions such as generating a security detection file, identifying and blocking attack behaviors, etc.

[0107] Accordingly, when the current detection time consumption is greater than or equal to the upper limit of the total detection time consumption, it can be determined not to detect the response process of the first detection node to the target request.

[0108] Alternatively, when the current detection time is greater than or equal to the upper limit of the total detection time, it is possible to further determine whether detection is needed based on one or more of the information such as time margin ratio, node risk level, request threat index, system load pressure, etc.

[0109] In one possible implementation, when executing the security detection logic corresponding to the first detection node, the target duration consumed by the first detection node to detect the target request can be monitored in real time. When the target duration is greater than or equal to the upper limit of the single detection duration, the execution of the security detection logic can be terminated. Specifically, the termination of the execution of the security monitoring logic can mean that after completing the security monitoring logic corresponding to the first monitoring node, the security monitoring logic corresponding to subsequent monitoring nodes will no longer be executed.

[0110] When the sum of the target duration and the current detection time is greater than or equal to the upper limit of the total detection time, the execution of the security detection logic may be terminated.

[0111] Furthermore, when the system determines not to perform detection, or to terminate detection, or to conduct testing normally, a structured log can be generated for offline analysis, so as to optimize parameters such as the current detection time of the target request, the upper limit of the total detection time corresponding to the target request, the detection priority corresponding to the target request, the detection strategy corresponding to the detection priority, the upper limit of the single detection time indicated by the detection strategy, and the target type detection node indicated by the detection strategy.

[0112] This approach dynamically determines whether to execute the security logic for the current detection node by calculating the target request's current detection duration (i.e., the cumulative duration of executed detection nodes) against a preset upper limit for the total detection duration in real time. When the cumulative duration approaches the upper limit, subsequent detection nodes are automatically skipped, enabling dynamic security detection decisions and significantly reducing performance overhead.

[0113] Moreover, it can also ensure that the protection capability of the RASP system is retained to the maximum extent without causing serious impact on the target application.

[0114] See also Figure 2The figure shows a flowchart of another application detection method based on the RASP system provided by an embodiment of the present disclosure. When receiving a request, the method first initializes the requested detection context according to the preset configuration. When the request enters the detection node, it first determines whether the time-consuming circuit has been blown (that is, whether the current detection time is greater than or equal to the total detection time limit). If the time-consuming circuit has been blown, the detection of the detection node is directly skipped; if the time-consuming circuit has not been blown, the execution level of the detection (that is, the detection priority) can be determined from the detection context information, and it is determined whether the remaining time meets the conditions for executing the test. If the remaining time is insufficient, the detection of the detection node is directly skipped; if the remaining time is sufficient, the detection is executed. During the detection process, the execution time can be monitored in real time. If it exceeds the single detection time limit, the time-consuming circuit can be blown; if the execution time exceeds the total detection time limit, the time-consuming circuit can also be blown. Finally, the log of the entire protection process can be collected for offline use.

[0115] Those skilled in the art will understand that in the above-mentioned method of the specific implementation method, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0116] Based on the same inventive concept, the embodiment of the present disclosure also provides an application detection device based on the RASP system corresponding to the application detection method based on the RASP system. Since the principle of solving the problem by the device in the embodiment of the present disclosure is similar to the above-mentioned application detection method based on the RASP system in the embodiment of the present disclosure, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0117] Reference Figure 3 FIG. 1 is a schematic diagram of an application detection device based on a RASP system provided by an embodiment of the present disclosure, wherein the device includes:

[0118] An instrumentation module 310 is used to instrument multiple detection nodes of a target application and write security detection logic corresponding to the detection nodes;

[0119] Determination module 320, for determining, when a first detection node responds to a target request, the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node currently responding to the target request; the current detection time is the sum of the detection times of each second detection node when responding to the target request; the second detection node is the detection node that responded to the target request before the first detection node;

[0120] A determination module 330 is configured to determine whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time;

[0121] The detection module 340 is configured to execute a security detection logic corresponding to the first detection node when it is determined to detect a response process of the first detection node to the target request.

[0122] In an optional implementation manner, the judgment module 330 is specifically configured to:

[0123] In a case where the current detection time consumption is less than the upper limit of the total detection time consumption, it is determined to detect a response process of the first detection node to the target request.

[0124] In an optional implementation manner, the judgment module 330 is specifically configured to:

[0125] When the current detection time is less than the upper limit of the total detection time, determining the detection priority corresponding to the target request;

[0126] Based on the detection policy corresponding to the detection priority, it is determined whether to detect a response process of the first detection node to the target request.

[0127] In an optional implementation manner, the judgment module 330 is specifically configured to:

[0128] Determine the upper limit of a single detection time indicated by the detection strategy; and, based on the upper limit of the total detection time and the current detection time, determine the remaining detection time of the target request;

[0129] When the remaining detection time is greater than or equal to the upper limit of the single detection time, it is determined to detect a response process of the first detection node to the target request.

