Defense accuracy improving method and system based on IAST data enhancement

Abstract

The invention discloses a defense accuracy improving method and system based on IAST data enhancement. The method comprises the following steps: when an application program runs, acquiring IAST dynamic taint analysis data collected by an Agent inserted in the application program; according to the IAST dynamic taint analysis data, identifying and verifying security vulnerabilities in the application program through a dynamic taint analysis and data enhancement technology to obtain an IAST detection result; monitoring runtime behaviors of the application program in real time, and intercepting attack behaviors; and judging the interception credibility in combination with an IAST detection result, dynamically adjusting a defense strategy according to a vulnerability level, and intercepting an attack behavior in combination with a filtering algorithm. By implementing the method provided by the invention, accurate data and deep analysis provided by the IAST technology can be realized, the accuracy of RASP defense is effectively improved, and the occurrence of false alarms and missing alarms is reduced.

Description

Technical Field

[0001] The present invention relates to data security, and more specifically to a method and system for improving defense accuracy based on IAST data enhancement. Background Art

[0002] Currently, runtime-based RASP (Runtime Application Self-Protection) technology has become an effective means to improve the security of Web applications. By monitoring and protecting the application at runtime, RASP technology can detect potential attack behaviors in real time and prevent these attacks from occurring. Unlike traditional security protection methods, RASP technology can be directly embedded into the application and analyze its behavior at runtime, thereby achieving more accurate security protection. However, traditional RASP defense algorithms still have certain defects in practical applications, especially their low accuracy. This problem usually manifests itself as false positives or missed negatives, which affects the protection effect and the overall security of the system.

[0003] At the same time, IAST (Interactive Application Security Testing), as a method that combines static analysis and dynamic analysis, has gradually attracted widespread attention. IAST technology can detect potential security vulnerabilities in real time by monitoring the flow path and execution process of sensitive data during the operation of the application. This technology combines the advantages of static code scanning and dynamic behavior monitoring, and can explore security risks in applications at a deeper level, especially effectively identifying attacks such as data leakage, SQL injection, and cross-site scripting. However, although IAST technology has shown great potential in security testing, it still has certain shortcomings in data collection and analysis. Especially when conducting in-depth mining of complex data interactions in Web applications, existing technologies are still unable to fully capture the details of multi-dimensional data such as request parameters, user input, function calls, and their interrelationships. This problem means that the accuracy and real-time performance of IAST in complex environments still need to be improved.

[0004] Therefore, how to combine IAST dynamic taint analysis data with RASP defense mechanisms to enhance the accuracy and reliability of RASP algorithms has become a key issue that needs to be addressed in the current cybersecurity field. Although some research and practical attempts have been made to combine IAST dynamic taint analysis data with RASP defense mechanisms, this field still faces many technical challenges, such as the complexity of data flow, performance overhead, and false positives and negatives.

[0005] Therefore, it is necessary to design a new method to utilize the precise data and in-depth analysis provided by IAST technology to effectively improve the accuracy of RASP defense and reduce the occurrence of false positives and missed negatives. Summary of the Invention

[0006] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a method and system for improving defense accuracy based on IAST data enhancement.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a defense accuracy improvement method based on IAST data enhancement, comprising:

[0008] When the application is running, obtain the IAST dynamic taint analysis data collected by the agent inserted in the application;

[0009] Identify and verify security vulnerabilities in the application using dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain IAST detection results;

[0010] Monitor the runtime behavior of applications in real time and intercept attack behaviors;

[0011] The credibility of the interception is judged in combination with the IAST detection results, and the defense strategy is dynamically adjusted according to the vulnerability level, and the attack behavior is intercepted in combination with the filtering algorithm.

[0012] Its further technical solution is: the IAST dynamic taint analysis data includes untrusted data sources and sensitive data flows when the application is running.

[0013] A further technical solution is: identifying and verifying security vulnerabilities in the application through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain IAST detection results, including:

[0014] Analyze the IAST dynamic taint analysis data to identify potential attacks and record relevant information about all potential attack behaviors;

[0015] Performing enhancement processing on the IAST dynamic taint analysis data to obtain an enhanced result;

[0016] Use the enhanced results to test the security protection capabilities of the application and determine the IAST detection results in combination with the potential attacks.

[0017] A further technical solution is to analyze the IAST dynamic taint analysis data to identify potential attacks and record relevant information of all potential attack behaviors, including:

[0018] Vulnerability identification, anomaly detection, taint analysis, and security risk assessment are performed on the IAST dynamic taint analysis data to identify potential attacks and record relevant information of all potential attack behaviors.

[0019] Its further technical solution is: the relevant information of the potential attack behavior includes the request packet, URL, parameters, call chain and sink point of the potential attack.

[0020] A further technical solution is: real-time monitoring of the runtime behavior of the application and interception of attack behaviors include:

[0021] Monitor the runtime behavior of the application in real time. When the runtime behavior triggers the attack behavior interception algorithm, intercept the attack behavior and identify and record the sink points and request packet information involved to obtain interception information.

[0022] Its further technical solution is: judging the credibility of interception in combination with the IAST detection results, dynamically adjusting the defense strategy according to the vulnerability level, and intercepting the attack behavior in combination with the filtering algorithm, including:

[0023] Determine whether the interception information is in the IAST detection result and the call chain is complete;

[0024] If the interception information is in the IAST detection result and the call chain is complete, determine whether the interception information contains an IAST dynamic hierarchical call;

[0025] If the interception information contains an IAST dynamic decomposition call, determine whether the vulnerability level corresponding to the interception information has changed;

[0026] If the vulnerability level corresponding to the intercepted information changes, the RASP filtering algorithm is used to determine whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters;

[0027] If the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters, it is determined that there is a vulnerability and the attack behavior is intercepted.

[0028] Its further technical solution is: after determining whether the interception information is in the IAST detection result and the call chain is complete, it also includes:

[0029] If the interception information is not in the IAST detection result and / or the call chain is incomplete, the vulnerability algorithm with low threat level and easy to cause false detection is relaxed.

[0030] Its further technical solution is: after determining whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters through the RASP filtering algorithm, it also includes:

[0031] If the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters, it is determined that there is no vulnerability and the runtime behavior of the application is released.

[0032] The present invention also provides a defense accuracy improvement system based on IAST data enhancement, including:

[0033] An acquisition unit is used to acquire IAST dynamic taint analysis data collected by an agent inserted into the application while the application is running;

[0034] A detection unit, configured to identify and verify security vulnerabilities in the application program through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data, so as to obtain an IAST detection result;

[0035] The interception unit is used to monitor the runtime behavior of the application in real time and intercept attack behaviors;

[0036] The processing unit is used to determine the credibility of the interception based on the IAST detection results, dynamically adjust the defense strategy according to the vulnerability level, and intercept the attack behavior in combination with the filtering algorithm.

