Abnormity detection method for deserialization attack

Abstract

The invention discloses a deserialization attack anomaly detection method, which comprises the following steps of: collecting events such as calling, returning, object creating, field reading and writing and the like of all methods by a probe, and marking a causal label on each event; the central entropy engine receives the event stream from the probe, constructs and maintains a causal context graph in a system memory in real time, and calculates an entropy change index; and making a release, observation or blocking decision according to the entropy change index calculated by the analysis engine in combination with a predefined or dynamic learning strategy. According to the method, the generic detection of the deserialization attack is realized from the dimensions of behavior intention and context anomaly, and the fundamental defects in the aspects of unknown attack defense, obfuscated code detection, early warning and adaptive ability in the prior art are effectively overcome.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and more specifically, relates to an anomaly detection method for deserialization attacks. Background Technology

[0002] In the field of software security, deserialization vulnerabilities have become a highly threatening attack vector due to their high severity and ease of exploitation. Attackers construct malicious serialized data to trigger unexpected object graph construction and method execution during the target system's deserialization process, thereby achieving malicious purposes such as remote code execution and privilege escalation.

[0003] Current mainstream detection technologies can be mainly divided into the following categories, each with its own significant drawbacks: 1. Signature / rule-based detection technology: This method maintains a blacklist or rule base of known malicious classes, method signatures, or attack patterns (such as Runtime.exec, ProcessBuilder.start), and performs pattern matching during deserialization. Disadvantages: It relies entirely on prior knowledge and cannot identify new attacks not included in the rule base or variants of known attacks. It remains in a reactive and lagging state, allowing attackers to easily bypass static signature detection by obfuscating critical calls using simple techniques such as reflection, dynamic class loading, and method delegation.

[0004] 2. Static Code Analysis (SAST) based detection technology: During the software development phase, this technology analyzes application source code or bytecode to identify code patterns that may pose a risk of insecure deserialization. Disadvantages: Static analysis cannot detect the specific data flow and execution environment during program runtime, leading to a large number of false positives and false negatives. It cannot determine whether a potential vulnerability can actually be triggered and exploited in a production environment.

[0005] 3. Detection techniques based on simple behavior monitoring: Monitor whether "dangerous behaviors" are executed during deserialization, such as executing system commands, file operations, or network connections. Disadvantages: Alerts are only issued during the "final execution stage" of malicious code, by which time the attack may have already succeeded, making it too late. It cannot link a series of scattered, seemingly harmless calls into a complete attack chain. It cannot distinguish whether a ProcessBuilder call originates from an administrator's background operation or from a deserialization attack payload. Summary of the Invention

[0006] In view of the shortcomings of the existing technology, the purpose of this invention is to provide an anomaly detection method for deserialization attacks.

[0007] To achieve the aforementioned objectives, the technical solution adopted by this invention includes: an anomaly detection method for deserialization attacks, comprising: The probe, implemented using Java Agent technology, is embedded into the JVM of the target application. It is activated at the deserialization entry point (such as ObjectInputStream.readObject) and, within a subsequent time window, collects all event data, including method calls, returns, object creation, and field read / write operations, and assigns a causal label to each event. The central entropy engine receives event streams from probes, builds and maintains a causal context graph in system memory in real time, and calculates entropy change metrics. Based on the entropy change index calculated by the analysis engine, combined with predefined or dynamically learned strategies, decisions are made to allow passage, observe, or block passage. The probe, central entropy change analysis engine, strategy and adjudicator are integrated into the same application process as a software library, and high-speed data communication is achieved through in-process function calls and shared memory. In a microservice architecture, the probe is deployed in the business application instance and runs as a sidecar. It serializes the event stream through the local loopback network and sends it to the independently deployed central entropy engine service. The central entropy engine communicates with the policy and adjudicator through RPC or message queues.

