Java unknown threat detection method and device based on dynamic call chain fingerprint

Abstract

The application discloses a Java unknown threat detection method and device based on a dynamic call chain fingerprint, and belongs to the field of Java application security. The method comprises the following steps: identifying a traffic entry node and a preset node in an application based on a preset security policy; setting a monitoring anchor point at the traffic entry node and the preset node, and implanting a front-end interception instruction at the preset node; collecting method call stacks of all business threads of the application within a preset observation period based on the monitoring anchor point, converting the method call stacks into semantic fingerprint sequences, and aggregating all the semantic fingerprint sequences to construct a business execution graph; obtaining a method call stack of a to-be-detected business request runtime, and converting the method call stack into a semantic fingerprint sequence; calculating a graph edit distance between the to-be-detected semantic fingerprint sequence and the business execution graph based on an asymmetric cost matrix; and performing a corresponding security response operation according to the graph edit distance. The application realizes high-precision detection of unknown threats.

Description

Technical Field

[0001] This invention belongs to the field of Java application security, and in particular relates to a method and device for detecting unknown threats in Java based on dynamic call chain fingerprinting. Background Technology

[0002] In the field of Java application security, with the continuous evolution of attack techniques, security threats have evolved from traditional sensitive data theft to more covert and dangerous advanced unknown threats such as logical vulnerability exploitation, memory malware injection, and remote code execution. Traditional security detection methods, such as rule-based feature matching or scanning based on known vulnerability features, are difficult to effectively deal with these unknown attacks that do not rely on known features and whose behavior is highly variable.

[0003] To address this challenge, existing technologies are evolving from "data feature matching" to "behavioral pattern analysis." For example, Chinese patent application CN118054958A discloses a method for detecting sensitive information leakage vulnerabilities on a website server using dynamic instrumentation. This method constructs a refined data flow graph during program runtime using dynamic instrumentation technology and utilizes deep learning models such as Graph Convolutional Networks (GCNs) to identify sensitive information leakage. However, this method still has the following shortcomings:

[0004] (1) This method explicitly requires "possessing the website's source code" and, based on that, "modifying the server's source code." This prerequisite severely limits its application in modern software development: for widely used closed-source commercial software, third-party components (such as the closed-source portion of Oracle JDK or JAR files whose source code is unavailable), and production environments where recompilation is not permitted, this method is almost impossible to implement. Furthermore, directly modifying the source code is a highly invasive approach, typically requiring a complete recompiling, packaging, and deployment process, leading to a significant increase in operational costs.

[0005] (2) The core detection logic of this method focuses on the identification of "sensitive information" at the data level, mainly using graph convolutional networks to determine whether the data stream contains specific content such as ID cards and passwords. However, this design has an inherent blind spot: it cannot effectively detect logical attacks that do not involve the return of sensitive data. For example, attackers may use Runtime.exec to execute system commands to delete files, or bypass login verification through logical vulnerabilities (before data is read). Since such attacks do not generate typical "sensitive data streams", they are easily ignored by GCN models that rely on data features for discrimination.

[0006] (3) The effectiveness of this method is highly dependent on a pre-trained deep learning model (GCN). This dependence brings multiple problems: First, model training requires a large number of labeled "sensitive information" samples, which belongs to the supervised or semi-supervised learning paradigm and has limited ability to identify new attack patterns that have not appeared in the training data. Second, deep learning models generally have the problem of "poor interpretability". More importantly, the model is extremely sensitive to changes in application code. Any normal business logic iteration, code refactoring or function addition or removal may change the structural features of the program graph, resulting in a decrease in model accuracy and an increase in false positive rate. Therefore, it is necessary to frequently collect data, train and update the model, which is a heavy maintenance burden.

[0007] (4) In terms of performance, inference based on graph convolutional networks involves complex matrix operations, resulting in significant computational overhead. In high-concurrency scenarios on the server side, performing real-time GCN inference for every request path may introduce significant latency and affect service performance. In terms of interpretability, the GCN model is essentially a "black box." When it determines that an operation is a threat, the system struggles to provide operations personnel with clear and specific root cause analysis (e.g., accurately locating the specific line of code or logical step that is in problem), which makes subsequent verification and handling difficult.

[0008] (5) Since its detection mechanism is usually based on supervised or semi-supervised learning and relies on extracting sample features from known "sensitive information" leakage attacks, this approach has inherent shortcomings when facing novel attack methods that do not directly touch known sensitive fields. For example, the model may not be able to effectively identify zero-day attacks that exploit unknown JVM vulnerabilities to cause service crashes or attack chains that are completely different from the training samples. Its defense capabilities are limited by the set of known attack patterns covered by the training data, and it lacks essential defense capabilities against truly "unknown unknowns" threats. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a Java unknown threat detection method and device based on dynamic call chain fingerprinting, which achieves high-precision detection of unknown threats.

