WEB application mimicry judgment system and method based on runtime data

Abstract

The invention relates to the technical field of network security, in particular to a WEB application mimicry judgment system and method.The WEB application mimicry judgment method based on runtime data is characterized in that a parameter collection module is used for implanting instrumentation codes in key functions of WEB application programs and collecting runtime parameters of the WEB application programs in real time; the event conversion module is used for converting the acquired runtime parameters of the plurality of heterogeneous execution bodies into structured runtime events; the sequence alignment module is used for carrying out time sequence alignment on runtime events from different heterogeneous executors according to the business operation labels; and the risk judgment module is used for vectorizing the aligned text data of the runtime events, calculating a plurality of judgment factors and performing weighted fusion to generate a final confidence score, and performing feedback control to judge whether to trigger an execution body rotation operation or not according to the confidence score. According to the method, the WEB application runtime parameters are collected, through event conversion, sequence alignment and multi-factor weighted decision, the WEB application abnormal attack recognition accuracy is greatly improved, and the defect of traditional flow decision is effectively overcome.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a web application mimicry adjudication system and method based on runtime data. Background Technology

[0002] With the deepening of informatization and the rapid development of the internet, technologies such as cloud computing, big data, and the Internet of Things are deeply integrated with the real economy. The increasing prevalence of remote work, smart government, and digital finance has significantly restructured human work, learning, and lifestyles, promoting the global sharing of information resources. However, this has also broadened the boundaries of cybersecurity. Cybersecurity has evolved from a technical issue to a critical matter concerning national security and corporate survival. Web applications, as one of the core carriers of digital services, have seen their attack surface expand exponentially and security risks grow exponentially due to the application of new technologies such as microservice architecture and API calls, making them highly susceptible to cyberattacks. Currently, traditional attack methods still dominate cyberattacks against web applications: for example, SQL injection steals data through malicious queries, leading to data breaches in over 30% of global enterprises; XSS cross-site scripting modifies web pages, becoming a major cause of phishing scams; and malicious file uploads implant Trojans, with global server hijacking incidents increasing by 47% year-on-year in 2024. Even more serious is the continuous emergence of new web threats: such as memory backdoors (hijacking process memory to evade detection), zero-day vulnerabilities (attacking undisclosed vulnerabilities), and AI deepfakes (generating fake web pages to increase the success rate of phishing), putting unprecedented pressure on traditional defense systems.

[0003] Faced with these cyberattacks, government and enterprise organizations generally adopt Web Application Firewalls (WAFs) as their core protection measure. While WAFs effectively filter traffic using pre-set rule bases and are effective against known attacks, they have inherent flaws: the rule base relies on manual updates, making it difficult to keep up with the speed of attack mutations and resulting in a lag in responding to new attacks; their defense logic is limited to "feature matching," failing to identify unknown attacks; and their detection capabilities also significantly decrease when facing encrypted traffic and covert channels. To address the challenge of defending against unknown threats, Wu Jiangxing, an academician of the Chinese Academy of Engineering, proposed the theory of cyberspace mimicry defense, the core of which is a "multi-dimensional dynamic reconstruction mechanism": by continuously and randomly changing the internal structure of the system (heterogeneous execution environment, data path, interface protocol, etc.), the system state dynamically changes, using the principle of uncertainty to curb unknown vulnerabilities and backdoor exploitation. Currently, the mature technology under this theory is mimicry traffic adjudication: multiple heterogeneous executors are deployed to simultaneously process the same request, collecting traffic data (packet size, transmission frequency, protocol mode, etc.) from each executor, and using a differential adjudication algorithm to analyze the differences. If the traffic characteristics of a certain executor deviate significantly, it is determined to be an abnormal executor and rotated. This heterogeneous redundancy plus differential adjudication mode eliminates the reliance on attack signature databases and can defend against unknown threats without writing static rules.

[0004] Mimicry traffic adjudication still has limitations: the network traffic it relies on only reflects data traffic characteristics and cannot intuitively map the runtime state of web applications (including process memory usage, CPU utilization, database operation logs, business logic execution results, etc.). The two are not entirely positively correlated; some attacks only damage memory data or tamper with business logic without changing traffic characteristics, leading to missed detections in differential modalities. This directly affects the accuracy of adjudicating abnormal execution entities and becomes a key bottleneck in improving the effectiveness of mimicry defense. Summary of the Invention

[0005] To address the issues of existing mimicry adjudication techniques, traffic-based adjudication methods suffer from coarse-grained adjudication and an inability to display application runtime status, thus affecting overall adjudication accuracy, this invention proposes a web application mimicry adjudication system and method based on runtime data. This system utilizes instrumentation technology to dynamically acquire program runtime parameters and improves adjudication accuracy through a multi-factor adjudication algorithm. This provides more accurate information on abnormal execution entities for feedback control and offers more accurate attack threat identification and security protection for cyberspace.