[0037] The beneficial effects of the present invention compared to the prior art are: by inserting an Agent into the application to collect IAST dynamic taint analysis data, the system can accurately identify and verify security vulnerabilities. Based on these data, dynamic taint analysis and data enhancement technology help monitor application behavior in real time and effectively intercept attacks. Combined with the IAST detection results, the system dynamically adjusts the defense strategy according to the vulnerability level, reduces false positives and missed reports, and improves the protection effect; combined with the precise dynamic taint analysis data provided by IAST technology, the system can collect and verify security vulnerabilities in the application in real time, thereby accurately identifying attack behaviors. IAST's in-depth data analysis helps the RASP module dynamically adjust the defense strategy based on the level and credibility of the vulnerability when monitoring application runtime, and combines filtering algorithms to accurately intercept attacks, significantly improving the accuracy of defense and reducing the occurrence of false positives and missed reports.

[0038] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0040] Figure 1 A flowchart of a method for improving defense accuracy based on IAST data enhancement provided by an embodiment of the present invention;

[0041] Figure 2 A schematic diagram of a sub-process of a method for improving defense accuracy based on IAST data enhancement provided by an embodiment of the present invention;

[0042] Figure 3 A schematic diagram of a sub-process of a method for improving defense accuracy based on IAST data enhancement provided by an embodiment of the present invention;

[0043] Figure 4 A schematic block diagram of a defense accuracy improvement system based on IAST data enhancement provided by an embodiment of the present invention;

[0044] Figure 5 A schematic block diagram of a detection unit of a defense accuracy improvement system based on IAST data enhancement provided in an embodiment of the present invention;

[0045] Figure 6 A schematic block diagram of a processing unit of a defense accuracy improvement system based on IAST data enhancement provided in an embodiment of the present invention;

[0046] Figure 7 A schematic block diagram of a computer device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0048] It will be understood that when used in this specification and the appended claims, the terms “comprises” and “comprising” indicate the presence of described features, integers, steps, operations, elements and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof.

[0049] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the present invention. As used in the specification and appended claims, the singular forms "a," "an," and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0050] It should be further understood that the term "and / or" used in the present description and the appended claims refers to and includes any and all possible combinations of one or more of the associated listed items.

[0051] See also Figure 1 , Figure 1 A schematic flow chart of a method for improving defense accuracy based on IAST data enhancement provided in an embodiment of the present invention. The method for improving defense accuracy based on IAST data enhancement is applied to a server. The server interacts with the terminal to perform data interaction, monitors the behavior of the application in real time by combining the dynamic taint analysis data provided by the IAST technology, and uses data enhancement technology to identify and verify potential attacks, thereby improving the accuracy of RASP defense. Specifically, IAST dynamic taint analysis data is used to detect security vulnerabilities in applications and identify potential attacks, while enhancing data processing capabilities to improve defense effectiveness. When intercepting attack behaviors, the defense strategy is dynamically adjusted by analyzing the IAST detection results, vulnerability levels, and call chains, and the attack behaviors are accurately intercepted in combination with the RASP filtering algorithm to reduce the occurrence of false positives and missed reports. This method can accurately judge the credibility of attack behaviors and adjust defense measures based on vulnerability levels, thereby achieving more accurate security protection.

[0052] Figure 1 This is a flow chart of a method for improving defense accuracy based on IAST data enhancement provided by an embodiment of the present invention. Figure 1 As shown, the method includes the following steps S110 to S140.

[0053] S110. When the application is running, obtain IAST dynamic taint analysis data collected by the Agent inserted into the application.

[0054] In this embodiment, the IAST dynamic taint analysis data includes untrusted data sources and sensitive data flows when the application is running.

[0055] Specifically, IAST is an application security testing technology that identifies potential security vulnerabilities, particularly in data flows, by monitoring and analyzing application code in real time while the application is running. Dynamic taint analysis, part of this technology, tracks and marks "tainted data" flowing through the program. This is sensitive data introduced from external sources (such as user input and HTTP requests) that could become potential attack vectors.

[0056] Untrusted data sources refer to data within a program that may come from unreliable sources such as user input, external network requests, file input, and database query results. This data carries a high risk and can be easily manipulated or injected with malicious content by malicious users, potentially affecting the normal execution of the program or causing security vulnerabilities.

[0057] Sensitive data flow refers to the flow of sensitive information within a program, such as user credentials, payment information, and API keys. As this sensitive data passes through different code modules and functions, its propagation path becomes a key focus of analysis. Taint analysis techniques can track the flow of this sensitive data and detect whether it has been compromised by malicious operations or attacks, such as SQL injection and XSS.

[0058] Insert an agent during application runtime. An agent is a component that can be dynamically inserted and collect information during application runtime. It can seamlessly monitor the application's running process, capturing and recording data that enters through the network, database, or user input during program execution.

[0059] The agent automatically identifies and records all untrusted data sources from outside, as well as the flow paths involving sensitive information in the program.

[0060] The agent captures every data flow within the program, focusing particularly on data from user input, requests, or other external sources. It marks and tracks the path of this data, recording how it propagates from its source to different functional points within the program, potentially impacting the processing of sensitive data.

[0061] The collected data includes not only the specific data flow, but also the data source, transmission process, related parameters and the final sink point (that is, the point where sensitive data is processed or output).

[0062] For example, when a user submits personal information (such as username and password) through an input box, the agent captures this input and marks it as tainted data. The subsequent data flow tracing process shows how this data flows between different modules of the application, and may eventually enter the database or log files (these are sinks for processing sensitive data). If these data flows are manipulated by malicious users, they may lead to security vulnerabilities (such as SQL injection).

[0063] The IAST dynamic taint analysis data collected through this process provides accurate information for subsequent vulnerability detection and security analysis. It helps identify untrusted data sources and data paths that may involve sensitive information, thus laying a solid foundation for subsequent data enhancement, vulnerability verification, and defense algorithm optimization.

[0064] S120. Identify and verify security vulnerabilities in the application program through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain IAST detection results.

[0065] In this embodiment, the above-mentioned IAST detection results refer to the process of identifying and verifying potential security vulnerabilities and attack behaviors in the actual operating environment of the application by using security data collected by dynamic taint analysis technology during application runtime. Specifically, IAST detection results generally include the following aspects:

[0066] Vulnerability Identification: Identifies security vulnerabilities by analyzing the application's runtime behavior. Examples include SQL injection, cross-site scripting (XSS), and buffer overflow vulnerabilities. Based on dynamic taint analysis, the IAST system identifies code paths that involve untrusted user input or other potentially attacking data.