[0010] This invention is achieved through the following technical solution:

[0011] The first aspect of this invention discloses a method for detecting unknown Java threats based on dynamic call chain fingerprinting, comprising:

[0012] During the application startup phase, a preset security policy is loaded using Java Virtual Machine probe technology, and traffic entry nodes and preset nodes in the application are identified based on the security policy.

[0013] Monitoring anchor points are set at the traffic entry node and the preset node, and a pre-interception instruction that takes precedence over the original business logic is implanted at the preset node. The pre-interception instruction is configured to: when it is executed, synchronize the runtime context data of the current thread to the local context container of the thread.

[0014] Based on the monitoring anchor points, the method call stacks of all business threads of the application are collected within the preset observation period. Each method call stack is converted into a corresponding semantic fingerprint sequence, and all semantic fingerprint sequences are aggregated to construct a business execution graph.

[0015] Obtain the method call stack of the business request to be detected and convert it into a corresponding semantic fingerprint sequence;

[0016] Based on a preset asymmetric cost matrix, the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph is calculated, wherein the asymmetric cost matrix configures different edit operation costs for different semantic roles;

[0017] Based on the comparison result between the graph edit distance and the preset first threshold and second threshold, the corresponding security response operation is executed; wherein, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated; if the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed; if the graph edit distance is greater than or equal to the first threshold and less than the second threshold, the deep detection process is triggered.

[0018] Furthermore, the method call stacks are converted into corresponding semantic fingerprint sequences, including:

[0019] Lexical normalization is performed on the method frames in the method call stack, and line numbers and source file name information are removed;

[0020] Replace the dynamically generated class identifier in the method frame with a uniform preset placeholder;

[0021] Based on the preset package name weight mapping relationship, filter out method frames with a weight value of zero;

[0022] The filtered and retained method frames are labeled with semantic roles to form the semantic fingerprint sequence.

[0023] Furthermore, the semantic roles include at least one of the following: entry layer role, core logic layer role, data operation layer role, auxiliary tool layer role, and high-risk point layer role.

[0024] Furthermore, the asymmetric cost matrix is ​​configured as follows:

[0025] Configure a first cost value for the operation of inserting auxiliary tool layer roles;

[0026] Configure a second cost value for the operation of deleting a core logic layer role;

[0027] Configure a third cost value for operations that replace entry layer roles or introduce high-risk point layer roles;

[0028] Wherein, the second cost value is greater than the first cost value, and the third cost value is greater than the second cost value.

[0029] Furthermore, all semantic fingerprint sequences are aggregated to construct a business execution graph, including:

[0030] The semantic fingerprint sequence is aggregated using a directed acyclic graph or a prefix tree structure, wherein, during the aggregation process, identical method frame nodes are merged and branches are created at sequence bifurcation points;

[0031] After the preset observation period ends, the aggregated graph structure will be solidified into a business execution graph.

[0032] Furthermore, the first threshold is determined by the upper limit of the number of auxiliary tool nodes allowed to be added in a single business iteration, the insertion cost of a single such node, and the security redundancy, and its calculation formula is as follows:

[0033] TL ;

[0034] In the formula, TL represents the first threshold; This indicates the maximum number of non-business logic nodes that can be added within the same call chain during a single release. This represents the insertion cost of a single utility class node; This indicates the amount of safety redundancy.

[0035] Furthermore, the second threshold is determined by the lower limit of the cost of deleting the core authentication node, replacing the entry node, and introducing high-risk nodes, combined with a sensitivity correction coefficient. Its calculation formula is as follows: ;

[0036] In the formula, TB represents the second threshold. This represents the cost of deleting a single critical authentication node; This indicates the cost of replacing the entry point; This represents the editing cost value assigned when introducing a high-risk, sensitive node; This represents the sensitivity correction coefficient.

[0037] Furthermore, the depth detection process includes:

[0038] Identify the target method frame node in the semantic fingerprint sequence to be detected that causes abnormal graph edit distance, and use it as a preset node; use the pre-interception instruction implanted in the target method frame node to block the execution of the current business thread;

[0039] Extract runtime context data corresponding to the target method frame node from the local context container of the current thread. The runtime context data includes at least the input parameters and object references of the target method.

