Code obfuscation method and device, equipment and medium

Abstract

The invention provides a code obfuscation method. The method can be applied to the technical fields of big data and artificial intelligence. The method comprises the steps of obtaining request data sent by a client, inputting the request data into a pre-trained security analysis model, and outputting a risk level of the request data. Presetting a confusion strategies, and performing risk level identification on the a confusion strategies. B confusion strategies with the same risk level as the request data are obtained from the a confusion strategies. And performing feature code extraction on the request data to generate a target feature code of the request data. C obfuscation strategies meeting the target feature code use conditions of the request data are obtained from the a obfuscation strategies. And obtaining d identical obfuscation strategies in the b obfuscation strategies and the c obfuscation strategies, and performing code obfuscation on the target feature code of the request data according to the d obfuscation strategies. The invention further provides a code obfuscation device and equipment, a storage medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of big data technology, specifically to the field of artificial intelligence technology, and more particularly to a code obfuscation method, apparatus, device, medium, and program product. Background Art

[0002] With the rapid development of computer technology, enterprises, including banks, have increasingly demanded greater information security. Obfuscation is a key means of information security. In the field of software security, obfuscation involves using various techniques to make source code difficult to understand or decompile.

[0003] The obfuscation strategies in the existing technology have the following shortcomings: the obfuscation strategies are single and lack flexibility; the obfuscation algorithms are inefficient and easy to be cracked; and they lack intelligence and cannot adapt to the rapid changes in the network environment. Summary of the Invention

[0004] In view of the above problems, the present disclosure provides a code obfuscation method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a code obfuscation method is provided, the method including obtaining request data sent by a client, inputting the request data into a pre-trained security analysis model, and outputting a risk level of the request data; presetting a obfuscation strategies, and performing risk level identification on the a obfuscation strategies, wherein a is greater than 1 and is an integer; obtaining b obfuscation strategies with the same risk level as the request data from the a obfuscation strategies, wherein b is less than or equal to a, b is greater than 1, and b is an integer; performing feature code extraction on the request data to generate a target feature code of the request data; obtaining c obfuscation strategies that meet the target feature code usage conditions of the request data from the a obfuscation strategies, wherein c is less than or equal to a, c is greater than 1, and c is an integer; and obtaining d obfuscation strategies that are the same from the b obfuscation strategies and the c obfuscation strategies, and performing code obfuscation on the target feature code of the request data according to the d obfuscation strategies, wherein d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer.

[0006] According to an embodiment of the present disclosure, risk level identification is performed on the a obfuscation strategies, including: obtaining the computing resource occupancy rate of each of the a obfuscation strategies when it is running; sorting the computing resource occupancy rate of each of the a obfuscation strategies when it is running to generate a obfuscation strategy sequence; and sequentially identifying the risk level of the a obfuscation strategies based on the a obfuscation strategy sequence.

[0007] According to an embodiment of the present disclosure, target feature code extraction is performed on the request data to generate the target feature code of the request data, including: performing natural language processing on the request data to generate multiple request data features; inputting the multiple request data features into a pre-trained data feature analysis model to output target feature data; and performing code extraction on the target feature data to generate the target feature code of the request data.

[0008] According to an embodiment of the present disclosure, code obfuscation is performed on the target feature code of the request data according to the d obfuscation strategies, including: obtaining a server load rate and a network idle rate, and based on the server load rate and the network idle rate, obtaining e obfuscation strategies from the d obfuscation strategies to perform code obfuscation on the target feature code of the request data, wherein e is less than or equal to d, e is greater than 1, and e is an integer.

[0009] According to an embodiment of the present disclosure, code obfuscation is performed on the target feature code of the request data according to the d obfuscation strategies, including: obtaining f obfuscation strategies from the d obfuscation strategies according to Bayesian optimization to perform code obfuscation on the target feature code of the request data, wherein f is less than or equal to d, f is greater than 1, and f is an integer.

[0010] According to an embodiment of the present disclosure, the obfuscation strategy includes at least one of: variable name replacement, code logic obfuscation, string encryption, control flow transformation, instruction replacement, dead code insertion, and interface encapsulation.