[0067] Anomaly detection: Detects unexpected behavior patterns during application runtime, such as illegal data access, abnormal request parameters, and incorrect function calls, which could be part of a malicious attack.

[0068] Taint analysis: This involves tracing the flow of data, specifically the path from untrusted input (such as user input, external requests, etc.) to sensitive data processing. This helps detect which data has been mistakenly or maliciously propagated to critical areas of the application, thereby identifying potential attack chains.

[0069] Security risk assessment: Analyze and categorize discovered vulnerabilities and abnormal behaviors to assess their potential risks. This assessment typically considers the severity of the vulnerability, the potential scope of attack, and the ease of exploitation. This helps determine which issues require priority.

[0070] In this embodiment, IAST detection results refer to reports or result data on potential vulnerabilities generated by in-depth analysis of the dynamic behavior of the application through the above-mentioned process (vulnerability identification, anomaly detection, taint analysis, security risk assessment, etc.). These detection results will record relevant attack information, such as:

[0071] The request packet of a potential attack refers to the specific data of the attack request;

[0072] The URL refers to the specific path containing the vulnerability;

[0073] Parameters refer to the specific way malicious attack data is transmitted;

[0074] The call chain refers to the order of function calls during data flow transmission;

[0075] A sink point is a point or code segment in a program that receives and processes sensitive data, usually a function that processes or ultimately uses the data.

[0076] In this embodiment, vulnerability identification results: the system will mark all identified vulnerabilities in the application and their related information, indicating the vulnerability type and possible security impact.

[0077] Attack behavior recording: Detected potential attack behaviors will be recorded, including detailed information about related requests (such as request packets, URLs, and parameters), which provides a basis for further defense strategies.

[0078] Taint tracing results: Tracing paths from user input to sensitive data flows in the program where attacks may occur, helping developers understand how vulnerabilities are triggered and exploited.

[0079] Security risk assessment results: Each detected vulnerability will be classified and evaluated based on severity, risk level, etc., to determine the priority and repair strategy of the vulnerability.

[0080] Through the above process, IAST detection results provide detailed security data support for the RASP defense system, which helps to accurately adjust the defense strategy and detection algorithm to achieve more effective attack protection.

[0081] In one embodiment, see Figure 2 , the above-mentioned step S120 may include steps S121 to S123.

[0082] S121. Analyze the IAST dynamic taint analysis data to determine potential attacks and record relevant information of all potential attack behaviors.

[0083] In this embodiment, the relevant information of the potential attack behavior includes the request packet, URL, parameters, call chain and sink point of the potential attack.

[0084] Specifically, the IAST dynamic taint analysis data is subjected to vulnerability identification, anomaly detection, taint analysis, and security risk assessment to identify potential attacks and record relevant information of all potential attack behaviors.

[0085] Anomaly detection involves identifying observations or events in a program that do not conform to expected patterns.

[0086] Security risk assessment is a systematic process used to identify, analyze, and evaluate security risks in an organization. Its purpose is to discover potential security threats and assess their likelihood and impact.

[0087] In this embodiment, dynamic taint analysis data is collected during the operation of the application. This data typically includes untrusted external input data (such as user input, network requests) and sensitive data (such as database query results). By analyzing this data, vulnerability identification, anomaly detection and taint tracking are performed. The purpose of taint tracking is to trace the flow path of data in the application and identify key data flows that may cause vulnerabilities. In addition to vulnerability identification, security risk assessment is also required to determine the severity of the vulnerability and the risk it may cause to the system. This process can help determine which vulnerabilities are most likely to be exploited by attackers, and then focus on high-risk areas. All potential attack behavior information, including request packets, URLs, parameters, call chains, and the sink point that ultimately processes sensitive data, will be recorded in detail. This information is an important basis for subsequent processing and defense strategy formulation.

[0088] S122. Perform enhancement processing on the IAST dynamic stain analysis data to obtain an enhanced result.

[0089] In this embodiment, the enhanced result refers to the result obtained by enhancing the IAST dynamic taint analysis data. Specifically, it refers to the result obtained by modifying, expanding, replacing, and other means of the original data captured by IAST to increase the diversity and complexity of the data, including noise injection, character replacement, data order adjustment, etc.

[0090] Data cleansing can be performed on the raw IAST dynamic taint analysis data collected to remove invalid data or interference information. Furthermore, noise injection can increase data diversity, simulating different attack patterns to test the defense system's ability to respond to various attacks. Data augmentation can modify, transform, or generate new test data based on existing data. This augmented data can help fill gaps in the dataset, especially when certain attack patterns are not fully covered. Augmentation can increase data diversity and improve test coverage.

[0091] S123. Use the enhanced results to test the security protection capabilities of the application, and determine the IAST detection results in combination with the potential attack.

[0092] In this embodiment, the enhanced data is used to proactively send packets to test the security protection capabilities of the target application. This means using data enhancement technology to simulate various attack patterns and verify whether the application can identify and prevent these attacks.

[0093] In addition to enhancing data, the identification and verification of potential attack behaviors are also part of the testing process. By incorporating specific information about potential attacks, it is possible to verify during the testing process whether the application has the ability to prevent these attacks.

[0094] Ultimately, by combining and verifying the aforementioned enhanced data with potential attack information, we can generate comprehensive IAST detection results, which not only help identify known vulnerabilities but also reveal the application's security protection mechanisms' ability to respond to unknown attacks.

[0095] The goal of step S120 is to comprehensively improve the accuracy and completeness of IAST detection results through dynamic taint analysis technology and data enhancement methods. By recording and analyzing the security status of applications in detail, especially identifying and verifying potential attacks, combined with the diversity and accuracy of data enhancement, the accuracy of the RASP defense algorithm can be significantly improved, effectively enhancing the overall security protection capabilities of the system.

[0096] This process not only optimizes vulnerability identification but also enhances the flexibility and adaptability of defense mechanisms, ensuring appropriate responses in different attack scenarios.

[0097] The above steps S110 to S120 belong to the IAST detection process, and S100 dynamically collects untrusted data sources and sensitive data flows:

[0098] During application runtime, a pre-implanted agent plug-in monitors and records all data sources entering the application in real time, particularly those that may contain untrusted information, such as user input and network requests. This agent not only captures this data but also marks it as potentially tainted and tracks its flow within the application until it reaches the sink. The agent then conducts in-depth analysis of the acquired dynamic tainted data, leveraging static analysis combined with actual runtime data flows to identify potential security vulnerabilities and anomalous behavior patterns. This includes, but is not limited to, common web application security threats such as SQL injection and cross-site scripting (XSS). Furthermore, the agent records the details of each potential attack attempt, including the specific request packet content, involved URLs, parameter values, call chain, and the final triggered sink location. This detailed information helps determine the exact attack path and is provided to the RASP module as a basis for defensive decisions. A series of data augmentation techniques are performed on the raw tainted data collected by IAST, including removing redundant or erroneous data (data cleaning), adding random noise to the existing dataset (noise injection), and generating new sample instances based on the existing data (data augmentation). This not only improves the overall quality of the dataset but also increases its diversity, making the models or algorithms trained on this data more robust and generalizable, thereby enhancing the overall protection system's ability to respond to unknown threats. After data enhancement, this high-quality data is used to verify the effectiveness of identified vulnerabilities by simulating real-world attack scenarios. This phase pays special attention to the difficulty of successfully exploiting the vulnerability and its propagation path throughout the system to assess its true threat level. Furthermore, based on these verification results, existing protection strategies are adjusted and refined to ensure that even seemingly minor vulnerabilities that could cause significant damage are promptly and effectively patched, thereby improving overall application security.