[0040] Based on the semantic roles of the target method frame nodes, content security analysis is performed on the runtime context data;

[0041] The final security decision is made based on the results of the content security analysis: if abnormal features are detected in the analysis, the service request to be tested is ultimately determined to be malicious and blocked; if no abnormalities are found in all analyses, the service request to be tested is ultimately determined to be benign and allowed to proceed.

[0042] Furthermore, based on the semantic role of the target method frame node, content security analysis is performed on the runtime context data, including:

[0043] When the target method frame node is a data operation layer role, analyze whether the collected database operation statements contain structured query language injection features;

[0044] When the target method frame node is a high-risk layer role, analyze whether the collected command parameters or deserialized data contain keywords in the preset blacklist;

[0045] When the target method frame node is a core logic layer role, the collected security context information is analyzed to verify user permissions.

[0046] A second aspect of the present invention discloses a Java unknown threat detection device based on dynamic call chain fingerprinting, comprising:

[0047] The node identification module is used to load a preset security policy using Java Virtual Machine probe technology during the application startup phase, and to identify traffic entry nodes and preset nodes in the application based on the security policy.

[0048] Anchor point setting module is used to set monitoring anchor points at the traffic entry node and preset node, and to implant a pre-interception instruction that takes precedence over the original business logic at the preset node. The pre-interception instruction is configured to: when it is executed, synchronize the runtime context data of the current thread to the local context container of the thread.

[0049] The graph construction module is used to collect the method call stacks of all business threads of the application within a preset observation period based on the monitoring anchor points, convert each method call stack into a corresponding semantic fingerprint sequence, and aggregate all semantic fingerprint sequences to construct a business execution graph.

[0050] The fingerprint generation module is used to obtain the method call stack of the business request to be detected and convert it into the corresponding semantic fingerprint sequence.

[0051] The distance calculation module is used to calculate the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph based on a preset asymmetric cost matrix, wherein the asymmetric cost matrix is ​​configured with different edit operation costs for different semantic roles;

[0052] The response execution module is used to execute corresponding security response operations based on the comparison result between the graph edit distance and a preset first threshold and a second threshold. Specifically, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated; if the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed; if the graph edit distance is greater than or equal to the first threshold and less than the second threshold, a deep detection process is triggered.

[0053] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0054] (1) This invention uses Java Agent technology to directly modify bytecode in memory without relying on source code. It can protect against both open-source applications and closed-source commercial middleware (such as WebLogic), perfectly solving the problem of difficult technology implementation in closed-source components and production environments where secondary compilation is not possible. Its deployment method is non-intrusive, requiring no modification or recompilation of the original application source code. It only requires adding startup parameters to take effect, with minimal interference to existing development and operation processes.

[0055] (2) This invention elevates the traditional "data content classification" to "logical behavior analysis." It focuses not on whether the data itself is sensitive, but on whether the "structure of the program's execution path" undergoes abnormal mutations. Therefore, whether it is a deserialization attack that leads to remote code execution (RCE), a memory malware injection, or a logical vulnerability such as permission verification bypass, as long as the attack behavior causes the normal business logic to deviate, it can be effectively detected, achieving coverage of the entire spectrum of threats; moreover, it can be blocked at the moment of malicious logic execution (such as before the sink point is triggered or when authentication is skipped), rather than waiting until sensitive data flows out to intercept it, thus achieving proactive defense.

[0056] (3) To address the noise problem caused by frequent code changes, this invention introduces a TSN (lexical-semantic-noise) semantic noise reduction mechanism, which can automatically filter the impact of benign code changes such as log enhancement and utility class refactoring. At the same time, through the baseline learning threshold and graph edit distance dynamic completion mechanism, it can automatically adapt to the benign iteration of business at runtime without frequent manual intervention or retraining of the model, which significantly reduces the maintenance burden and improves the practicality and stability of the system.

[0057] (4) This invention uses graph edit distance calculation after semantic denoising to replace complex deep learning inference. This calculation method is lightweight and efficient with extremely low computational overhead, and can well adapt to the stringent performance requirements of high-concurrency production environments. More importantly, it has "white-box" interpretability. When an alarm is triggered, it can clearly give the cause of the anomaly, such as "graph edit distance D=50, the reason is that the AuthService.check node was deleted", which enables operation and maintenance personnel to quickly locate and understand security threats.