[0011] According to a second aspect of the present disclosure, a code obfuscation device is provided, which includes: a first acquisition module, used to acquire request data sent by a client, input the request data into a pre-trained security analysis model, and output the risk level of the request data; a first identification module, used to preset a obfuscation strategies and identify the risk levels of the a obfuscation strategies, wherein a is greater than 1 and is an integer; a second acquisition module, used to acquire b obfuscation strategies with the same risk level as the request data from the a obfuscation strategies, wherein b is less than or equal to a, b is greater than 1, and b is an integer; a first generation module, used to extract feature codes from the request data and generate target feature codes of the request data; a third acquisition module, used to acquire c obfuscation strategies that meet the usage conditions of the target feature codes of the request data from the a obfuscation strategies, wherein c is less than or equal to a, c is greater than 1, and c is an integer; and a code obfuscation module, used to acquire d obfuscation strategies that are the same as the b obfuscation strategies and the c obfuscation strategies, and perform code obfuscation on the target feature codes of the request data according to the d obfuscation strategies, wherein d is less than or equal to b, d is less than or equal to c, d is greater than 1 and is an integer.

[0012] According to an embodiment of the present disclosure, the first identification module includes: a fourth acquisition module, used to obtain the computing resource occupancy rate of each of the a obfuscation strategies during operation; a second generation module, used to sort the computing resource occupancy rate of each of the a obfuscation strategies during operation to generate a obfuscation strategy sequence; and a second identification module, used to sequentially identify the risk levels of the a obfuscation strategies based on the a obfuscation strategy sequences.

[0013] According to an embodiment of the present disclosure, the first generation module includes: a third generation module, used to perform natural language processing on the request data to generate multiple request data features; a fourth generation module, used to input the multiple request data features into a pre-trained data feature analysis model to output target feature data; and a fifth generation module, used to perform code extraction on the target feature data to generate a target feature code for the request data.

[0014] According to a third aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned code obfuscation method.

[0015] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which executable instructions or computer programs are stored. When the instructions or computer programs are executed by a processor, the processor executes the above-mentioned code obfuscation method.

[0016] According to a fifth aspect of the present disclosure, a computer program product is further provided, including a computer program, which implements the above-mentioned code obfuscation method when executed by a processor.

[0017] This disclosure achieves precise matching of dynamic obfuscation by integrating two orthogonal dimensions: risk level mapping and feature code adaptation. Based on a dual-strategy screening mechanism, it strikes a balance between security strength and system performance. By dynamically adjusting the obfuscation strategy, the effectiveness and efficiency of obfuscation are improved. This also improves the reliability of code obfuscation defense, conserves computing resources, and improves the efficiency of data defense. It addresses the technical issues in existing technologies, such as the single obfuscation strategy and lack of flexibility; the inefficient obfuscation algorithm, which is easily cracked; and the lack of intelligence and inability to adapt to rapidly changing network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0019] Figure 1A diagram schematically illustrates an application scenario of the code obfuscation method and device according to an embodiment of the present disclosure;

[0020] Figure 2 The following schematically shows a flow chart of a code obfuscation method according to an embodiment of the present disclosure;

[0021] Figure 3 A flowchart of risk level identification in a code obfuscation method according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 4 The flowchart of generating a target characteristic code in the code obfuscation method according to an embodiment of the present disclosure is schematically shown;

[0023] Figure 5 Schematically shows a structural block diagram of a code obfuscation device according to an embodiment of the present disclosure; and

[0024] Figure 6 A block diagram of an electronic device suitable for implementing a code obfuscation method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0028] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0029] The accompanying drawings illustrate some block diagrams and / or flow charts. It should be understood that some blocks in the block diagrams and / or flow charts, or combinations thereof, may be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable control device, so that when executed by the processor, these instructions may create a device for implementing the functions / operations described in the block diagrams and / or flow charts.

[0030] First, let’s explain the technical terms that appear in this article as follows:

[0031] Gateway: In network communications, a gateway is a device that acts as a communication node, forwarding data between different networks or protocols.

[0032] Obfuscation strategy: refers to a security measure in the field of software security that uses various technical means to make source code difficult to understand or decompile.

[0033] Dynamic obfuscation algorithm: an algorithm that performs real-time obfuscation of code while the program is running to improve code security.

[0034] Artificial Intelligence: refers to the intelligence displayed by systems created by humans.