[0130] In an optional embodiment, the device further includes a termination module, configured to:

[0131] During execution of the security detection logic corresponding to the first detection node, monitoring a target duration consumed by the first detection node for detecting the target request;

[0132] When the target duration is greater than or equal to the upper limit of the single detection time, the execution of the safety detection logic is terminated; and / or when the sum of the target duration and the current detection time is greater than or equal to the upper limit of the total detection time, the execution of the safety detection logic is terminated.

[0133] In an optional implementation manner, the judgment module 330 is specifically configured to:

[0134] determine whether the first detection node matches a target type detection node indicated by the detection policy based on attribute information of the first detection node;

[0135] in a case where the first detection node matches the target type detection node indicated by the detection policy, determine to detect a response process of the first detection node to the target request.

[0136] In an optional implementation, the target type detection node includes at least one of the following:

[0137] a detection node whose risk degree meets a first preset condition; a detection node whose detection time length meets a second preset condition; and a detection node whose historical hit frequency meets a third preset condition.

[0138] In an optional implementation, the judging module 330 is specifically configured to:

[0139] determine a detection priority corresponding to the target request based on a ratio of the current detection time to the upper limit of the total detection time.

[0140] In an optional implementation, the target request carries a detection context; and the detection context includes at least one of the following:

[0141] a current detection time of the target request; an upper limit of a total detection time corresponding to the target request; a detection priority corresponding to the target request; a detection policy corresponding to the detection priority; a single detection time upper limit indicated by the detection policy; and a target type detection node indicated by the detection policy.

[0142] In an optional implementation, the judging module 330 is specifically configured to:

[0143] in a case where the current detection time is greater than or equal to the upper limit of the total detection time, determine not to detect the response process of the first detection node to the target request.

[0144] The description of the processing procedure of each module in the apparatus and the interaction procedure between the modules can refer to the related description in the above method embodiments, and will not be repeated here.

[0145] The present disclosure also provides a computer device, as shown in the accompanying drawings, which is a structural schematic diagram of a computer device provided by the present disclosure, comprising: Figure 4

[0146] ​Processor 41 and memory 42; the memory 42 stores machine-readable instructions executable by the processor 41, and the processor 41 is configured to execute the machine-readable instructions stored in the memory 42. When the machine-readable instructions are executed by the processor 41, the processor 41 performs the following steps:

[0147] Instrument multiple detection nodes of the target application and write security detection logic corresponding to the detection nodes;

[0148] When a first detection node responds to a target request, determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node that currently responds to the target request; the current detection time is the sum of the detection times of each second detection node when responding to the target request; the second detection node is the detection node that responded to the target request before the first detection node;

[0149] Determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time;

[0150] In a case where it is determined to detect a response process of the first detection node to the target request, a security detection logic corresponding to the first detection node is executed.

[0151] The above-mentioned memory 42 includes internal memory 421 and external memory 422; the memory 421 here is also called internal memory, which is used to temporarily store the calculation data in the processor 41 and the data exchanged with the external memory 422 such as the hard disk. The processor 41 exchanges data with the external memory 422 through the memory 421.

[0152] The specific execution process of the above instructions can refer to the steps of the application detection method based on the RASP system described in the embodiment of the present disclosure, and will not be repeated here.

[0153] The present disclosure also provides a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the computer program executes the steps of the RASP-based application detection method described in the above method embodiment. The storage medium may be a volatile or non-volatile computer-readable storage medium.

[0154] The embodiments of the present disclosure also provide a computer program product, which carries program code. The instructions included in the program code can be used to execute the steps of the application detection method based on the RASP system described in the above method embodiment. For details, please refer to the above method embodiment and will not be repeated here.

[0155] The computer program product can be implemented by hardware, software or a combination thereof. In an optional embodiment, the computer program product is embodied in a computer storage medium. In another optional embodiment, the computer program product is embodied in a software product, such as a software development kit (SDK) or the like.

[0156] In the solutions described in the specification and embodiments, if personal information is involved, the personal information is processed on the premise of legal basis (for example, the consent of the subject of personal information or necessity for performing a contract) and within a prescribed or agreed range. If a user refuses to process personal information other than necessary information for basic functions, the user can use the basic functions.

[0157] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the foregoing method embodiments, which will not be described here. In several embodiments provided in the disclosure, it should be understood that the disclosed system, device and method can be implemented by other ways. The device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some communication interface, device or unit, which can be electrical, mechanical or other forms.

[0158] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed on multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments.

[0159] In addition, each functional unit in each embodiment of the disclosure can be integrated into one processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit.

[0160] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0161] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present disclosure, which are used to illustrate the technical solutions of the present disclosure, rather than to limit them. The scope of protection of the present disclosure is not limited thereto. Although the present disclosure has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed in the present disclosure, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure, and should be included in the scope of protection of the present disclosure. Therefore, the scope of protection of the present disclosure should be based on the scope of protection of the claims.