[0058] (5) The present invention is essentially an unsupervised anomaly detection method. It does not rely on any known attack sample characteristics, but instead establishes and learns the call chain baseline of normal business logic (such as GEG). Any behavior that deviates from the baseline in structure, regardless of whether it is a known attack method, will produce a significant distance difference and be captured. This method makes it naturally capable of defending against unknown threats and 0-day vulnerabilities. Attached Figure Description

[0059] The accompanying drawings, which are included to provide a further understanding of embodiments of the invention and form part of this application, do not constitute a limitation thereof. In the drawings:

[0060] Figure 1 This is a flowchart of a Java unknown threat detection method in this invention;

[0061] Figure 2 This is a block diagram of one component of the Java unknown threat detection device in this invention. Detailed Implementation

[0062] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0063] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0064] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "inner," and "outer" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the accompanying drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0065] In the description of this invention, unless otherwise explicitly specified and limited, the term "connection" or similar designation indicating a connection between components should be interpreted broadly. For example, it can refer to a fixed connection, a detachable connection, or an integral part; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can refer to the internal communication between two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0066] like Figures 1 to 2 As shown in the figure, this embodiment discloses a method and apparatus for detecting unknown Java threats based on dynamic call chain fingerprints.

[0067] The first aspect of this embodiment provides a Java unknown threat detection method based on dynamic call chain fingerprinting, such as... Figure 1 As shown, the detection method includes steps S100 to S600.

[0068] Step S100. During the application startup phase, a preset security policy is loaded using Java Virtual Machine probe technology, and traffic entry nodes and preset nodes in the application are identified based on the security policy.

[0069] For example, during the application startup phase (class loading), a pre-defined security policy (e.g., a list of hook rules) is loaded using Java Virtual Machine probe technology (Java Agent). Based on this security policy, traffic entry nodes and pre-defined nodes (i.e., key nodes or key semantic role nodes) in the application are identified.

[0070] Predefined nodes (i.e., critical nodes / critical semantic role nodes) refer to methods that, if maliciously exploited, could cause substantial harm to the system. These include, but are not limited to, data persistence interfaces (JDBC) conforming to the Java language specification, and system command execution interfaces. Critical nodes and critical semantic role nodes refer to the same object; the former emphasizes its code location, while the latter emphasizes its assigned security semantic attributes. For example:

[0071] Data persistence operations (R3): such as JDBC's executeQuery and executeUpdate methods (which involve SQL injection risks);

[0072] Command execution (R5): such as Runtime.exec, ProcessBuilder.start methods (involving RCE risk);

[0073] File operations: such as the read and write methods of FileInputStream and FileOutputStream (involving the risk of arbitrary file read and write);

[0074] Network operations: such as the URL.openConnection method (which involves SSRF risk).

[0075] Step S200. Set monitoring anchor points at the traffic entry node and the preset node, and implant a pre-interception instruction that takes precedence over the original business logic at the preset node. The pre-interception instruction is configured to: when it is executed, synchronously pre-store the runtime context data of the current thread into the local context container of the thread.

[0076] In this embodiment, the pre-interception instruction applies to all business threads that have reached the preset node, synchronously pre-storing the runtime context data of the current thread into the thread's local context container. The runtime context data refers to information related to the target method call captured during the execution of the pre-interception instruction, including the target method's input parameter values, object references, etc.

[0077] Step S300. Based on the monitoring anchor point, collect the method call stacks of all business threads of the application within the preset observation period, convert each method call stack into a corresponding semantic fingerprint sequence, and aggregate all semantic fingerprint sequences to construct a business execution graph.

[0078] The method call frame includes ordered method frames, each method frame referring to a record unit in the runtime method call stack, and the record unit containing class name, method name, and line number information. In some embodiments of this example, each method call stack is converted into a corresponding semantic fingerprint sequence, including steps S310 to S340.

[0079] Step S310. Perform lexical normalization on the method frames in the method call stack, and remove line numbers and source file name information.

[0080] Step S320. Replace the dynamically generated class identifier in the method frame with a uniform preset placeholder.

[0081] For example, the dynamically generated class identifier includes a Hex memory address, a Lambda suffix ($Lambda$1), a reflection temporary class name (GeneratedMethodAccessor), etc., and the preset placeholder is DYNAMIC_STUB.

[0082] Step S330. Filter out method frames with a weight value of zero according to the preset package name weight mapping relationship.

[0083] Specifically, each method frame in the method call stack is traversed, and its package name is extracted. A preset mapping table is queried to determine the semantic weight value corresponding to the package name. Method frames with a weight value of zero are discarded, and only method frames with a weight value greater than zero are retained. If the package name belongs to the underlying framework (such as sun.reflect), its weight value is set to zero. If the package name belongs to business logic and core components, its weight value is set to greater than zero.