[0035] Machine learning: A branch of artificial intelligence that refers to techniques that enable computer systems to use data to continuously improve their performance.

[0036] An embodiment of the present disclosure provides a code obfuscation method, which includes: obtaining request data sent by a client, inputting the request data into a pre-trained security analysis model, and outputting the risk level of the request data. Preset a number of obfuscation strategies, and perform risk level identification on the a number of obfuscation strategies, wherein a is greater than 1 and is an integer. Obtain b number of obfuscation strategies with the same risk level as the request data from the a number of obfuscation strategies, wherein b is less than or equal to a, b is greater than 1, and b is an integer. Perform feature code extraction on the request data to generate a target feature code for the request data. Obtain c number of obfuscation strategies that meet the target feature code usage conditions of the request data from the a number of obfuscation strategies, wherein c is less than or equal to a, c is greater than 1, and c is an integer. And obtain d number of obfuscation strategies that are the same among the b and c number of obfuscation strategies, and perform code obfuscation on the target feature code of the request data according to the d number of obfuscation strategies, wherein d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer.

[0037] According to the embodiments of the present disclosure, by integrating the two orthogonal dimensions of risk level mapping and feature code adaptation, a balance is made between security strength and system performance based on a dual-strategy screening mechanism, thereby achieving precise matching of dynamic obfuscation. By dynamically adjusting the obfuscation strategy, the effect and efficiency of obfuscation are improved. This also improves the reliability of code obfuscation defense, saves computing resources, and improves the efficiency of data defense. This solves the technical problems in the prior art of single obfuscation strategy and lack of flexibility; low efficiency of obfuscation algorithm and easy cracking; lack of intelligence and inability to adapt to the rapid changes in the network environment.

[0038] Figure 1 The following diagram schematically illustrates an application scenario of the code obfuscation method and device according to an embodiment of the present disclosure. Figure 1 The examples shown are merely examples of scenarios in which the embodiments of the present disclosure can be applied, to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other devices, systems, environments or scenarios.

[0039] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a code obfuscation application scenario. A network 104 is used as a medium for providing a communication link between a first terminal device 101, a second terminal device 102, a third terminal device 103, and a server 105. The network 104 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0040] A user may use a first terminal device 101, a second terminal device 102, or a third terminal device 103 to interact with a server 105 via a network 104 to receive or send messages, etc. Various communication client applications may be installed on the first terminal device 101, the second terminal device 102, or the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (for example only).

[0041] The first terminal device 101 , the second terminal device 102 , and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0042] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal devices.

[0043] It should be noted that the code obfuscation method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the code obfuscation device provided in the embodiments of the present disclosure can generally be set in the server 105. The code obfuscation method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the code obfuscation device provided in the embodiments of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0044] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0045] The following will be based on Figure 1 The scene described by Figures 2 to 4 The code obfuscation method of the disclosed embodiment is described in detail. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0046] Figure 2 The flowchart of the code obfuscation method according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 2 As shown, the method 200 includes steps S201 to S206.

[0048] Step S201: obtain request data sent by the client, input the request data into a pre-trained security analysis model, and output the risk level of the request data.

[0049] For example, the request data sent by the client is fed into a machine learning model that has been trained and loaded from a file or database, and the output is a risk level. The risk level can include: low risk label, medium risk label, and high risk label. The risk level can also be a specific risk value.

[0050] Step S202: preset a obfuscation strategies, and perform risk level identification on the a obfuscation strategies, where a is greater than 1 and a is an integer.

[0051] For example, a number of obfuscation strategies may be preset, including: the obfuscation strategy includes at least one of variable name replacement, code logic obfuscation, string encryption, control flow transformation, instruction replacement, dead code insertion, and interface encapsulation. By performing code obfuscation on at least one of variable name replacement, code logic obfuscation, string encryption, control flow transformation, instruction replacement, dead code insertion, and interface encapsulation, the reliability of code obfuscation can be improved, and defense efficiency can be enhanced.

[0052] Figure 3 The flowchart of risk level identification in the code obfuscation method according to an embodiment of the present disclosure is schematically shown.

[0053] like Figure 3 As shown, the method 300 includes steps S301 to S303.

[0054] Step S301, obtaining the computing resource occupancy rate of each obfuscation strategy in the a obfuscation strategies when it is running.