[0099] S130. Monitor the runtime behavior of the application in real time and intercept attack behaviors.

[0100] In this embodiment, the runtime behavior of the application is monitored in real time. When the runtime behavior triggers the attack behavior interception algorithm, the attack behavior is intercepted and the sink points and request packet information involved are identified and recorded to obtain interception information.

[0101] Specifically, the main goal of step S130 is to monitor the runtime behavior of the application in real time and intercept potential attacks in a timely manner. Once the attack behavior interception algorithm is triggered during the application's operation, the system will immediately activate the defense mechanism and take interception measures, while also recording detailed information about the attack behavior.

[0102] First, the system continuously monitors the application's operating status, including user input, external requests, data flow, etc. By monitoring the application's behavior, the system can identify potential abnormal activities or attack patterns, such as malicious input and unauthorized data access.

[0103] Next, when specific attack behaviors are detected (such as SQL injection, XSS, buffer overflow, etc.), the system's interception algorithms are triggered. Attack behaviors typically manifest as unexpected operation patterns or dangerous input data. When certain behaviors match known attack patterns, the system immediately identifies them and prepares to take appropriate interception measures.

[0104] Once an attack is identified, the system immediately takes defensive action. This may include denying malicious requests, restricting access, or simply blocking suspicious operations. By promptly intercepting attacks, the system can effectively prevent potential security threats and avoid damage to applications and data.

[0105] When intercepting an attack, the system also records detailed information, particularly information related to "sink points." Sink points are code snippets or functions within a program that ultimately process sensitive data. When an attack reaches these sensitive code paths, the system identifies these sink points and records information such as the request packet, parameters, and call chain. This information facilitates subsequent security analysis and response, and provides valuable data support for improving defense mechanisms.

[0106] Ultimately, all relevant information about the attack (such as the reason for the interception, the sink points involved, the attack request packet, etc.) will be compiled into interception information. This information will help developers or security teams understand the specific methods of the attack and the attacker's behavior patterns, providing strong support for further optimizing RASP protection strategies and IAST detection modules.

[0107] Through the above steps, S130 achieves real-time behavior monitoring and attack interception, which can not only prevent ongoing attacks but also provide key data for subsequent security analysis and improvements.

[0108] S140. Determine the credibility of the interception based on the IAST detection results, dynamically adjust the defense strategy according to the vulnerability level, and intercept the attack behavior in combination with the filtering algorithm.

[0109] In one embodiment, see Figure 3 , the above-mentioned step S140 may include steps S141 to S147.

[0110] S141. Determine whether the interception information is in the IAST detection result and the call chain is complete.

[0111] First, the system needs to confirm whether the intercepted information is present in the IAST detection module's results and ensure the integrity of the call chain. Call chain integrity refers to whether the attack path from user input to the final sink point that processes sensitive data. Without a complete call chain, it may be impossible to determine the attack propagation path, increasing the risk of misjudgment.

[0112] S142. If the interception information is in the IAST detection result and the call chain is complete, determine whether the interception information contains an IAST dynamic hierarchical call.

[0113] If the interception information is indeed included in the IAST detection results and the call chain is complete, the system will further analyze the interception information to see if there are dynamic classification calls. IAST dynamic classification calls refer to the classification of vulnerabilities based on their actual difficulty of exploitation to determine the severity of the vulnerability.

[0114] S143. If the interception information contains an IAST dynamic decomposition call, determine whether the vulnerability level corresponding to the interception information has changed.

[0115] In this embodiment, when a dynamic classification call is detected, the system will determine whether the vulnerability level has changed. If the severity of the vulnerability has changed, it means that the difficulty of its exploitation has changed, which may affect the interception strategy.

[0116] Specifically, after the enhancement, it is determined whether the vulnerability level has changed compared to the vulnerability level before the enhancement; if the vulnerability level is improved or remains unchanged, the request will still be intercepted; if the vulnerability level is downgraded, the judgment will continue to be executed.

[0117] S144. If the vulnerability level corresponding to the intercepted information changes, the RASP filtering algorithm is used to determine whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters.

[0118] In this embodiment, if the vulnerability level changes, the system will further check whether the parameters entering the sink point contain malicious payload characters through the RASP filtering algorithm. Malicious payloads usually refer to the manipulation of the program by inputting improper data (for example, injecting malicious scripts or SQL queries, etc.). If malicious characters are detected, the system will be considered a vulnerability.

[0119] S145. If the parameters entering the sink point corresponding to the interception information contain malicious payload characters, it is determined that there is a vulnerability and the attack behavior is intercepted.

[0120] If the parameters entering the sink point in S144 contain malicious payload characters, it indicates that this behavior is an attack. At this time, the system will determine that there is a vulnerability and intercept the attack behavior to prevent further exploitation of the vulnerability.

[0121] S146. If the interception information is not in the IAST detection result and / or the call chain is incomplete, then the vulnerability algorithm with low threat level and easy to cause false detection is relaxed.

[0122] If the interception information is not included in the IAST detection results, or the call chain is incomplete, the system will relax the inspection of some lower-threat vulnerability algorithms (such as reflected XSS vulnerability algorithms). This can reduce false positives and unnecessary interceptions, ensuring that normal user behavior is not accidentally affected.

[0123] This vulnerability algorithm refers to the algorithm used to identify vulnerabilities in the IAST dynamic taint analysis data. In some cases, the vulnerability is very easy to exploit, allowing attackers to exploit it in a very simple way, perhaps even by exploiting common input flaws (such as reflected XSS vulnerabilities). However, exploiting these vulnerabilities does not lead to serious consequences, and the attacker may not have a chance of successfully attacking. Therefore, for these low-threat vulnerabilities, the system does not require excessively strict defenses.

[0124] Some vulnerability algorithms may misidentify legitimate actions as attacks. For example, some common vulnerabilities (such as XSS and SQL injection) may trigger false positives with normal input, especially when the call chain is incomplete or IAST doesn't fully cover certain inputs. This misdetection can cause the system to misidentify normal user operations as attacks, disrupting normal application operations.