[0008] Furthermore, it includes the following steps: A1. Detection Startup and Data Acquisition At the deserialization entry point (such as ObjectInputStream.readObject), the probe is activated, creating a unique monitoring session for this deserialization operation. The probe collects runtime events (method entry / exit, object creation, field read / write, reflection calls, etc.) with extremely low overhead. Each event is encapsulated into a data structure containing event ID, type, method signature, timestamp, and a list of key causal event IDs. A2. Real-time context modeling and entropy calculation Causal Graph Construction: The central analytics engine receives event streams and constructs and maintains a causal context graph G = (V, E) in memory for each session in real time. The engine processes events incrementally and periodically calculates the current graph snapshot based on a fixed time window or an event count window. Bientropy calculation, for each time window t, subgraph G_t, Calculate the structure entropy H_struct(t) to quantify the complexity of the call path within that time period. Calculate the semantic entropy H_semantic(t) to quantify the semantic coherence of the execution path within this time period. A3. Feature Extraction and Intelligent Analysis Based on the currently collected events, the system periodically constructs or updates the causal context graph (e.g., every N events or every T milliseconds) using a sliding window or timed triggering method, and calculates entropy values ​​and feature vectors for real-time or near real-time analysis. The construction and calculation of feature vectors are incremental. Based on the entropy change sequence and causal graph state of the current session, the system periodically extracts a fixed-length feature vector F and inputs F into a pre-trained OCSVM model to obtain an anomaly score. A4. Strategic Decisions and System Evolution Strategy adjudication: The strategy and adjudicator make real-time decisions based on anomaly scores and preset thresholds. Score < θ1 → Normal: Allow this operation. θ1 ≤ Score < θ2 → Suspicious: Allow passage, but record detailed context and report for review by a security analyst. Score ≥ θ2 → Malicious: Immediately terminate the current thread or request and log the complete attack chain context. For suspicious alarms, after confirmation by security operations personnel, the feature vectors of false alarm samples can be added to the dynamic feature library and the incremental training of the model can be triggered to continuously optimize the detection strategy.

[0009] This invention breaks away from the traditional mindset of feature matching and dangerous behavior monitoring. By constructing a causal graph model, introducing information entropy quantification indicators, and employing unsupervised machine learning algorithms, it achieves essential detection of deserialization attacks from the dimensions of behavioral intent and contextual anomalies. This effectively overcomes the fundamental deficiencies of existing technologies in defending against unknown attacks, detecting obfuscated code, providing early warnings, and adaptability.

[0010] Furthermore, step A2, which involves constructing the causal context graph, calculating structural entropy, and calculating semantic entropy, specifically includes: When a deserialization call begins, the probe is activated and starts logging events for a session, each event e containing: e.id: Unique event ID; e.type: Event type (such as METHOD_ENTRY, METHOD_EXIT, FIELD_READ, OBJECT_NEW); `e.signature`: Method signature or field descriptor; `e.timestamp`: Timestamp; `e.cause`: List of causal event IDs, this is crucial. An ENTRY event of a method, whose cause is the ENTRY event of the previous method that triggered it or a specific object creation event; Therefore, a directed graph G = (V, E) is constructed. V: The set of all events; E: Causal relationship, the edge (v_i -> v_j) exists if and only if v_i is in the cause list of v_j; A graph is not simply a call stack; it is a causal network that better reflects the real logical dependencies.

[0011] Furthermore, calculating structural entropy and semantic entropy specifically includes: Structure entropy H_struct: measures the unpredictability of calling the structure; Divide graph G into subgraphs G_t by time slices (e.g., every 100 milliseconds), and calculate the out-degree deg_out(v) of each vertex v in G_t. The structural entropy of this time slice is: H_struct(t) = - Σ_{v ∈ G_t} [P(v) * log2(P(v))], Where P(v) = deg_out(v) / Σ_{v' ∈ G_t} deg_out(v'), P(v) is the probability that the out-degree of node v is equal to the sum of the out-degrees of all nodes in the graph. If a method frequently and unpredictably calls many different methods (such as by invoking multiple unrelated methods through reflection), its structural entropy will increase sharply. Semantic entropy H_semantic: measures the degree of semantic confusion in the execution path. Define a method semantic vector space; each method is mapped to a vector vec(m) based on its package name, class name, and method name through a pre-trained word embedding model (such as Word2Vec on Java SDK & Libs); In time slice G_t, extract all method call sequences S =<m1, m2, ..., mn> ; Calculate the semantic consistency of the sequence: Consistency(S) = (1 / (n-1)) * Σ_{i=1}^{n-1}cosine_similarity(vec(m_i), vec(m_{i+1})); Semantic entropy is defined as: H_semantic(t) = 1 - Consistency(S).