[0084] Step S340. Label the semantic roles of the filtered and retained method frames to form the semantic fingerprint sequence.

[0085] In some implementations of this embodiment, the semantic roles include at least one of the following: entry layer role, core logic layer role, data operation layer role, auxiliary tool layer role, and high-risk point layer role.

[0086] For example, the semantic roles include:

[0087] R1 (Entrance): The entry layer (Controller), corresponding to the request entry point;

[0088] R2 (Critical): Core logic (Auth / Pay), corresponding to key business logic;

[0089] R3 (Data): Data operations (DAO / SQL), corresponding to data access behavior;

[0090] R4 (Utility): Accessibility tools (Log / Utils), corresponding to auxiliary functions;

[0091] R5 (Sink): High-risk point (Exec / Deser), corresponding to sensitive and dangerous operations.

[0092] In some implementations of this embodiment, aggregating all semantic fingerprint sequences to construct a business execution graph includes: aggregating the semantic fingerprint sequences using a directed acyclic graph or a prefix tree structure, wherein, during the aggregation process, identical method frame nodes are merged and branches are created at sequence bifurcations; after the preset observation period ends, the aggregated graph structure is solidified into a business execution graph (GEG).

[0093] Step S400. Obtain the method call stack of the business request to be detected and convert it into the corresponding semantic fingerprint sequence.

[0094] Specifically, the method call stack of the business request to be detected is obtained; the method frames in the method call stack are lexically normalized to remove line numbers and source file name information; the dynamically generated class identifier in the method frame is replaced with a unified preset placeholder; the method frames with a weight value of zero are filtered out according to the preset package name weight mapping relationship; the semantic roles are labeled for the filtered and retained method frames to form the semantic fingerprint sequence.

[0095] Step S500. Based on a preset asymmetric cost matrix, calculate the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph, wherein the asymmetric cost matrix configures different edit operation costs for different semantic roles.

[0096] The semantic fingerprint sequence to be detected is the semantic fingerprint sequence formed by transforming the method call stack during the runtime of the business request to be detected.

[0097] Specifically, the asymmetric cost matrix defines the cost value corresponding to the insertion, deletion or replacement operation performed for different semantic roles when calculating the graph edit distance.

[0098] In some embodiments of this example, the asymmetric cost matrix is ​​configured as follows: a first cost value is configured for the operation of inserting an auxiliary tool layer role; a second cost value is configured for the operation of deleting a core logic layer role; and a third cost value is configured for the operation of replacing an entry layer role or introducing a high-risk layer role; wherein the second cost value is greater than the first cost value, and the third cost value is greater than the second cost value.

[0099] For example, the asymmetric cost matrix is ​​configured such that inserting an auxiliary tool role (R4) has a very low cost, deleting a core logic role (R2) has a very high cost, and replacing an entry role (R1) or introducing a high-risk role (R5) has a very high cost.

[0100] Step S600. Based on the comparison result between the graph edit distance and the preset first threshold and second threshold, execute the corresponding security response operation; wherein, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated; if the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed; if the graph edit distance is greater than or equal to the first threshold and less than the second threshold, the deep detection process is triggered.

[0101] For example, a hierarchical response is performed based on the relationship between the graph edit distance (D) and a first threshold (learning threshold, TL) and a second threshold (blocking threshold, TB):

[0102] If D < TL, it belongs to the benign drift zone and is judged as a normal business iteration (such as adding logs); at this time, the request is allowed, and $V_{new}$ is automatically appended and integrated into the business execution graph to achieve baseline self-learning;

[0103] If D≥TB, it belongs to the malicious attack zone and is determined to be a known unknown threat (such as lack of authentication or memory malware); at this time, execution is immediately blocked and a stack difference snapshot is reported.

[0104] If TL≤D<TB, it falls within the verification and evidence collection area and is judged as suspicious behavior, requiring further confirmation; at this time, the in-depth analysis process is triggered.

[0105] In some implementations of this embodiment, the first threshold is determined by the upper limit of the number of auxiliary tool nodes allowed to be added in a single business iteration, the insertion cost of a single such node, and the amount of security redundancy.

[0106] Specifically, the first threshold is defined as the maximum tolerance for "positive business iterations," and its derivation formula is as follows:

[0107] TL ;

[0108] In the formula, TL represents the first threshold; This indicates the maximum number of non-business logic nodes (such as logs and monitoring points) that can be added within the same call chain during a single release. This represents the insertion cost of a single utility class node; This indicates the amount of safety redundancy.