[0055] Step S302 , sorting the computing resource occupancy of each obfuscation strategy in the a obfuscation strategies during operation to generate a obfuscation strategy sequences.

[0056] Step S303: Based on the a obfuscation strategy sequences, sequentially identify the a obfuscation strategies by risk level.

[0057] For example, you can obtain the computing resource usage of each obfuscation strategy during runtime among a number of obfuscation strategies and sort the strategies from low to high. The 20 percent of strategies with the lowest computing resource usage during runtime are labeled as low risk; the 60 percent of strategies with the middle computing resource usage during runtime are labeled as medium risk; and the 20 percent of strategies with the highest computing resource usage during runtime are labeled as high risk.

[0058] By deeply coupling the strategy risk level identification and resource consumption characteristics, a confusion strategy is sorted in order of resource occupancy and risk through a pre-sorting mechanism, thereby improving the technical effect of confusion effect and efficiency.

[0059] Return to reference Figure 2 In step S203, b obfuscation strategies with the same risk level as the request data are obtained from the a obfuscation strategies, where b is less than or equal to a, b is greater than 1, and b is an integer.

[0060] Step S204: extracting characteristic codes from the request data to generate target characteristic codes for the request data.

[0061] Figure 4 The flowchart of generating a target characteristic code in the code obfuscation method according to an embodiment of the present disclosure is schematically shown.

[0062] like Figure 4 As shown, the method 400 includes steps S401 to S403.

[0063] Step S401: perform natural language processing on the request data to generate multiple request data features.

[0064] For example, performing natural language processing on request data may include: performing grammatical analysis on the request data to generate parameter boundary markers; performing grammatical parsing on the request data to generate a data structure tree; performing semantic reasoning on the request data to generate an intent vector; and merging the parameter boundary markers, data structure tree, and intent vector into multiple request data features.

[0065] Performing natural language processing on the request data may also include: performing natural language processing on the request data to generate the source IP address, request method, URL path, request header information, carried parameters and data, etc. of the request, performing feature extraction on the data after natural language processing, and generating multiple request data features.

[0066] Step S402: input the multiple request data features into a pre-trained data feature analysis model, and output target feature data.

[0067] Step S403: extract the target feature data and generate a target feature code for the request data.

[0068] Through natural language processing and feature refinement mechanisms, deep semantic analysis of data features is achieved, and the transition from raw data to target feature codes is realized, achieving the technical effect of improving obfuscation accuracy.

[0069] Return to reference Figure 2 In step S205, c obfuscation strategies that meet the target feature code usage conditions of the request data are obtained from the a obfuscation strategies, where c is less than or equal to a, c is greater than 1, and c is an integer.

[0070] Step S206: Obtain d identical obfuscation strategies from the b obfuscation strategies and the c obfuscation strategies, and perform code obfuscation on the target feature code of the request data according to the d obfuscation strategies, where d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer.

[0071] In a disclosed embodiment, the server load rate and the network idle rate can be obtained, and based on the server load rate and the network idle rate, e obfuscation strategies out of d obfuscation strategies are obtained to perform code obfuscation on the target feature code of the request data, where e is less than or equal to d, e is greater than 1, and e is an integer.

[0072] For example, real-time decisions can be made based on the real-time server load rate and network idle rate, enabling a lightweight obfuscation strategy when the server is highly loaded and the network is idle at a low rate, and enabling a deep obfuscation strategy when the server is low loaded and the network is idle at a high rate.

[0073] Through server resource perception and dynamic policy adjustment, precise control of obfuscation execution is achieved, which saves computer resources and improves CPU utilization while ensuring the accuracy and reliability of obfuscation.

[0074] In another disclosed embodiment, f obfuscation strategies can be obtained from the d obfuscation strategies according to Bayesian optimization to perform code obfuscation on the target feature code of the request data, where f is less than or equal to d, f is greater than 1, and f is an integer.

[0075] For example, a Bayesian optimization engine can be enabled to build a proxy function, and the acquisition function can be optimized through a security strength prediction model and a performance consumption prediction model to obtain f obfuscation strategies with the optimal strategy combination from d obfuscation strategies.

[0076] By using Bayesian optimization to screen the obfuscation strategies, the reliability and accuracy of obtaining f obfuscation strategies can be improved.