[0006] To achieve the above objectives, the technical solution adopted is:

[0007] This invention provides a web application mimicry adjudication system based on runtime data, comprising:

[0008] The parameter acquisition module is used to insert instrumentation code into key functions of web applications to collect their runtime parameters in real time.

[0009] The event conversion module is used to convert the collected runtime parameters of multiple heterogeneous executors into structured runtime events;

[0010] The sequence alignment module is used to align runtime events from different heterogeneous executors in sequence according to business operation tags.

[0011] The risk adjudication module is used to vectorize the text data of aligned runtime events, calculate multiple adjudication factors and weighted fuse them to generate the final confidence score. The feedback control determines whether to trigger the execution body rotation operation based on the confidence score.

[0012] According to the WEB application mimicry adjudication system based on runtime data of the present invention, the heterogeneous executor refers to multiple WEB application instances that are implemented based on the same business logic but differ in runtime environment, system components, dependent library versions or underlying instruction sets. The multiple heterogeneous executors synchronously process the same business request and output runtime parameters to the parameter acquisition module respectively.

[0013] According to the WEB application mimicry adjudication system based on runtime data of the present invention, the parameter acquisition module further utilizes bytecode instrumentation technology to implant instrumentation code at a specified execution node of the WEB application. The acquired runtime parameters include: the request parameters of the WEB application and the input and output parameters of key functions; the full path name of the class, used to identify the program class to which the data belongs; the business traffic identifier mimicTag, the left bracket arrival time requestTime, and the executor ID executorID.

[0014] According to the web application mimicry adjudication system based on runtime data of the present invention, the event conversion module further includes:

[0015] The method-event mapping table is used to predefine the mapping relationship between key methods and event types within the program.

[0016] The event description information generation unit is used to encapsulate runtime parameters into JSON format event description information, and attach the event type (eventType) and the event occurrence time (eventTime).

[0017] According to the web application mimicry adjudication system based on runtime data of the present invention, the sequence alignment module further includes:

[0018] The priority queue storage unit internally maintains multiple priority queues to store event description information from different heterogeneous executors.

[0019] The sequence alignment algorithm unit is used to match and align events based on the business traffic identifier bit mimicTag, and output the set of events belonging to the same business operation to the risk adjudication module.

[0020] According to the web application mimicry adjudication system based on runtime data of the present invention, the sequence alignment algorithm unit further performs the following steps:

[0021] If the first element of multiple priority queues has the same mimicTag, the business event is considered to be successfully matched, and the corresponding event description information is dequeued and output.

[0022] If the mimicTag is inconsistent, it is determined that the event is out of order, triggering a priority queue reordering operation, and the matching step is re-executed after reordering. If the mimicTag is still inconsistent after reordering, it is determined that the event is missing, the description information of the mismatched event is cached in the buffer pool, and added back to the original priority queue after a preset time period. If it still cannot be matched after the preset timeout period, an alarm is issued to the risk adjudication module, and the unmatched event is persistently stored.

[0023] According to the WEB application mimicry adjudication system based on runtime data of the present invention, the risk adjudication module further performs the following steps: first, the event description information is vectorized; then, three adjudication factors are calculated: (1-consistency score C), maximum risk score, and maximum time tolerance; next, the above three adjudication factors are weighted and fused through a weight matrix to obtain the confidence score; finally, if the confidence score exceeds a preset threshold, the business event is determined to be abnormal and the execution body rotation is triggered.

[0024] According to the WEB application mimicry adjudication system based on runtime data of the present invention, the consistency score C is further calculated by performing a hash operation on the event description information of multiple heterogeneous executors to obtain a consistency vector, and then comparing these consistency vectors according to the consistency scoring matrix to obtain a consistency score; the maximum risk score is calculated by converting the event description information text into a risk vector through a risk transformation function, and then multiplying and accumulating the risk vector and the risk weight vector to calculate the independent risk score of each executor event, and taking the maximum value as the maximum risk score; the maximum time tolerance is calculated by comparing the timestamps of multiple events (eventTime) and calculating the difference ΔT between the maximum and minimum timestamps as the maximum time tolerance.