[0109] For example, based on historical statistics, regular releases rarely insert more than 15 log lines into a single path. = 15, =1, =0.

[0110] Final setting: TL=15x1=15.

[0111] In some embodiments of this example, the second threshold is determined by the lower limit of the cost of key malicious operations such as deleting core authentication nodes, replacing entry nodes, and introducing high-risk nodes, combined with a sensitivity correction coefficient.

[0112] Specifically, the second threshold is defined as the minimum threshold for confirming "malicious logic tampering," and its derivation formula is as follows:

[0113]

[0114] In the formula, TB represents the second threshold. This represents the cost of deleting a single critical authentication node; This indicates the cost of replacing the entry point; This represents the editing cost associated with introducing (or highlighting) a "high-risk sensitive node (Sink Node)". This represents the sensitivity correction factor, used to prevent cost offsetting caused by compound operations and to ensure that critical missing data is intercepted immediately.

[0115] For example, the cost of key authentication deletion. = 50、 =100、 =150. To ensure the system can still intercept attacks even if an attacker simultaneously removes authentication and tweaks a few lines of code, the sensitivity is set to 150. = 5.

[0116] Final setting: TB=50-5=45.

[0117] The method in this embodiment extracts stable semantic fingerprints through the TSN three-level semantic compression model, eliminates environmental noise, and directly anchors the essence of attack behavior (such as abnormal jumps in key execution paths and abrupt calls to sensitive sink points). It can accurately identify zero-day attacks such as deserialization vulnerability exploitation and memory horse implantation without the need for a signature library.

[0118] T, S, and N represent Token (lexical tag), Semantic (semantic role), and Node (key node), respectively, and their specific definitions are as follows:

[0119] The T (Token) layer is located at the bottom of the processing flow and mainly performs text preprocessing and normalization. This layer directly processes the raw stack string, eliminating non-semantic noise caused by differences in the runtime environment by removing line numbers, memory addresses, and normalizing dynamic identifiers to static placeholders, thus providing clean and stable text input for subsequent analysis.

[0120] The S (Semantic) layer serves as an intermediate processing layer, responsible for logical understanding and information noise reduction. Based on a preset package name weight table, this layer performs lookup matching and filtering on normalized class names and package name sequences to identify and filter a large amount of framework call code without security significance. This solves the problems of excessive stack depth and redundant information, retaining only key method frames with business or security weights.

[0121] The N (Node) layer sits at the top of the processing flow, responsible for the final structured and symbolic abstraction. This layer maps the filtered key method frames to predefined security role nodes, thereby transforming specific code implementations into a general sequence of symbols representing security semantics. This abstraction process allows the system to ignore specific implementation differences, providing a standardized semantic fingerprint for core behavior comparison and threat determination.

[0122] The method in this embodiment utilizes a role-based weighted graph edit distance algorithm to quantify the semantic differences between runtime behavior and baseline behavior. It assigns extremely low editing costs to "benign drift" (such as inserting logs or helper methods) and extremely high editing costs to "malicious tampering" (such as deleting authentication or replacing entry points), thereby tolerating normal business iterations and blocking only genuine threats.

[0123] The method in this embodiment constructs a judgment model of "benign drift, review, and blocking," which can automatically learn low-risk business changes at runtime (for example, automatically incorporating benign drifts into the business execution graph as a baseline), thereby reducing the need for frequent manual updates to the whitelist and achieving an automated operation and maintenance effect that becomes more accurate with use.

[0124] In some embodiments of this example, the depth detection process includes steps S710 to S750.

[0125] Step S710. Identify the target method frame node that causes the graph editing distance anomaly in the semantic fingerprint sequence to be detected, which is a preset node.

[0126] For example, identify the method frames in the semantic fingerprint sequence to be detected that cause semantic deviation and are preset nodes, and mark them as target method frame nodes (such as newly inserted R3 nodes).

[0127] Step S720. Block the execution of the current business thread by using the pre-interception instruction implanted in the target method frame node.

[0128] Step S730. Extract runtime context data corresponding to the target method frame node from the local context container of the current thread. The runtime context data includes at least the input parameters and object references of the target method.

[0129] Step S740. Perform content security analysis on the runtime context data based on the semantic role of the target method frame node.

[0130] In some implementations of this embodiment, content security analysis is performed on the runtime context data based on the semantic role of the target method frame node, including: when the target method frame node is a data operation layer role, analyzing whether the collected database operation statements contain structured query language injection features; when the target method frame node is a high-risk layer role, analyzing whether the collected command parameters or deserialized data contain keywords in a preset blacklist; when the target method frame node is a core logic layer role, analyzing the collected security context information to verify user permissions.