[0012] A well-functioning business logic flow (such as Order.setItem()->Order.calculateTotal()->Order.saveToDB()) has methods that are adjacent in the semantic vector space, resulting in high consistency and low H_semantic. However, an attack chain (such as HashMap.hash()->URLStreamHandler.hashCode()->URL.getURLStreamHandler()->Sun.misc.Launcher()...->Runtime.exec()) jumps to completely unrelated semantic regions, causing H_semantic to spike.

[0013] Furthermore, the training methods for the pre-trained OCSVM model in step A3 include: B1. Environmental preparation: Constructing a clean training sandbox; B2. Data acquisition executes normal business use cases. Write or invoke all known and legitimate business deserialization scenarios, use testing tools to execute these normal test cases intensively and repeatedly, simulate the situation under different loads and parameters, record the complete event flow of each deserialization operation by probes, and finally generate causal context graphs and entropy change sequences; B3. Feature extraction and construction of training sample set For each deserialization operation, following the process during detection, a fixed-length feature vector F is extracted from its causal context graph to form a large training dataset X_train = {F1, F2, ..., Fn}, where each Fn represents a normal deserialization operation; B4. Data Cleaning and Preprocessing Remove the abnormal feature vectors from X_train and scale the data for each feature dimension to the same range; The training objective of B5 and OCSVM is to find a hyperplane that separates most normal data points X_train from the origin while maximizing their distance from the origin. min (0.5 * ||w||^2 + (1 / (νn)) * Σ ζ_i - ρ) st (w · φ(x_i)) ≥ ρ - ζ_i, ζ_i ≥ 0 w is the normal vector of the hyperplane, φ is the kernel function that maps the data to a high-dimensional space (usually using the RBF kernel), ρ is the distance to the origin, ζ_i is the slack variable that allows a small number of samples to fall outside the boundary to avoid overfitting, and ν is the key parameter that roughly represents the upper limit of the proportion of samples that fall "outside" the training boundary (i.e., the proportion considered as anomalies), and is usually set to a very small value, such as 0.01 or 0.05. The cleaned and normalized X_train is input into the OCSVM algorithm for solving. After training, a decision function f(x) is obtained. For a new sample x, the sign of f(x) is used for judgment. f(x) ≥ 0: Determined as normal. f(x) < 0: This is considered an anomaly; B6. Calculate the f(x) value for all samples on the training set X_train, and take its minimum value or a low quantile (e.g., 1%) as the initial discrimination threshold θ. During detection, we compare f(x) with θ, not just 0, to control the false positive rate. Use another set of normal data (validation set) that was not used in training to validate the model's performance, ensuring it can correctly accept all normal behaviors. We can also try injecting some simple anomalous patterns to test its sensitivity. B7. Serialize the trained model (including model parameters, normalizer, and discrimination threshold θ) into a file (such as pickle or pmml), deploy it to the central entropy engine, and load it into system memory.

[0014] Go-live switch: Switch the detection system from "learning mode" to "detection mode" to officially begin real-time analysis and protection of production traffic.

[0015] Furthermore, step B1 specifically includes deploying application systems, dependency libraries, and versions that are completely consistent with the production environment in a sandbox isolated from the production network, deploying probes into the sandbox environment, ensuring that it is in data collection mode, and ensuring that there is absolutely no malicious deserialization attack traffic in the environment, and that all data is known and controlled.

[0016] Compared with the prior art, the advantages of the present invention include: (1) This invention provides an anomaly detection method for deserialization attacks. Traditional detection methods based on signature or rule bases cannot effectively defend against unprecedented (zero-day) deserialization attacks or variants of known attacks. This solution does not rely on any known attack features, but instead uses a single-class support vector machine (OCSVM) to model the behavior of "normal" applications. Any operation that significantly deviates from this normal behavior baseline, regardless of its specific form, will be judged as an anomaly. This fundamentally shifts the defense target from identifying malice to identifying anomalies, thereby possessing the inherent ability to detect unknown attacks.