[0125] The relaxation strategy generally involves adjusting the priority of detected vulnerabilities and using looser rules for low-threat vulnerabilities to reduce false positives. For these low-threat vulnerabilities, the following strategies are adopted:

[0126] Reduced interception severity: For low-threat vulnerabilities, only a warning may be issued instead of mandatory interception. This is because the exploitation of these vulnerabilities is not serious and interception may affect normal business processes.

[0127] Ignore certain input detection: For some common and low-risk vulnerabilities (such as reflected XSS), the system may relax input filtering and no longer strictly intercept them to reduce false positives.

[0128] Adaptive rules: Based on dynamic analysis, the system can flexibly adjust defense strategies based on the actual exploitation of vulnerabilities. If a vulnerability is not actually exploited, the system can choose to relax defenses instead of blocking it directly.

[0129] The goal of relaxing measures is to provide more efficient protection while avoiding disruption to normal business processes. The previous steps emphasized identifying attack paths through checking the integrity of the call chain and dynamic IAST detection results. If the call chain is incomplete or the attack path is unclear, the defense strategy may be adjusted to be more relaxed to avoid inadvertent interception of legitimate operations.

[0130] In dynamic grading, vulnerability levels are adjusted based on attack difficulty and actual impact. If the vulnerability poses a lower threat, the system will reduce the intensity of interception to avoid excessive interference with normal operations.

[0131] In the previous step, if malicious payload characters are detected, it indicates an actual attack and the system will trigger the defense mechanism to intercept it. In S146, if the system determines that the threat of the vulnerability is low and unlikely to be actually exploited, it will relax the detection of such vulnerabilities to avoid unnecessary interference.

[0132] Relaxing the algorithm for vulnerabilities with low threat levels and high risk of false positives is closely related to the previous steps. It further optimizes previously detected vulnerabilities. The goal is to reduce false positives by dynamically adjusting defense strategies, ensuring a positive user experience and normal business processes without sacrificing defense effectiveness.

[0133] S147. If the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters, it is determined that there is no vulnerability and the runtime behavior of the application is released.

[0134] If no malicious payload characters are found in S144, the request is normal. At this point, the system will determine that there is no vulnerability, allow the application to run normally, and release the request.

[0135] If the vulnerability level corresponding to the interception information has not changed, executing step S145;

[0136] If the interception information does not contain an IAST dynamic decomposition call, step S145 is executed.

[0137] The above steps are achieved by combining the detection results of the IAST detection module with methods such as dynamic classification, call chain integrity, and malicious payload detection, combined with the filtering algorithm of the RASP protection module, to dynamically adjust the defense strategy. This approach can effectively improve the accuracy of the system's defense. Specifically, it enhances the intelligence and precision of defense through the following key points:

[0138] Call chain integrity: Ensures that the attack path from user input to sink point can be fully traced to reduce misjudgments.

[0139] Dynamic adjustment of vulnerability levels: Dynamically adjust defense strategies based on the severity of the vulnerability to reduce false interceptions in low-threat situations.

[0140] Malicious payload detection: The RASP filtering algorithm is used to ensure that the parameters entering the sink point contain malicious payload characters, thereby enhancing the targetedness and accuracy of defense.

[0141] Relaxation strategy: When the call chain is incomplete or not included in the IAST detection results, relax the detection of low-risk vulnerabilities to reduce unnecessary false interceptions.

[0142] This flexible and dynamic adjustment method can significantly improve the accuracy of defense strategies, while enhancing the system's real-time response capabilities to attack behaviors and improving the reliability and effectiveness of the entire security protection system.

[0143] The above steps S130 to S140 detect and block attacks against the application in real time. This module relies on the information provided by the IAST detection module to adjust its defense strategy and decide whether to intercept the attack based on the real-time situation.

[0144] Specifically, RASP monitors application behavior in real time and triggers attack interception algorithms when potential attacks are detected. At this point, RASP records the sink points (i.e., functions that process sensitive data) involved in the attack and detailed information about the request packet. Further analysis of the detected attack behavior includes the following:

[0145] Determine whether the sink point and request packet of this attack behavior are recorded in the IAST detection process, and whether there is a complete call chain from the request function to the sink point. The existence of this call chain can prove the credibility of the attack behavior.

[0146] If the call chain exists, it means that this is a credible attack behavior and needs to be further processed.

[0147] If there is no complete call chain, or the attack behavior is not identified as harmful in IAST, some interception strategies can be relaxed. For example, a relaxed strategy can be adopted for vulnerabilities that are easy to misjudge, such as reflected XSS vulnerabilities.

[0148] We also refer to the dynamic vulnerability classification information provided by IAST to optimize defense strategies:

[0149] If the IAST analysis records a change in the vulnerability level (for example, the vulnerability level has increased or remained unchanged), the request continues to be blocked.

[0150] If the vulnerability level decreases, the threat of this request will be reassessed, and a relatively relaxed defense strategy may be adopted.

[0151] Next, the malicious payload is detected through the RASP filtering algorithm; at this stage, RASP further examines the parameters entering the sink point:

[0152] If the request parameters contain malicious payload characters or the request structure does not conform to normal specifications, the request will be blocked. If no malicious content is detected, the user operation is considered a legitimate request and will not be blocked.

[0153] IAST and RASP each play an important role, but their combination enables more precise application protection. IAST provides dynamic application data flow information and identifies potential vulnerabilities and attack points through dynamic taint analysis. This information enables the RASP module to make decisions based on a more comprehensive data flow and vulnerability analysis when intercepting attacks. RASP intercepts potential attacks by monitoring application behavior in real time and combining it with security data provided by IAST. RASP also adjusts its interception strategy based on dynamic vulnerability information provided by IAST, improving the accuracy and specificity of defense.

[0154] IAST provides detailed application runtime data flow information, which helps the RASP module more accurately identify potential attack behaviors. In this way, RASP can effectively filter out legitimate requests, avoid misjudgments, and intercept potential attacks in a timely manner.

[0155] RASP's real-time intercept feedback will help the IAST module improve its vulnerability analysis and prediction capabilities, thereby enhancing the intelligence and efficiency of the overall defense system. IAST and RASP complement each other, improving system security through continuous feedback and optimization.

[0156] By combining IAST with RASP technology, this solution can significantly improve the security protection capabilities of applications. Combined with IAST's dynamic taint analysis, RASP can obtain more accurate security data input, enabling defense algorithms to make precise decisions based on different attack behaviors and reduce false interceptions. Through data sharing and feedback mechanisms between the two, defense strategies are continuously optimized and can automatically adjust to respond to different levels of attacks, improving the system's automated defense capabilities. By combining IAST's dynamic vulnerability classification with RASP's multi-level interception strategy, the system can more intelligently handle different types of attack behaviors, avoiding misjudgments caused by low-level vulnerabilities.