[0131] In this embodiment, based on the semantic roles annotated on the target method frame nodes, targeted security detection is performed on the dynamically collected runtime information. The detection strategy is strongly correlated with the semantic roles. For example, if the node role is a data operation layer role (R3), the focus is on analyzing the SQL or NoSQL statements it executes to detect whether there are attack patterns such as structured query language injection. If the node role is a high-risk layer role (R5), the command parameters and deserialized data streams it triggers are scanned to check whether they contain malicious instructions or attack payloads from a preset blacklist. If the node role is a core logic layer role (R2), the user identity and permission identifier in the thread context (such as SecurityContext) are checked to verify whether the operation exceeds the authority.

[0132] Step S750. Make a final security decision based on the results of the content security analysis.

[0133] The final security decision is made based on the results of the content security analysis, including: if abnormal features are detected in the analysis, the request is ultimately determined to be malicious and blocked; if no abnormalities are found in all analyses, the request is ultimately determined to be benign and allowed.

[0134] The second aspect of this embodiment provides a Java unknown threat detection device based on dynamic call chain fingerprinting, such as... Figure 2 As shown, the detection device includes a node identification module, an anchor point setting module, a map construction module, a fingerprint generation module, a distance calculation module, and a response execution module.

[0135] The node identification module is used to load a preset security policy using Java Virtual Machine probe technology during the application startup phase, and to identify traffic entry nodes and preset nodes in the application based on the security policy.

[0136] The anchor point setting module is used to set monitoring anchor points at the traffic entry node and the preset node, and to implant a pre-interception instruction that takes precedence over the original business logic at the preset node. The pre-interception instruction is configured to: when it is executed, synchronize and pre-store the runtime context data of the current thread into the local context container of the thread.

[0137] The graph construction module is used to collect the method call stacks of all business threads of the application within a preset observation period based on the monitoring anchor points, convert each method call stack into a corresponding semantic fingerprint sequence, and aggregate all semantic fingerprint sequences to construct a business execution graph.

[0138] The fingerprint generation module is used to obtain the method call stack of the business request to be detected during runtime and convert it into a corresponding semantic fingerprint sequence.

[0139] The distance calculation module is used to calculate the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph based on a preset asymmetric cost matrix, wherein the asymmetric cost matrix is ​​configured with different edit operation costs for different semantic roles.

[0140] The response execution module is used to perform corresponding security response operations based on the comparison result between the graph edit distance and a preset first threshold and a second threshold. Specifically, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated. If the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed. If the graph edit distance is greater than or equal to the first threshold and less than the second threshold, a deep detection process is triggered.

[0141] It should be noted that those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system or device described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0142] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A Java unknown threat detection method based on dynamic call chain fingerprinting, characterized in that, include: During the application startup phase, a preset security policy is loaded using Java Virtual Machine probe technology, and traffic entry nodes and preset nodes in the application are identified based on the security policy. Monitoring anchor points are set at the traffic entry node and the preset node, and a pre-interception instruction that takes precedence over the original business logic is implanted at the preset node. The pre-interception instruction is configured to: when it is executed, synchronize the runtime context data of the current thread to the local context container of the thread. Based on the monitoring anchor points, the method call stacks of all business threads of the application are collected within the preset observation period. Each method call stack is converted into a corresponding semantic fingerprint sequence, and all semantic fingerprint sequences are aggregated to construct a business execution graph. Obtain the method call stack of the business request to be detected and convert it into a corresponding semantic fingerprint sequence; Based on a preset asymmetric cost matrix, the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph is calculated, wherein the asymmetric cost matrix configures different edit operation costs for different semantic roles; Based on the comparison result between the graph edit distance and the preset first threshold and second threshold, the corresponding security response operation is executed; wherein, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated; if the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed; if the graph edit distance is greater than or equal to the first threshold and less than the second threshold, the deep detection process is triggered.

2. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 1, characterized in that, Convert each method call stack into a corresponding semantic fingerprint sequence, including: Lexical normalization is performed on the method frames in the method call stack, and line numbers and source file name information are removed; Replace the dynamically generated class identifier in the method frame with a uniform preset placeholder; Based on the preset package name weight mapping relationship, filter out method frames with a weight value of zero; The filtered and retained method frames are labeled with semantic roles to form the semantic fingerprint sequence.

3. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 2, characterized in that, The semantic roles include at least one of the following: entry layer role, core logic layer role, data operation layer role, auxiliary tool layer role, and high-risk point layer role.

4. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 3, characterized in that, The asymmetric cost matrix is ​​configured as follows: Configure a first cost value for the operation of inserting auxiliary tool layer roles; Configure a second cost value for the operation of deleting a core logic layer role; Configure a third cost value for operations that replace entry layer roles or introduce high-risk point layer roles; Wherein, the second cost value is greater than the first cost value, and the third cost value is greater than the second cost value.

5. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 1, characterized in that, Aggregate all semantic fingerprint sequences to construct a business execution graph, including: The semantic fingerprint sequence is aggregated using a directed acyclic graph or a prefix tree structure, wherein, during the aggregation process, identical method frame nodes are merged and branches are created at sequence bifurcation points; After the preset observation period ends, the aggregated graph structure will be solidified into a business execution graph.

6. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 1, characterized in that, The first threshold is determined by the maximum number of auxiliary tool nodes allowed to be added in a single business iteration, the insertion cost of a single such node, and the security redundancy. Its calculation formula is as follows: TL ; In the formula, TL represents the first threshold; This indicates the maximum number of non-business logic nodes that can be added within the same call chain during a single release. This represents the insertion cost of a single utility class node; This indicates the amount of safety redundancy.

7. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 1, characterized in that, The second threshold is determined by the lower limit of the cost of deleting the core authentication node, replacing the entry node, and introducing high-risk nodes, and is combined with the sensitivity correction coefficient. The calculation formula is as follows: ； In the formula, TB represents the second threshold. This represents the cost of deleting a single critical authentication node; This indicates the cost of replacing the entry point; This represents the editing cost value assigned when introducing a high-risk, sensitive node; This represents the sensitivity correction coefficient.

8. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 1, characterized in that, The depth detection process includes: Identify the target method frame node, which is a preset node, in the semantic fingerprint sequence to be detected and causes anomalies in graph edit distance; By using the pre-interception instruction implanted in the target method frame node, the execution of the current business thread is blocked; Extract runtime context data corresponding to the target method frame node from the local context container of the current thread. The runtime context data includes at least the input parameters and object references of the target method. Based on the semantic roles of the target method frame nodes, content security analysis is performed on the runtime context data; The final security decision is made based on the results of the content security analysis: if abnormal features are detected in the analysis, the service request to be tested is ultimately determined to be malicious and blocked; if no abnormalities are found in all analyses, the service request to be tested is ultimately determined to be benign and allowed to proceed.

9. The Java unknown threat detection method based on dynamic call chain fingerprinting according to claim 8, characterized in that, Based on the semantic roles of the target method frame nodes, content security analysis is performed on the runtime context data, including: When the target method frame node is a data operation layer role, analyze whether the collected database operation statements contain structured query language injection features; When the target method frame node is a high-risk layer role, analyze whether the collected command parameters or deserialized data contain keywords in the preset blacklist; When the target method frame node is a core logic layer role, the collected security context information is analyzed to verify user permissions.

10. A Java unknown threat detection device based on dynamic call chain fingerprinting, characterized in that, include: The node identification module is used to load a preset security policy using Java Virtual Machine probe technology during the application startup phase, and to identify traffic entry nodes and preset nodes in the application based on the security policy. Anchor point setting module is used to set monitoring anchor points at the traffic entry node and preset node, and to implant a pre-interception instruction that takes precedence over the original business logic at the preset node. The pre-interception instruction is configured to: when it is executed, synchronize the runtime context data of the current thread to the local context container of the thread. The graph construction module is used to collect the method call stacks of all business threads of the application within a preset observation period based on the monitoring anchor points, convert each method call stack into a corresponding semantic fingerprint sequence, and aggregate all semantic fingerprint sequences to construct a business execution graph. The fingerprint generation module is used to obtain the method call stack of the business request to be detected and convert it into the corresponding semantic fingerprint sequence. The distance calculation module is used to calculate the graph edit distance between the semantic fingerprint sequence to be detected and the business execution graph based on a preset asymmetric cost matrix, wherein the asymmetric cost matrix is ​​configured with different edit operation costs for different semantic roles; The response execution module is used to execute corresponding security response operations based on the comparison result between the graph edit distance and a preset first threshold and a second threshold; wherein, if the graph edit distance is less than the first threshold, the service request to be detected is determined to be benign, and the service execution graph is updated; if the graph edit distance is greater than or equal to the second threshold, the service request to be detected is determined to be malicious, and interception is performed. If the graph editing distance is greater than or equal to the first threshold and less than the second threshold, the depth detection process is triggered.

Images