[0017] (2) The present invention provides an anomaly detection method for deserialization attacks. By constructing a causal context graph instead of a simple call stack, this solution can accurately depict the logical dependencies between methods, objects, and fields, and reconstruct the complete attack chain. By combining the calculation of structural entropy and semantic entropy, it can quantitatively reveal the complexity and disorder of the call path, so that those carefully constructed attack chains that attempt to hide under complex logic are exposed due to their abnormal "entropy change" patterns.

[0018] (3) The present invention provides an anomaly detection method for deserialization attacks, which offers a flexible deployment architecture (in-process integration and sidecar mode), and distributes the computational pressure across multiple time windows through incremental computation and periodic analysis strategies, avoiding computational peaks at a single point. At the same time, the construction of the causal graph and the calculation of entropy are optimized for real-time performance, ensuring near real-time detection and blocking with acceptable performance loss.

[0019] (3) The present invention provides an anomaly detection method for deserialization attacks, which feeds back confirmed false alarms (normal behavior) to a dynamic feature library and triggers incremental training of the model, enabling the OCSVM model to continuously learn new normal patterns of the business system and adaptively adjust its decision boundaries. This transforms the detection system from a static filter into an intelligent agent that can grow with the business and self-optimize, significantly reducing long-term operation and maintenance costs. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of an anomaly detection method for deserialization attacks in this invention; Figure 2This is a flowchart illustrating the training process of the OCSVM model, an anomaly detection method for deserialization attacks, as described in this invention. Detailed Implementation

[0022] In view of the shortcomings of the prior art, the inventors of this invention, through long-term research and extensive practice, have proposed the technical solution of this invention. The technical solution, its implementation process, and principles will be further explained below with reference to the accompanying drawings and specific implementation examples in the embodiments of this application.

[0023] It should be noted that the embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention. The described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, the present invention covers any substitutions, modifications, equivalent methods and solutions made on the spirit, principles and scope of the present invention as defined by the claims. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] In the description of this application, the terms "first," "second," "third," and similar words do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Similarly, the terms "a" or "one," and similar words, do not indicate a quantity limitation, but rather indicate the presence of at least one. The terms "comprising" or "including," and similar words, mean that the elements or objects preceding "comprising" or "including" encompass the elements or objects listed following "comprising" or "including," and their equivalents, but do not exclude other elements or objects. The terms "connected" or "linked," and similar words, are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0025] In the description of this application, the terms "center," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used solely for the convenience of describing this application and for simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this application. Furthermore, when using positional terms such as "both sides," "outer side," and "upper and lower," it should be understood that they are used only for ease of understanding and description, taking into account that the structure may be oriented to other positions.

[0026] In the description of this application, unless otherwise expressly specified and limited, the technical or scientific terms used shall have the ordinary meaning understood by a person with ordinary skills in the art to which this application pertains. Terms such as “installation,” “connection,” and “joining” shall be interpreted broadly, for example, as fixed connection, detachable connection, mating connection, or integral connection. For a person skilled in the art, the specific meaning of the above terms in this application can be understood according to the specific circumstances.

[0027] The present invention aims to introduce and explain the structural composition of an anomaly detection method for deserialization attacks and the cooperation relationship between the components. Unless otherwise specified, the size, material, and manufacturing process of each component in the anomaly detection method suitable for deserialization attacks in the present invention can be selected according to specific circumstances, and no special limitations or explanations are made here.

[0028] Furthermore, to provide the public with a better understanding of the present invention, certain specific details are described in detail in the following description of the invention. However, those skilled in the art will fully understand the invention even without these detailed descriptions.

[0029] Example 1 Please see Figure 1 and Figure 2 An anomaly detection method for deserialization attacks, comprising: The probe, implemented using Java Agent technology, is implanted into the JVM of the target application. It is activated at the deserialization entry point (such as ObjectInputStream.readObject) and collects all method calls, returns, object creations, field reads and writes, and other events within a certain time window thereafter, and labels each event with a causal tag. The central entropy engine receives event streams from probes, builds and maintains a causal context graph in system memory in real time, and calculates entropy change metrics. Based on the entropy change index calculated by the analysis engine, combined with predefined or dynamically learned strategies, decisions are made to allow passage, observe, or block passage. The probe, central entropy change analysis engine, strategy and adjudicator are integrated into the same application process as a software library, and high-speed data communication is achieved through in-process function calls and shared memory. In a microservice architecture, the probe is deployed in the business application instance and runs as a sidecar. It serializes the event stream through the local loopback network and sends it to the independently deployed central entropy engine service. The central entropy engine communicates with the policy and adjudicator through RPC or message queues.