[0077] In addition, after obfuscating the target characteristic code of the requested data, the obfuscated code is sent back to the client as a response. At the same time, a secure obfuscation key is generated during this communication and sent to the client and server through a secure communication channel, ensuring that all three parties can use the same key to obfuscate and deobfuscate the code.

[0078] In a disclosed embodiment, a code obfuscation system is disclosed, which includes: a dynamic obfuscation policy manager: responsible for policy selection and adjustment; an obfuscation algorithm optimizer: responsible for real-time optimization of the algorithm; an intelligent learning module: using artificial intelligence and machine learning technology to learn and adapt; a collaborative work module: realizing collaborative obfuscation between the gateway, the server, and the client.

[0079] The system's specific workflow is to read pre-defined obfuscation policies from files, databases, or configuration services and load them into the gateway. Pre-defined obfuscation policies can be designed based on different security requirements and application scenarios. The following are some obfuscation techniques that may be included in a policy: Variable name substitution: Replacing variable names in the code with meaningless character combinations to reduce code readability. Code logic obfuscation: Transforming code logic, such as replacing simple logical statements with complex algorithms, making it more difficult to understand. String encryption: Encrypting string constants in the code, decrypting them only at runtime to prevent sensitive information from being read directly from the code. Control flow transformation: Changing the program's control flow structure, such as loops and conditionals, to complicate the program's execution path. Instruction substitution: Replacing simple operations with complex instruction sequences, increasing the difficulty of decompilation and understanding. Dead code insertion: Inserting code that will not be executed into the program to confuse attackers and increase the complexity of analysis. API encapsulation: Encapsulating commonly used API calls to hide specific implementation details. Code reorganization: Splitting the code into multiple parts and recombining them in non-intuitive ways makes it more difficult to understand the program's functionality directly from the source code. Custom obfuscation algorithms: Developing specific obfuscation algorithms, which may combine multiple obfuscation techniques, to suit specific security requirements. Environment-aware obfuscation: Dynamically adjusting the obfuscation strategy based on the characteristics of the runtime environment (such as the operating system and user permissions).

[0080] Load a trained machine learning model from a file or database. This model will be used for subsequent request analysis and threat level prediction. The intelligent learning module collects feedback from the client, which may include an assessment of the obfuscation effect and the results of the request execution. The collected feedback information is used to update the machine learning model to provide more accurate predictions in future request analysis and policy selection.

[0081] When the gateway is running, it listens for and receives requests from clients. This may be done via HTTP, API calls, or other network communication methods. This communication generates a secure obfuscation key, which is then sent to the client and server via a secure communication channel, ensuring that all three parties can use the same key to obfuscate and deobfuscate the code.

[0082] After receiving a client request, the intelligent learning module uses a loaded machine learning model to analyze the request and predict its threat level. Specifically, when a client (such as a user's web browser or a third-party service) sends a request to an enterprise's application server, the request is first intercepted by the gateway. The gateway's intelligent learning module, a pre-trained machine learning model, then begins its operation. This model is specifically designed to identify and assess potential security threats in network requests. The intelligent learning module analyzes multiple request features, including the source IP address, request method, URL path, request headers, and carried parameters and data. Using these extracted features, the machine learning model predicts the request's threat level. Threat levels can be categorized into several levels, such as low, medium, and high, each corresponding to a different degree of security risk. The model outputs a threat score or direct threat level, which is used to determine the appropriate obfuscation strategy.

[0083] Based on the threat level provided by the intelligent learning module, the Dynamic Obfuscation Policy Manager selects or generates an appropriate obfuscation policy from the loaded policies. Unlike traditional rule-based systems, the AI-driven Dynamic Obfuscation Policy Manager can learn and adapt to new threat patterns in real time.

[0084] The policy manager assesses the current threat level, security posture, and request characteristics, intelligently selecting the most appropriate obfuscation strategy. This is based not only on the threat level but may also consider performance impact, request type, and other contextual information. For example, the policy manager continuously optimizes its detection and prediction capabilities by analyzing large amounts of real-time network traffic and historical data. It identifies new patterns and trends in network behavior. These patterns may include new attack vectors, unknown intrusion methods, or obfuscation requirements not yet covered by existing security measures. For example, it may discover that certain requests, while superficially legitimate, display anomalies in request frequency, data patterns, or source distribution. Once the policy manager identifies a new threat pattern or obfuscation requirement, it enters the policy synthesis phase. In this phase, the policy manager uses its machine learning algorithms, combined with its existing security knowledge base and previous obfuscation strategies, to create a new obfuscation strategy.