[0157] In summary, enhancing the accuracy of the RASP defense algorithm based on IAST dynamic taint analysis not only improves the protection capabilities of applications, but also provides development and operations teams with more intelligent and efficient security protection methods.

[0158] The method of this embodiment improves the accuracy of the Runtime Application Self-Protection (RASP) defense algorithm. Specifically, this method integrates the advantages of IAST technology and dynamic taint analysis, and is intended to be achieved through the following steps:

[0159] First, during application execution, a pre-configured agent is used to monitor and record all untrusted data sources and their flow within the application in real time, specifically tracking this data until it reaches an operation point (sink point) that could potentially lead to security issues. This process not only captures external data such as user input and network requests, but also provides foundational data for subsequent security analysis.

[0160] Secondly, the collected dynamic taint data is deeply analyzed and mined to identify potential security vulnerabilities and abnormal behavior patterns. Each possible attack attempt is recorded in detail, including specific request parameters, URL addresses, call links, and sink point locations. The key to this stage is the ability to accurately depict the attack path and provide the RASP module with the necessary decision-making information.

[0161] Next, a series of data augmentation techniques are used to process the original tainted data, such as data cleaning to remove erroneous or redundant information, noise injection to increase dataset diversity, and data expansion to generate new sample instances. These methods improve the quality and richness of the data, thereby making the models or algorithms trained on this data more robust and generalizable.

[0162] Finally, we use this augmented data to simulate real-world attack scenarios, verifying the effectiveness of identified vulnerabilities and adjusting and improving our protection strategies based on the results. This approach ensures that even seemingly minor vulnerabilities that could cause significant damage are promptly and effectively patched, thereby improving overall system security.

[0163] In summary, this embodiment, by combining IAST technology and dynamic taint analysis, can not only provide a more comprehensive understanding of the behavior and data flow of the application, but also provide more accurate data input for RASP dynamic analysis, ultimately achieving the goal of improving the accuracy and effectiveness of the defense algorithm.

[0164] The above-mentioned defense accuracy improvement method based on IAST data enhancement, by inserting an Agent into the application to collect IAST dynamic taint analysis data, the system can accurately identify and verify security vulnerabilities. Based on this data, dynamic taint analysis and data enhancement technology help monitor application behavior in real time and effectively intercept attacks. Combined with the IAST detection results, the system dynamically adjusts the defense strategy according to the vulnerability level, reduces false positives and missed alerts, and improves the protection effect; combined with the precise dynamic taint analysis data provided by IAST technology, the system can collect and verify security vulnerabilities in the application in real time, thereby accurately identifying attack behaviors. IAST's in-depth data analysis helps the RASP module dynamically adjust the defense strategy based on the level and credibility of the vulnerability when monitoring application runtime, and combines filtering algorithms to accurately intercept attacks, significantly improving the accuracy of defense and reducing the occurrence of false positives and missed alerts.

[0165] Figure 4 is a schematic block diagram of a defense accuracy improvement system 300 based on IAST data enhancement provided by an embodiment of the present invention. Figure 4 As shown, corresponding to the above defense accuracy improvement method based on IAST data enhancement, the present invention also provides a defense accuracy improvement system 300 based on IAST data enhancement. The defense accuracy improvement system 300 based on IAST data enhancement includes a unit for executing the above defense accuracy improvement method based on IAST data enhancement, and the system can be configured in a server. Specifically, please refer to Figure 4 The defense accuracy improvement system 300 based on IAST data enhancement includes an acquisition unit 301, a detection unit 302, an interception unit 303 and a processing unit 304.

[0166] The acquisition unit 301 is used to obtain the IAST dynamic taint analysis data collected by the agent inserted in the application when the application is running; the detection unit 302 is used to identify and verify the security vulnerabilities in the application through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain the IAST detection result; the interception unit 303 is used to monitor the runtime behavior of the application in real time and intercept the attack behavior; the processing unit 304 is used to judge the credibility of the interception in combination with the IAST detection result, and dynamically adjust the defense strategy according to the vulnerability level, and intercept the attack behavior in combination with the filtering algorithm.

[0167] In one embodiment, if Figure 5 As shown, the detection unit 302 includes an analysis subunit 3021 , an enhancement processing subunit 3022 and an adjustment subunit 3023 .

[0168] The analysis subunit 3021 is used to analyze the IAST dynamic taint analysis data to determine potential attacks and record relevant information of all potential attack behaviors; the enhancement processing subunit 3022 is used to perform enhancement processing on the IAST dynamic taint analysis data to obtain enhanced results; the adjustment subunit 3023 is used to use the enhanced results to test the security protection capabilities of the application and determine the IAST detection results in combination with the potential attacks.

[0169] In one embodiment, the analysis subunit 3021 is used to perform vulnerability identification, anomaly detection, taint analysis and security risk assessment on the IAST dynamic taint analysis data to determine potential attacks and record relevant information of all potential attack behaviors.

[0170] In one embodiment, the interception unit 303 is used to monitor the runtime behavior of the application in real time. When the runtime behavior triggers the attack behavior interception algorithm, the attack behavior is intercepted and the sink points and request packet information involved are identified and recorded to obtain interception information.

[0171] In one embodiment, if Figure 6 As shown, the processing unit 304 includes a first judgment subunit 3041 , a second judgment subunit 3042 , a third judgment subunit 3043 , a fourth judgment subunit 3044 , an interception determination subunit 3045 , a relaxation subunit 3046 and a release subunit 3047 .

[0172] The first judgment subunit 3041 is used to judge whether the interception information is in the IAST detection result and the call chain is complete. The second judgment subunit 3042 is used to judge whether the interception information contains an IAST dynamic hierarchical call if the interception information is in the IAST detection result and the call chain is complete. The third judgment subunit 3043 is used to judge whether the vulnerability level corresponding to the interception information has changed if the interception information contains an IAST dynamic decomposition call. The fourth judgment subunit 3044 is used to judge whether the parameters entering the sink point corresponding to the interception information contain malicious payload characters through the RASP filtering algorithm if the vulnerability level corresponding to the interception information has changed. The interception determination subunit 3045 is used to determine the existence of a vulnerability and intercept the attack behavior if the parameters entering the sink point corresponding to the interception information contain malicious payload characters. The relaxation subunit 3046 is used to relax the vulnerability algorithm with low threat level and easy to produce false detection if the interception information is not in the IAST detection result and / or the call chain is incomplete. The release sub-unit 3047 is used to determine that there is no vulnerability and release the runtime behavior of the application if the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters.