[0030] Furthermore, it includes the following steps: A1. Detection Startup and Data Acquisition At the deserialization entry point (such as ObjectInputStream.readObject), the probe is activated and a unique monitoring session is created for this operation. The probe collects runtime events, and each event is encapsulated into a data structure containing event ID, type, method signature, timestamp, and a list of key causal event IDs. A2. Real-time context modeling and entropy calculation Causal Graph Construction: The central analytics engine receives event streams and constructs and maintains a causal context graph G = (V, E) in memory for each session in real time. The engine processes events incrementally and periodically calculates the current graph snapshot based on a fixed time window or an event count window. Bientropy calculation, for each time window t, subgraph G_t, Calculate the structure entropy H_struct(t) to quantify the complexity of the call path within that time period. Calculate the semantic entropy H_semantic(t) to quantify the semantic coherence of the execution path within this time period. A3. Feature Extraction and Intelligent Analysis Based on the currently collected events, the system periodically constructs or updates the causal context graph (e.g., every N events or every T milliseconds) using a sliding window or timed triggering method, and calculates entropy values ​​and feature vectors for real-time or near real-time analysis. The construction and calculation of feature vectors are incremental. Based on the entropy change sequence and causal graph state of the current session, the system periodically extracts a fixed-length feature vector F and inputs F into a pre-trained OCSVM model to obtain an anomaly score. A4. Strategic Decisions and System Evolution Strategy adjudication: The strategy and adjudicator make real-time decisions based on anomaly scores and preset thresholds. Score < θ1 → Normal: Allow this operation. θ1 ≤ Score < θ2 → Suspicious: Allow passage, but record detailed context and report for review by a security analyst. Score ≥ θ2 → Malicious: Immediately terminate the current thread or request and log the complete attack chain context. For suspicious alarms, after confirmation by security operations personnel, the feature vectors of false alarm samples can be added to the dynamic feature library and the incremental training of the model can be triggered to continuously optimize the detection strategy.

[0031] As an embodiment of the present invention, in addition to the above embodiments, step A2, which involves constructing a causal context graph, calculating structural entropy, and calculating semantic entropy, specifically includes: When a deserialization call begins, the probe is activated and starts logging events for a session, each event e containing: e.id: Unique event ID; e.type: Event type (such as METHOD_ENTRY, METHOD_EXIT, FIELD_READ, OBJECT_NEW); `e.signature`: Method signature or field descriptor; `e.timestamp`: Timestamp; `e.cause`: List of causal event IDs, this is crucial. An ENTRY event of a method, whose cause is the ENTRY event of the previous method that triggered it or the creation event of a specific object. Therefore, a directed graph G = (V, E) is constructed. V: The set of all events; E: Causal relationship, the edge (v_i -> v_j) exists if and only if v_i is in the cause list of v_j; A graph is not simply a call stack; it is a causal network that better reflects the real logical dependencies.

[0032] Furthermore, calculating structural entropy and semantic entropy specifically includes: Structure entropy H_struct: measures the unpredictability of calling the structure; Divide graph G into subgraphs G_t by time slices (e.g., every 100 milliseconds), and calculate the out-degree deg_out(v) of each vertex v in G_t. The structural entropy of this time slice is: H_struct(t) = - Σ_{v ∈ G_t} [P(v) * log2(P(v))], Where P(v) = deg_out(v) / Σ_{v' ∈ G_t} deg_out(v'), P(v) is the probability that the out-degree of node v is equal to the sum of the out-degrees of all nodes in the graph. If a method frequently and unpredictably calls many different methods (such as by invoking multiple unrelated methods through reflection), its structural entropy will increase sharply. Semantic entropy H_semantic: measures the degree of semantic confusion in the execution path. Define a method semantic vector space; each method is mapped to a vector vec(m) based on its package name, class name, and method name through a pre-trained word embedding model (such as Word2Vec on Java SDK & Libs); In time slice G_t, extract all method call sequences S =<m1, m2, ..., mn> ; Calculate the semantic consistency of the sequence: Consistency(S) = (1 / (n-1)) * Σ_{i=1}^{n-1}cosine_similarity(vec(m_i), vec(m_{i+1})); Semantic entropy is defined as: H_semantic(t) = 1 - Consistency(S).