[0085] Suppose the policy manager discovers a new attack variant that bypasses traditional defenses by sending specially crafted requests. Based on this information, the policy manager analyzes the characteristics of this new attack, such as special string patterns or unusual parameter combinations in the request. Based on the predicted threat level, the policy manager designs new obfuscation rules, such as deforming and encrypting database query strings, making it difficult for attackers to construct valid injection requests.

[0086] For example, the policy manager analyzes the predictions of machine learning models and introduces context-aware obfuscation strategies, determining which features are most critical for threat detection based on the specific circumstances of the request (such as user behavior, device type, and network environment). For example, if the model finds that specific parameters or header information in the request are strongly correlated with malicious behavior, these elements may become the focus of obfuscation.

[0087] Based on the analysis results, the policy manager designs new variable name replacement rules. These rules may include: replacing the original variable name with randomly generated, meaningless characters; dynamically generating variable names based on the scope and data type of the variable; introducing context-aware variable name replacement, and intelligently selecting replacement names based on other parts of the code.

[0088] The policy manager develops new logic obfuscation techniques, which can include: changing the control flow structure, such as introducing additional loops or conditional branches; using polymorphism and inheritance to increase code complexity; and introducing false logic paths to confuse potential attackers.

[0089] For sensitive data, the policy manager designs encryption schemes, which may include: encrypting string constants and decrypting them only at runtime; using secure encoding techniques, such as Base64 encoding, to hide the true format of the data.

[0090] In addition, obfuscation parameter optimization can also be performed, which can include:

[0091] Obfuscation depth adjustment,The policy manager adjusts the depth of obfuscation based on the characteristics and threat level of the request.,For high-threat requests, a deeper level of obfuscation may be used, while for low-threat requests, the complexity of the obfuscation may be reduced to save resources.

[0092] Obfuscation complexity optimization: The policy manager optimizes the complexity of the obfuscation strategy to balance security and performance. This may include: selecting simpler obfuscation strategies for performance-sensitive applications; and using more complex obfuscation techniques for applications with high security requirements.

[0093] Context-aware tuning: The policy manager may dynamically adjust obfuscation parameters based on the network environment and system load. For example, when the system load is low, the obfuscation complexity can be increased; when the system load is high, it can be reduced to avoid performance bottlenecks.

[0094] Feedback Loop,The policy manager implements a feedback loop to collect data on the effectiveness of new obfuscation rules.,This data will be used to further train the model and optimize the,obfuscation rules and parameters.

[0095] Automated parameter tuning: The policy manager uses automated machine learning techniques, such as Bayesian optimization, to find the best combination of obfuscation parameters. This approach can efficiently find the optimal solution within a limited search space.

[0096] Through the above steps, the policy manager can generate new obfuscation rules and carefully optimize them to provide the highest possible security without sacrificing system performance. This approach makes obfuscation policies more flexible and adaptable, able to cope with a variety of network threats and attack patterns.

[0097] The system uses a dynamic obfuscation policy manager to dynamically select and adjust obfuscation policies based on real-time network conditions and security threats, while the obfuscation algorithm optimizer optimizes these policies in real time to improve the effectiveness and efficiency of obfuscation. The intelligent learning module uses machine learning technology to continuously learn from historical data to predict and adapt to future security threats. The collaborative work module ensures consistency between the gateway, server, and client during the obfuscation and deobfuscation processes, enhancing the security of the entire system. At the same time, the system innovatively implements the ability to dynamically select obfuscation policies based on real-time network traffic and security threat assessments. This dynamism enables the gateway to adapt to ever-changing network environments and attack patterns. Utilizing machine learning algorithms, artificial intelligence models can analyze large amounts of network request data and autonomously generate new obfuscation rules that can provide effective defense against new attack patterns.

[0098] Figure 5 The following schematically shows a structural block diagram of a code obfuscation device according to an embodiment of the present disclosure.