Claims

1. An application detection method based on the RASP system, characterized in that: Applied to a runtime application self-protection (RASP) system, the method includes: Instrument multiple detection nodes of the target application and write security detection logic corresponding to the detection nodes; When a first detection node responds to a target request, determine the current detection time of the target request and the upper limit of the total detection time corresponding to the target request; the first detection node is the detection node that currently responds to the target request; the current detection time is the sum of the detection times of each second detection node when responding to the target request; the second detection node is the detection node that responded to the target request before the first detection node; Determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time; In a case where it is determined to detect a response process of the first detection node to the target request, executing a security detection logic corresponding to the first detection node; Determining whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time includes: When the current detection time is less than the upper limit of the total detection time, determining the detection priority corresponding to the target request; determining, based on a detection strategy corresponding to the detection priority, whether to detect a response process of the first detection node to the target request; The determining, based on the detection strategy corresponding to the detection priority, whether to detect a response process of the first detection node to the target request includes: Determine the upper limit of a single detection time indicated by the detection strategy; and, based on the upper limit of the total detection time and the current detection time, determine the remaining detection time of the target request; When the remaining detection time is greater than or equal to the upper limit of the single detection time, it is determined to detect a response process of the first detection node to the target request.

2. The method according to claim 1, characterized in that The determining, based on the current detection time and the upper limit of the total detection time, whether to detect a response process of the first detection node to the target request includes: In a case where the current detection time consumption is less than the upper limit of the total detection time consumption, it is determined to detect a response process of the first detection node to the target request.

3. The method according to claim 1, characterized in that The method further comprises: During execution of the security detection logic corresponding to the first detection node, monitoring a target duration consumed by the first detection node for detecting the target request; When the target duration is greater than or equal to the upper limit of the single detection time, the execution of the safety detection logic is terminated; and / or when the sum of the target duration and the current detection time is greater than or equal to the upper limit of the total detection time, the execution of the safety detection logic is terminated.

4. The method according to claim 1, wherein The determining, based on the detection strategy corresponding to the detection priority, whether to detect a response process of the first detection node to the target request includes: determining, based on the attribute information of the first detection node, whether the first detection node matches a target type detection node indicated by the detection strategy; In a case where the first detection node matches the target type detection node indicated by the detection policy, it is determined to detect a response process of the first detection node to the target request.

5. The method according to claim 4, characterized in that The target type detection node includes at least one of the following: A detection node whose risk level meets the first preset condition; a detection node whose detection time meets the second preset condition; a detection node whose historical hit frequency meets the third preset condition.

6. The method according to claim 1, characterized in that Determining the detection priority corresponding to the target request includes: Based on the ratio of the current detection time to the upper limit of the total detection time, the detection priority corresponding to the target request is determined.

7. The method according to any one of claims 1 to 6, characterized in that: The target request carries a detection context; the detection context includes at least one of the following: The current detection time of the target request; the upper limit of the total detection time corresponding to the target request; The detection priority corresponding to the target request; the detection strategy corresponding to the detection priority; the upper limit of the single detection time indicated by the detection strategy; The detection strategy indicates the target type of the detection node.

8. The method according to claim 1, characterized in that The determining, based on the current detection time and the upper limit of the total detection time, whether to detect a response process of the first detection node to the target request includes: If the current detection time is greater than or equal to the upper limit of the total detection time, it is determined not to detect a response process of the first detection node to the target request.

9. An application detection device based on a RASP system, characterized in that: include: An instrumentation module, used to instrument multiple detection nodes of a target application and write security detection logic corresponding to the detection nodes; a determination module, configured to determine, when the first detection node responds to the target request, a current detection time consumption of the target request and an upper limit of a total detection time consumption corresponding to the target request; The first detection node is a detection node that currently responds to the target request; The current detection time is the sum of the detection times consumed by each second detection node when responding to the target request; The second detection node is a detection node that responds to the target request before the first detection node; a judgment module, configured to determine whether to detect a response process of the first detection node to the target request based on the current detection time and the upper limit of the total detection time; a detection module, configured to, upon determining to detect a response process of the first detection node to the target request, execute a security detection logic corresponding to the first detection node; The judgment module is specifically used for: When the current detection time is less than the upper limit of the total detection time, determining the detection priority corresponding to the target request; determining, based on a detection strategy corresponding to the detection priority, whether to detect a response process of the first detection node to the target request; The judgment module is specifically used for: Determine the upper limit of the single detection time indicated by the detection strategy; and, determining a remaining detection time of the target request based on the total detection time upper limit and the current detection time; When the remaining detection time is greater than or equal to the upper limit of the single detection time, it is determined to detect a response process of the first detection node to the target request.

10. A computer device, characterized in that: include: A processor and a memory, wherein the memory stores machine-readable instructions executable by the processor, and the processor is used to execute the machine-readable instructions stored in the memory. When the machine-readable instructions are executed by the processor, the processor performs the steps of the application detection method based on the RASP system as described in any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program. When the computer program is executed by a computer device, the computer device executes the steps of the application detection method based on the RASP system according to any one of claims 1 to 8.

Images