[0173] It should be noted that those skilled in the art can clearly understand that the specific implementation process of the above-mentioned defense accuracy improvement system 300 based on IAST data enhancement and each unit can refer to the corresponding description in the aforementioned method embodiment. For the convenience and conciseness of the description, it will not be repeated here.

[0174] The above-mentioned defense accuracy improvement system 300 based on IAST data enhancement can be implemented in the form of a computer program. The computer program can be used in Figure 7 Runs on the computer equipment shown.

[0175] See also Figure 7 , Figure 7 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device 500 may be a server, wherein the server may be an independent server or a server cluster composed of multiple servers.

[0176] See Figure 7 The computer device 500 includes a processor 502 , a memory, and a network interface 505 connected via a system bus 501 , wherein the memory may include a non-volatile storage medium 503 and an internal memory 504 .

[0177] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can cause the processor 502 to execute a defense accuracy improvement method based on IAST data enhancement.

[0178] The processor 502 is used to provide computing and control capabilities to support the operation of the entire computer device 500.

[0179] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can execute a defense accuracy improvement method based on IAST data enhancement.

[0180] The network interface 505 is used to communicate with other devices through the network. Figure 7 The structure shown in the figure is merely a block diagram of a portion of the structure related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0181] The processor 502 is configured to execute a computer program 5032 stored in the memory to implement the following steps:

[0182] When the application is running, the IAST dynamic taint analysis data collected by the agent inserted in the application is obtained; based on the IAST dynamic taint analysis data, dynamic taint analysis and data enhancement technology are used to identify and verify security vulnerabilities in the application to obtain IAST detection results; the runtime behavior of the application is monitored in real time, and attack behaviors are intercepted; the credibility of the interception is judged based on the IAST detection results, and the defense strategy is dynamically adjusted according to the vulnerability level, and the attack behavior is intercepted in combination with the filtering algorithm.

[0183] Among them, the IAST dynamic taint analysis data includes untrusted data sources and sensitive data flows when the application is running.

[0184] In one embodiment, when the processor 502 implements the step of identifying and verifying security vulnerabilities in the application through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain an IAST detection result, the processor 502 specifically implements the following steps:

[0185] Analyze the IAST dynamic taint analysis data to determine potential attacks and record relevant information of all potential attack behaviors; enhance the IAST dynamic taint analysis data to obtain enhanced results; use the enhanced results to test the security protection capabilities of the application, and determine the IAST detection results in combination with the potential attacks.

[0186] In one embodiment, when the processor 502 implements the step of analyzing the IAST dynamic taint analysis data to determine potential attacks and recording relevant information of all potential attack behaviors, it specifically implements the following steps:

[0187] Vulnerability identification, anomaly detection, taint analysis, and security risk assessment are performed on the IAST dynamic taint analysis data to identify potential attacks and record relevant information of all potential attack behaviors.

[0188] The relevant information of the potential attack behavior includes the request packet, URL, parameters, call chain and sink point of the potential attack.

[0189] In one embodiment, the processor 502 implements the following steps when implementing the step of monitoring the runtime behavior of the application in real time and intercepting attack behaviors:

[0190] Monitor the runtime behavior of the application in real time. When the runtime behavior triggers the attack behavior interception algorithm, intercept the attack behavior and identify and record the sink points and request packet information involved to obtain interception information.

[0191] In one embodiment, the processor 502 implements the following steps when determining the credibility of interception in combination with the IAST detection results, dynamically adjusting the defense strategy according to the vulnerability level, and intercepting the attack behavior in combination with the filtering algorithm:

[0192] Determine whether the interception information is in the IAST detection result and the call chain is complete; if the interception information is in the IAST detection result and the call chain is complete, determine whether the interception information has an IAST dynamic hierarchical call; if the interception information has an IAST dynamic decomposition call, determine whether the vulnerability level corresponding to the interception information has changed; if the vulnerability level corresponding to the interception information has changed, determine whether the parameters entering the sink point corresponding to the interception information contain malicious payload characters through the RASP filtering algorithm; if the parameters entering the sink point corresponding to the interception information contain malicious payload characters, determine that a vulnerability exists and intercept the attack behavior.

[0193] In one embodiment, after implementing the step of determining whether the interception information is in the IAST detection result and completing the call chain, the processor 502 further implements the following steps:

[0194] If the interception information is not in the IAST detection result and / or the call chain is incomplete, the vulnerability algorithm with low threat level and easy to cause false detection is relaxed.

[0195] In one embodiment, after implementing the step of determining whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters through the RASP filtering algorithm, the processor 502 further implements the following steps:

[0196] If the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters, it is determined that there is no vulnerability and the runtime behavior of the application is released.

[0197] It should be understood that in the embodiment of the present application, the processor 502 may be a central processing unit (CPU) 304. The processor 502 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0198] Those skilled in the art will appreciate that all or part of the steps in the method of the above-described embodiment can be implemented by instructing the relevant hardware through a computer program. The computer program includes program instructions, which can be stored in a storage medium that is computer-readable. The program instructions are executed by at least one processor in the computer system to implement the steps in the method of the above-described embodiment.

[0199] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, wherein when the computer program is executed by a processor, the processor performs the following steps:

[0200] When the application is running, the IAST dynamic taint analysis data collected by the agent inserted in the application is obtained; based on the IAST dynamic taint analysis data, dynamic taint analysis and data enhancement technology are used to identify and verify security vulnerabilities in the application to obtain IAST detection results; the runtime behavior of the application is monitored in real time, and attack behaviors are intercepted; the credibility of the interception is judged based on the IAST detection results, and the defense strategy is dynamically adjusted according to the vulnerability level, and the attack behavior is intercepted in combination with the filtering algorithm.

[0201] Among them, the IAST dynamic taint analysis data includes untrusted data sources and sensitive data flows when the application is running.

[0202] In one embodiment, when the processor executes the computer program to implement the step of identifying and verifying security vulnerabilities in the application through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain an IAST detection result, the processor specifically implements the following steps:

[0203] Analyze the IAST dynamic taint analysis data to determine potential attacks and record relevant information of all potential attack behaviors; enhance the IAST dynamic taint analysis data to obtain enhanced results; use the enhanced results to test the security protection capabilities of the application, and determine the IAST detection results in combination with the potential attacks.

[0204] In one embodiment, when the processor executes the computer program to implement the steps of analyzing the IAST dynamic taint analysis data to determine potential attacks and recording relevant information of all potential attack behaviors, the processor specifically implements the following steps:

[0205] Vulnerability identification, anomaly detection, taint analysis, and security risk assessment are performed on the IAST dynamic taint analysis data to identify potential attacks and record relevant information of all potential attack behaviors.