[0099] like Figure 5 As shown, the apparatus 500 includes: a first acquisition module 501 , a first identification module 502 , a second acquisition module 503 , a first generation module 504 , a third acquisition module 505 and a code obfuscation module 506 .

[0100] The first acquisition module 501 is used to obtain the request data sent by the client, input the request data into a pre-trained security analysis model, and output the risk level of the request data. In one embodiment, the first acquisition module 501 can be used to perform step S201 described above, which will not be repeated here.

[0101] The first identification module 502 is configured to preset a obfuscation strategies and identify the risk levels of the a obfuscation strategies, where a is greater than 1 and is an integer. In one embodiment, the first identification module 502 may be configured to execute step S202 described above.

[0102] The first identification module 502 includes: a fourth acquisition module, a second generation module and a second identification module.

[0103] The fourth acquisition module is used to obtain the computing resource occupancy rate of each of the a obfuscation strategies when the obfuscation strategies are running. In one embodiment, the fourth acquisition module can be used to execute step S301 described above, which will not be repeated here.

[0104] The second generation module is used to sort the computing resource occupancy of each of the a obfuscation strategies when running, and generate a obfuscation strategy sequence. In one embodiment, the second generation module can be used to execute step S302 described above, which will not be repeated here.

[0105] The second identification module is used to sequentially identify the risk levels of the a obfuscation strategies based on the a obfuscation strategy sequences. In one embodiment, the second identification module can be used to execute step S303 described above, which will not be repeated here.

[0106] The second acquisition module 503 is configured to acquire, from the a obfuscation strategies, b obfuscation strategies having the same risk level as the request data, where b is less than or equal to a, greater than 1, and is an integer. In one embodiment, the second acquisition module 503 may be configured to execute step S203 described above and will not be further described herein.

[0107] The first generating module 504 is configured to extract a feature code from the request data and generate a target feature code for the request data. In one embodiment, the first generating module 504 may be configured to execute step S204 described above.

[0108] The first generating module 504 includes: a third generating module, a fourth generating module and a fifth generating module.

[0109] The third generating module is configured to perform natural language processing on the request data to generate a plurality of request data features. In one embodiment, the third generating module may be configured to execute step S401 described above, which will not be described in detail here.

[0110] The fourth generating module is configured to input the plurality of request data features into a pre-trained data feature analysis model and output target feature data. In one embodiment, the fourth generating module may be configured to execute step S402 described above, which will not be described in detail here.

[0111] The fifth generating module is configured to extract the code from the target feature data and generate the target feature code of the request data. In one embodiment, the fifth generating module may be configured to execute step S403 described above, which will not be described in detail here.

[0112] The third acquisition module 505 is configured to acquire, from the a obfuscation strategies, c obfuscation strategies that meet the target feature code usage conditions of the request data, where c is less than or equal to a, greater than 1, and is an integer. In one embodiment, the third acquisition module 505 may be configured to execute step S205 described above and will not be further described here.

[0113] Code obfuscation module 506 is configured to obtain d identical obfuscation strategies from the b and c obfuscation strategies, and perform code obfuscation on the target characteristic code of the request data according to the d obfuscation strategies, where d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer. In one embodiment, code obfuscation module 506 may be configured to execute step S206 described above, and will not be further described here.

[0114] According to embodiments of the present disclosure, any multiple modules among the first acquisition module 501, the first identification module 502, the second acquisition module 503, the first generation module 504, the third acquisition module 505, and the code obfuscation module 506 may be combined into a single module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present disclosure, at least one of the first acquisition module 501, the first identification module 502, the second acquisition module 503, the first generation module 504, the third acquisition module 505, and the code obfuscation module 506 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or may be implemented in any one of the three implementation methods of software, hardware, and firmware, or any appropriate combination of any of these. Alternatively, at least one of the first acquisition module 501, the first identification module 502, the second acquisition module 503, the first generation module 504, the third acquisition module 505 and the code obfuscation module 506 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be performed.

[0115] Figure 6 A block diagram of an electronic device suitable for implementing a code obfuscation method according to an embodiment of the present disclosure is schematically shown.

[0116] like Figure 6 As shown, an electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0117] Various programs and data required for the operation of the electronic device 600 are stored in the RAM 603. The processor 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 602 and / or the RAM 603. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and the RAM 603. The processor 601 may also perform various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0118] According to an embodiment of the present disclosure, electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to bus 604. Electronic device 600 may also include one or more of the following components connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN card or modem. Communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. Removable media 611, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 610 as needed, so that computer programs read from the removable media can be installed into storage section 608 as needed.