[0025] According to the WEB application mimicry adjudication system based on runtime data of the present invention, it further includes a feedback control module for receiving the output results of the risk adjudication module and triggering the rotation or cleaning operation of abnormal executors according to the executor ID.

[0026] Furthermore, the present invention also provides a web application mimicry adjudication method based on runtime data, implemented based on the above-mentioned web application mimicry adjudication system based on runtime data, comprising:

[0027] Insert instrumentation code into web applications to collect runtime parameters;

[0028] Convert the collected runtime parameters into JSON format event description information;

[0029] The event description information from different heterogeneous executors is time-sequentially aligned based on the business operation tags.

[0030] The aligned event description information is vectorized, multiple adjudication factors are calculated and weighted and fused to generate a confidence score;

[0031] The confidence score is used to determine whether to trigger the execution body rotation operation.

[0032] The beneficial effects achieved by adopting the above technical solution are:

[0033] 1. This invention is based on mimicry defense technology. By precisely embedding instrumentation code in heterogeneous executors, it achieves a deep extension of data collection from surface traffic to program parameters. It is no longer limited to the network transmission data captured by traditional technology, but can capture key node information of WEB application runtime in real time. It fundamentally solves the problem of misjudgment anomalies caused by coarse adjudication granularity and significantly improves adjudication accuracy.

[0034] 2. This invention adapts JSON text information for adjudication data and fully preserves the program's running parameters by vectorizing JSON event description information. At the same time, it adopts a calculation method that combines multiple adjudication factors with a weight matrix to obtain a more robust adjudication score. Compared with the existing single-factor adjudication or unweighted calculation method, it significantly reduces the impact of single abnormal interference on the results and significantly improves the reliability and anti-interference ability of the adjudication results. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.

[0036] Figure 1 This is an architecture diagram of the WEB application mimicry adjudication system based on runtime data according to Embodiment 2 of the present invention;

[0037] Figure 2 This is a flowchart of the parameter acquisition and event conversion method according to Embodiment 2 of the present invention;

[0038] Figure 3 This is a summary description of the runtime event types in Embodiment 2 of the present invention;

[0039] Figure 4 This is the database operation related function mapping table of Embodiment 2 of the present invention;

[0040] Figure 5 This is the MONGO database event description information data format of Embodiment 2 of the present invention;

[0041] Figure 6 This is the pseudocode of the risk adjudication algorithm in Embodiment 2 of the present invention. Detailed Implementation

[0042] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.

[0043] Example 1

[0044] To address the problem of insufficient accuracy caused by the coarse granularity and single decision factor in traditional traffic-based decision-making, this invention discloses a web application mimicry decision-making system based on runtime data, including a parameter acquisition module, an event conversion module, a sequence alignment module, and a risk decision-making module.

[0045] (1) Parameter acquisition module

[0046] The parameter acquisition module is used to embed pre-defined instrumentation code in key functions of a web application, collecting parameter and additional information of these functions in real time. This information is then aggregated and processed by the event conversion module. The collected and parsed data includes three core types of information: first, runtime parameter data of the web application, covering request parameters and runtime parameters of key functions (including input and output parameters); second, the fully qualified class name, used to track the internal execution of the program and identify the program class to which the data belongs; and third, other information fields, including the business traffic identifier mimicTag, used to uniquely identify the current business operation; the left bracket arrival time requestTime, used to record the time when the request traffic arrives at the left bracket; and the executor ID, used to record the executor ID of the current parameter collection.

[0047] In this solution, heterogeneous executors refer to multiple web application instances that are based on the same business logic but differ in runtime environment, system components, dependency library versions, or underlying instruction sets. Multiple heterogeneous executors synchronously process the same business request and output runtime parameters to the parameter acquisition module respectively.

[0048] (2) Event Transition Module

[0049] The event transformation module dynamically converts runtime parameters collected from multiple heterogeneous executors into structured runtime events. The transformation process relies on two core elements: first, a method-event mapping table, which predefines the mapping relationship between key methods and event types within the program, realizing the mapping from method execution to event triggering; second, encapsulating runtime parameters into JSON-formatted event description information, including the input and output parameters of key functions, the fully qualified class name, etc.; and appending the event type (eventType) generated based on the mapping table and the event occurrence time (eventTime) accurate to milliseconds to the event description information, providing standardized data support for subsequent sequence alignment and risk adjudication modules.