[0033] A well-functioning business logic flow (such as Order.setItem() -> Order.calculateTotal() -> Order.saveToDB()) has methods that are adjacent in the semantic vector space, resulting in high consistency and low H_semantic. However, an attack chain (such as HashMap.hash() -> URLStreamHandler.hashCode() -> URL.getURLStreamHandler() -> Sun.misc.Launcher() ... -> Runtime.exec()) jumps to completely unrelated semantic regions, causing H_semantic to spike.

[0034] As an embodiment of the present invention, in addition to the above embodiments, the training method of the pre-trained OCSVM model in step A3 includes: B1. Environmental preparation: Constructing a clean training sandbox; Specifically, this involves deploying application systems, dependency libraries, and versions completely identical to those in the production environment in a sandbox isolated from the production network. Probes are then deployed into the sandbox environment and placed in data collection mode to ensure that the environment is absolutely free of any malicious deserialization attack traffic, and that all data is known and controlled.

[0035] B2. Data acquisition executes normal business use cases. Write or invoke all known and legitimate business deserialization scenarios, use testing tools to execute these normal test cases intensively and repeatedly, simulate the situation under different loads and parameters, record the complete event flow of each deserialization operation by probes, and finally generate causal context graphs and entropy change sequences; B3. Feature extraction and construction of training sample set For each deserialization operation, following the process during detection, a fixed-length feature vector F is extracted from its causal context graph to form a large training dataset X_train = {F1, F2, ..., Fn}, where each Fn represents a normal deserialization operation; B4. Data Cleaning and Preprocessing Remove outlier feature vectors from X_train and scale the data for each feature dimension to the same range; The training objective of B5 and OCSVM is to find a hyperplane that separates most normal data points X_train from the origin while maximizing their distance from the origin. min (0.5 * ||w||^2 + (1 / (νn)) * Σ ζ_i - ρ) st (w · φ(x_i)) ≥ ρ - ζ_i, ζ_i ≥ 0 w is the normal vector of the hyperplane, φ is the kernel function that maps the data to a high-dimensional space (usually using the RBF kernel), ρ is the distance to the origin, ζ_i is the slack variable that allows a small number of samples to fall outside the boundary to avoid overfitting, and ν is the key parameter that roughly represents the upper limit of the proportion of samples that fall "outside" the training boundary (i.e., the proportion considered as anomalies), and is usually set to a very small value, such as 0.01 or 0.05. The cleaned and normalized X_train is input into the OCSVM algorithm for solving. After training, a decision function f(x) is obtained. For a new sample x, the sign of f(x) is used for judgment. f(x) ≥ 0: Determined as normal. f(x) < 0: This is considered an anomaly; B6. Calculate the f(x) value for all samples on the training set X_train, and take its minimum value or a low quantile (e.g., 1%) as the initial discrimination threshold θ. During detection, we compare f(x) with θ, not just 0, to control the false positive rate. Use another set of normal data (validation set) that was not used in training to validate the model's performance, ensuring it can correctly accept all normal behaviors. We can also try injecting some simple anomalous patterns to test its sensitivity. B7. Serialize the trained model (including model parameters, normalizer, and discrimination threshold θ) into a file (such as pickle or pmml), deploy it to the central entropy engine, and load it into system memory.

[0036] Go-live switch: Switch the detection system from "learning mode" to "detection mode" to officially begin real-time analysis and protection of production traffic.

[0037] This invention possesses an inherent "unknown threat detection" capability, enabling it to defend against undisclosed zero-day attacks and constantly evolving attack methods. This allows the defense system to shift from passive response to proactive defense, always staying one step ahead of attackers and providing a higher level of security for the system.