[0119] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0120] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 602 and / or RAM 603 described above, and / or one or more memories other than ROM 602 and RAM 603.

[0121] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the code obfuscation method provided by the embodiments of the present disclosure.

[0122] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0123] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0124] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from a removable medium 611. When the computer program is executed by the processor 601, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0125] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0127] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0128] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A code obfuscation method, characterized in that: The method includes: Obtaining request data sent by the client, inputting the request data into a pre-trained security analysis model, and outputting a risk level of the request data; Preset a number of obfuscation strategies, and identify the risk levels of the a obfuscation strategies, where a is greater than 1 and is an integer; Obtaining b obfuscation strategies with the same risk level as the requested data from the a obfuscation strategies, where b is less than or equal to a, b is greater than 1, and b is an integer; Extracting feature codes from the request data to generate target feature codes for the request data; Obtaining c obfuscation strategies that meet the target feature code usage condition of the request data from the a obfuscation strategies, where c is less than or equal to a, c is greater than 1, and c is an integer; and Obtaining d identical obfuscation strategies from the b obfuscation strategies and the c obfuscation strategies, and performing code obfuscation on a target feature code of the request data according to the d obfuscation strategies, where d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer.

2. The method according to claim 1, characterized in that The risk level of each obfuscation strategy is identified, including: Obtaining the computing resource occupancy rate of each obfuscation strategy in the a obfuscation strategies when it is running; Sorting the computing resource occupancy of each obfuscation strategy in the a obfuscation strategies during operation to generate a obfuscation strategy sequences; and Based on the a obfuscation strategy sequences, the a obfuscation strategies are sequentially identified by risk level.

3. The method according to claim 1, characterized in that Extracting a target feature code from the request data to generate a target feature code for the request data includes: performing natural language processing on the request data to generate a plurality of request data features; Inputting the plurality of request data features into a pre-trained data feature analysis model and outputting target feature data; and Code extraction is performed on the target feature data to generate a target feature code for the request data.

4. The method according to claim 1, wherein Obfuscating the target characteristic code of the request data according to the d obfuscation strategies includes: Obtain a server load rate and a network idle rate, and based on the server load rate and the network idle rate, obtain e obfuscation strategies from d obfuscation strategies to perform code obfuscation on a target feature code of the request data, where e is less than or equal to d, e is greater than 1, and e is an integer.

5. The method according to claim 1, wherein Obfuscating the target characteristic code of the request data according to the d obfuscation strategies includes: Obtain f obfuscation strategies from the d obfuscation strategies according to Bayesian optimization to perform code obfuscation on the target feature code of the request data, where f is less than or equal to d, f is greater than 1, and f is an integer.

6. The method according to any one of claims 1 to 5, characterized in that The obfuscation strategy includes at least one of: variable name replacement, code logic obfuscation, string encryption, control flow transformation, instruction replacement, dead code insertion, and interface encapsulation.

7. A code obfuscation device, characterized in that: The device includes: A first acquisition module is configured to acquire request data sent by a client, input the request data into a pre-trained security analysis model, and output a risk level of the request data; A first identification module is used to preset a obfuscation strategies and identify the risk levels of the a obfuscation strategies, where a is greater than 1 and a is an integer; A second acquisition module is configured to acquire, from the a obfuscation strategies, b obfuscation strategies having the same risk level as the request data, where b is less than or equal to a, b is greater than 1, and b is an integer; A first generating module is used to extract feature codes from the request data and generate target feature codes for the request data; a third acquisition module, configured to acquire c obfuscation strategies that meet the target feature code usage condition of the request data from the a obfuscation strategies, wherein c is less than or equal to a, c is greater than 1, and c is an integer; and A code obfuscation module is configured to obtain d identical obfuscation strategies from the b obfuscation strategies and the c obfuscation strategies, and perform code obfuscation on a target feature code of the request data according to the d obfuscation strategies, where d is less than or equal to b, d is less than or equal to c, d is greater than 1, and d is an integer.

8. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, The method further comprises the step of executing the one or more computer programs to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images