[0206] The relevant information of the potential attack behavior includes the request packet, URL, parameters, call chain and sink point of the potential attack.

[0207] In one embodiment, when the processor executes the computer program to implement the step of real-time monitoring of the runtime behavior of the application program and intercepting attack behavior, the processor specifically implements the following steps:

[0208] Monitor the runtime behavior of the application in real time. When the runtime behavior triggers the attack behavior interception algorithm, intercept the attack behavior and identify and record the sink points and request packet information involved to obtain interception information.

[0209] In one embodiment, when the processor executes the computer program to implement the steps of determining the credibility of interception in combination with the IAST detection results, dynamically adjusting the defense strategy according to the vulnerability level, and intercepting the attack behavior in combination with the filtering algorithm, the processor specifically implements the following steps:

[0210] Determine whether the interception information is in the IAST detection result and the call chain is complete; if the interception information is in the IAST detection result and the call chain is complete, determine whether the interception information has an IAST dynamic hierarchical call; if the interception information has an IAST dynamic decomposition call, determine whether the vulnerability level corresponding to the interception information has changed; if the vulnerability level corresponding to the interception information has changed, determine whether the parameters entering the sink point corresponding to the interception information contain malicious payload characters through the RASP filtering algorithm; if the parameters entering the sink point corresponding to the interception information contain malicious payload characters, determine that a vulnerability exists and intercept the attack behavior.

[0211] In one embodiment, after executing the computer program to implement the step of determining whether the interception information is in the IAST detection result and completing the call chain, the processor further implements the following steps:

[0212] If the interception information is not in the IAST detection result and / or the call chain is incomplete, the vulnerability algorithm with low threat level and easy to cause false detection is relaxed.

[0213] In one embodiment, after executing the computer program to implement the step of determining whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters through the RASP filtering algorithm, the processor further implements the following steps:

[0214] If the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters, it is determined that there is no vulnerability and the runtime behavior of the application is released.

[0215] The storage medium may be any computer-readable storage medium that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disk.

[0216] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the composition and steps of each example according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0217] In the several embodiments provided herein, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the various units is merely a logical functional division, and actual implementations may employ other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be omitted or not implemented.

[0218] The steps in the method of the embodiment of the present invention may be adjusted in order, combined, or deleted as needed. The units in the system of the embodiment of the present invention may be combined, divided, or deleted as needed. In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit 304, each unit may exist physically separately, or two or more units may be integrated into a single unit.

[0219] If this integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the existing technology, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, terminal, or network device, etc.) to execute all or part of the steps of the method described in various embodiments of the present invention.

[0220] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. The defense accuracy improvement method based on IAST data enhancement is characterized by: include: When the application is running, obtain the IAST dynamic taint analysis data collected by the agent inserted in the application; Identify and verify security vulnerabilities in the application using dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain IAST detection results; Monitor the runtime behavior of applications in real time and intercept attack behaviors; The credibility of the interception is judged in combination with the IAST detection results, and the defense strategy is dynamically adjusted according to the vulnerability level, and the attack behavior is intercepted in combination with the filtering algorithm.

2. The defense accuracy improvement method based on IAST data enhancement according to claim 1 is characterized in that: The IAST dynamic taint analysis data includes untrusted data sources and sensitive data flows when the application is running.

3. The defense accuracy improvement method based on IAST data enhancement according to claim 1 is characterized in that: The method of identifying and verifying security vulnerabilities in the application through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data to obtain IAST detection results includes: Analyze the IAST dynamic taint analysis data to identify potential attacks and record relevant information about all potential attack behaviors; Performing enhancement processing on the IAST dynamic taint analysis data to obtain an enhanced result; Use the enhanced results to test the security protection capabilities of the application and determine the IAST detection results in combination with the potential attacks.

4. The defense accuracy improvement method based on IAST data enhancement according to claim 1 is characterized in that: The IAST dynamic taint analysis data is analyzed to identify potential attacks and record relevant information about all potential attack behaviors, including: Vulnerability identification, anomaly detection, taint analysis, and security risk assessment are performed on the IAST dynamic taint analysis data to identify potential attacks and record relevant information of all potential attack behaviors.

5. The method for improving defense accuracy based on IAST data enhancement according to claim 4, characterized in that: The relevant information of the potential attack behavior includes the request packet, URL, parameters, call chain and sink point of the potential attack.

6. The method for improving defense accuracy based on IAST data enhancement according to claim 1, characterized in that: The real-time monitoring of application runtime behavior and interception of attack behaviors include: Monitor the runtime behavior of the application in real time. When the runtime behavior triggers the attack behavior interception algorithm, intercept the attack behavior and identify and record the sink points and request packet information involved to obtain interception information.

7. The method for improving defense accuracy based on IAST data enhancement according to claim 6, characterized in that: The reliability of interception is judged in combination with the IAST detection results, and the defense strategy is dynamically adjusted according to the vulnerability level, and the attack behavior is intercepted in combination with the filtering algorithm, including: Determine whether the interception information is in the IAST detection result and the call chain is complete; If the interception information is in the IAST detection result and the call chain is complete, determine whether the interception information contains an IAST dynamic hierarchical call; If the interception information contains an IAST dynamic decomposition call, determine whether the vulnerability level corresponding to the interception information has changed; If the vulnerability level corresponding to the intercepted information changes, the RASP filtering algorithm is used to determine whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters; If the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters, it is determined that there is a vulnerability and the attack behavior is intercepted.

8. The method for improving defense accuracy based on IAST data enhancement according to claim 7, characterized in that: After determining whether the interception information is in the IAST detection result and the call chain is complete, the method further includes: If the interception information is not in the IAST detection result and / or the call chain is incomplete, the vulnerability algorithm with low threat level and easy to cause false detection is relaxed.

9. The method for improving defense accuracy based on IAST data enhancement according to claim 7, characterized in that: After determining whether the parameters entering the sink point corresponding to the intercepted information contain malicious payload characters through the RASP filtering algorithm, the method further includes: If the parameters entering the sink point corresponding to the interception information do not contain malicious payload characters, it is determined that there is no vulnerability and the runtime behavior of the application is released.

10. The defense accuracy improvement system based on IAST data enhancement is characterized by: include: An acquisition unit is used to acquire IAST dynamic taint analysis data collected by an agent inserted into the application while the application is running; A detection unit, configured to identify and verify security vulnerabilities in the application program through dynamic taint analysis and data enhancement technology based on the IAST dynamic taint analysis data, so as to obtain an IAST detection result; The interception unit is used to monitor the runtime behavior of the application in real time and intercept attack behaviors; The processing unit is used to determine the credibility of the interception based on the IAST detection results, dynamically adjust the defense strategy according to the vulnerability level, and intercept the attack behavior in combination with the filtering algorithm.

Images