[0038] By reconstructing the attack chain context using causal graphs and combining this with dual-entropy metrics for quantitative analysis from both structural and semantic dimensions, the true intent of the attack can be profoundly revealed, significantly reducing the false positive rate. Simultaneously, through precise modeling of normal behavior, interference with legitimate business operations can be effectively avoided, ensuring a low false positive rate.

[0039] In this way, by deeply integrating causal graphs, information entropy theory and unsupervised machine learning, a proactive defense system capable of real-time detection, accurate identification and self-evolution has been constructed. This effectively solves the core pain points in current deserialization attack detection and has outstanding substantial progress and broad application prospects.

[0040] It supports two deployment methods: in-process integration (for ultimate performance) and sidecar mode (for microservice architecture), giving the technical solution strong environmental adaptability. This design allows it to be seamlessly integrated into various environments, from traditional monolithic applications to modern cloud-native architectures, and it has good scalability and feasibility.

[0041] The closed-loop mechanism of "detection-feedback-learning" enables the system to automatically adapt to business changes and maintain a high detection rate and low false alarm rate. This greatly reduces the manual intervention burden on security operations personnel, frees the security team from tedious policy optimization work, realizes the automation and intelligence of security operations, and significantly reduces the security operation cost throughout the entire lifecycle.

[0042] In this way, by deeply integrating causal graphs, information entropy theory and unsupervised machine learning, a proactive defense system capable of real-time detection, accurate identification and self-evolution has been constructed. This effectively solves the core pain points in current deserialization attack detection and has outstanding substantial progress and broad application prospects.

[0043] It should be understood that the above embodiments are only for illustrating the technical concept and features of the present invention, and are intended to enable those skilled in the art to understand the content of the present invention and implement it accordingly. It should not be considered that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, several simple deductions or substitutions can be made without departing from the concept of the present invention. All equivalent changes or modifications made in accordance with the spirit and essence of the present invention should be covered within the protection scope of the present invention.

Claims

1. An anomaly detection method for deserialization attacks, characterized in that: include: The probe, implemented using Java Agent technology, is embedded into the JVM of the target application. It is activated at the deserialization entry point and collects all method calls, returns, object creations, and field read / write events within a certain time window, and labels each event with a causal tag. The central entropy engine receives event streams from probes, builds and maintains a causal context graph in memory in real time, and calculates entropy change metrics. The strategy and arbiter make decisions on allowing, observing, or blocking based on the entropy change index calculated by the analysis engine and combined with predefined or dynamically learned strategies. The probe, central entropy change analysis engine, strategy and adjudicator are integrated into the same application process as a software library, and high-speed data communication is achieved through in-process function calls and shared memory.

2. The anomaly detection method for deserialization attacks according to claim 1, characterized in that: include The following steps: A1. Detection Startup and Data Acquisition At the deserialization entry point, the probe is activated and a unique monitoring session is created for this operation. The probe collects runtime events, and each event is encapsulated into a data structure containing event ID, type, method signature, timestamp, and a list of key causal event IDs. A2. Real-time context modeling and entropy calculation The central analytics engine receives event streams and constructs and maintains a causal context graph G = (V, E) in memory for each session in real time. The engine processes events incrementally and periodically calculates the current graph snapshot based on a fixed time window or an event count window. Bientropy calculation, for each time window t, subgraph G_t, Calculate the structure entropy H_struct(t) to quantify the complexity of the call path within that time period. Calculate the semantic entropy H_semantic(t) to quantify the semantic coherence of the execution path within this time period. A3. Feature Extraction and Intelligent Analysis Based on the entropy change sequence and causal graph state of the current session, the system periodically extracts a fixed-length feature vector F and inputs F into a pre-trained OCSVM model to obtain an anomaly score. A4. Strategic Decisions and System Evolution The strategy and adjudicator make real-time decisions based on anomaly scores and preset thresholds: Score < θ1 → Normal: Allow this operation. θ1 ≤ Score < θ2 → Suspicious: Allow passage, but record detailed context and report for review by a security analyst. Score ≥ θ2 → Malicious: Immediately terminate the current thread or request and log the complete attack chain context. For suspicious alerts, after confirmation, the feature vectors of the false alarm samples are added to the dynamic feature library, and incremental training of the model is triggered to continuously optimize the detection strategy.

3. The anomaly detection method for deserialization attacks according to claim 2, characterized in that: Step A2, which involves constructing the causal context graph, calculating structural entropy, and calculating semantic entropy, specifically includes: When a deserialization call begins, the probe is activated and starts logging events for a session, each event e containing: e.id: Unique event ID; e.type: Event type; e.signature: Method signature or field descriptor; e.timestamp: Timestamp; e.cause: List of causal event IDs; Therefore, a directed graph G = (V, E) is constructed. V: The set of all events; E: Causality.

4. The anomaly detection method for deserialization attacks according to claim 3, characterized in that: Calculating structural entropy and semantic entropy specifically includes: Structure entropy H_struct: measures the unpredictability of calling the structure; Divide graph G into subgraphs G_t according to time slices, and calculate the out-degree deg_out(v) of each vertex v in G_t. The structural entropy of this time slice is: H_struct(t) = - Σ_{v ∈ G_t} [P(v) * log2(P(v))], Where P(v) = deg_out(v) / Σ_{v' ∈ G_t} deg_out(v'), P(v) is the probability that the out-degree of node v is equal to the sum of the out-degrees of all nodes in the graph; Semantic entropy H_semantic: measures the degree of semantic confusion in the execution path. Define a method semantic vector space; each method is mapped to a vector vec(m) based on its package name, class name, and method name through a pre-trained word embedding model; In time slice G_t, extract all method call sequences S =<m1, m2, ..., mn> ; Calculate the semantic consistency of the sequence: Consistency(S) = (1 / (n-1)) * Σ_{i=1}^{n-1}cosine_similarity(vec(m_i), vec(m_{i+1})); Semantic entropy is defined as: H_semantic(t) = 1 - Consistency(S).

5. The anomaly detection method for deserialization attacks according to claim 4, characterized in that: The training method for the pre-trained OCSVM model in step A3 includes: B1. Environmental preparation: Constructing a clean training sandbox; B2. Data acquisition executes normal business use cases. Write or invoke all known and legitimate business deserialization scenarios, use testing tools to execute these normal test cases intensively and repeatedly, simulate the situation under different loads and parameters, record the complete event flow of each deserialization operation by probes, and finally generate causal context graphs and entropy change sequences; B3. Feature extraction and construction of training sample set For each deserialization operation, following the process during detection, a fixed-length feature vector F is extracted from its causal context graph to form a large training dataset X_train = {F1, F2, ..., Fn}, where each Fn represents a normal deserialization operation; B4. Data Cleaning and Preprocessing Remove outlier feature vectors from X_train and scale the data for each feature dimension to the same range; The training objective of B5 and OCSVM is to find a hyperplane that separates most normal data points X_train from the origin while maximizing their distance from the origin. min (0.5 * ||w||^2 + (1 / (νn)) * Σ ζ_i - ρ) st (w · φ(x_i)) ≥ ρ - ζ_i, ζ_i ≥ 0 w is the normal vector of the hyperplane, φ is the kernel function that maps the data to a high-dimensional space, ρ is the distance to the origin, ζ_i is the slack variable that allows a small number of samples to fall outside the boundary to avoid overfitting, and ν is the key parameter; The cleaned and normalized X_train is input into the OCSVM algorithm for solving. After training, a decision function f(x) is obtained. For a new sample x, the sign of f(x) is used for judgment. f(x) ≥ 0: Determined as normal. f(x) < 0: This is considered an anomaly; B6. Calculate the f(x) value for all samples on the training set X_train, and take its minimum value or a certain low quantile as the initial discrimination threshold θ. Use another part of normal data that was not involved in the training to verify the performance of the model, ensuring that it can correctly accept all normal behaviors. At the same time, you can try to inject some simple abnormal patterns to test its sensitivity. B7. Serialize the trained model into a file, deploy it to the central entropy engine, and load it into memory.

6. The anomaly detection method for deserialization attacks according to claim 5, characterized in that: Step B1 specifically includes deploying application systems, dependency libraries, and versions that are completely consistent with the production environment in a sandbox isolated from the production network, deploying probes into the sandbox environment, ensuring that it is in data collection mode, and ensuring that there is absolutely no malicious deserialization attack traffic in the environment, and that all data is known and controlled.

Images