[0050] (3) Sequence alignment module

[0051] The sequence alignment module aligns runtime events from different heterogeneous executors according to business operation tags, essentially aligning unordered event sets to business operations. The module receives JSON-formatted event descriptions from different executors, time periods, and business operations within the same application, in an unordered manner. It then filters out JSON-formatted event descriptions originating from a group of heterogeneous executors, within the same time period, and under the same business operation, and passes these to the risk adjudication module. The sequence alignment module includes a priority queue storage unit and a sequence alignment algorithm unit.

[0052] The priority queue storage unit internally maintains multiple priority queues to store event description information from different heterogeneous executors.

[0053] The sequence alignment algorithm unit is used to efficiently match and align events based on the business traffic identifier (mimicTag), quickly filtering out sets of event description information belonging to the same business operation, reducing redundant comparisons, and improving the delivery efficiency and matching accuracy of event description information; and outputting the set of events belonging to the same business operation to the risk adjudication module. The business traffic identifier (mimicTag) is the core flag for matching event description information under the same business operation.

[0054] Furthermore, the sequence alignment algorithm unit performs the following steps:

[0055] ① If the first element of multiple priority queues has the same mimicTag, the business event is considered to be successfully matched, and the corresponding event description information is dequeued and output.

[0056] ② If the mimicTag is inconsistent, it is determined that the event is out of order, triggering the priority queue to rearrange, and the matching step is re-executed after rearrangement; if the mimicTag is still inconsistent after rearrangement, it is determined that the event is missing, the description information of the mismatched event is cached in the buffer pool, and added back to the original priority queue after a preset time period; if it still cannot be matched after the preset timeout period, an alarm is sent to the risk adjudication module, and the unmatched event is persistently stored.

[0057] The missing item here refers to an event description message for a certain business operation in only two of the three priority queues, while the other may be blocked for some reason. Therefore, the event description messages of the two in the priority queue are placed in the buffer pool to avoid affecting the event matching of other business operations. After waiting for a time period t, the event description message in the buffer pool is put back into the original queue to check if it can be matched. If the match is successful, it means that the blocked business operation also generated the event description message normally and added it to the priority queue during the time it was placed in the buffer. If no match is found after 3t, it means that the blocked business operation is still blocked, and an alarm is sent to the risk adjudication module.

[0058] (4) Risk adjudication module

[0059] The risk adjudication module is used to vectorize a set of aligned JSON-formatted event description information, calculate multiple adjudication factors and weightedly fuse them to generate a final confidence score. The feedback control determines whether to trigger the execution body rotation operation based on the confidence score, thereby intercepting network attacks.

[0060] The risk adjudication module performs the following steps: First, the event description information (including fields such as eventType and eventTime) is vectorized; then, three adjudication factors are calculated: (1-consistency score C), maximum risk score, and maximum time tolerance; next, the above three adjudication factors are weighted and fused through a weight matrix to obtain the confidence score; finally, if the confidence score exceeds the preset threshold, the business event is determined to be abnormal and the execution body rotation is triggered.

[0061] The consistency score C is used to check whether the runtime behavior trajectories of multiple executors are logically consistent. The consistency score is calculated by performing a hash operation on the event description information of multiple heterogeneous executors to obtain corresponding consistency vectors, and then comparing these consistency vectors with the consistency scoring matrix to obtain the consistency score.

[0062] The maximum risk score extracts the highest value of risk features within a single time period. The maximum risk score is calculated by converting the event description text into a risk vector using a risk transformation function, then multiplying and summing the risk vector with the risk weight vector to obtain an independent risk score for each event.

[0063] The maximum time tolerance assesses the deviation of the event sequence from a preset reasonable range. The maximum time tolerance is calculated by comparing the timestamps of multiple events (eventTime) and calculating the difference ΔT between the maximum and minimum timestamps as the maximum time tolerance.

[0064] (5) Feedback control module

[0065] The feedback control module receives the output of the risk adjudication module and triggers the rotation or cleanup operation of abnormal executors based on the executor ID.

[0066] This invention also discloses a web application mimicry adjudication method based on runtime data, comprising the following steps:

[0067] Insert instrumentation code into web applications to collect runtime parameters;

[0068] Convert the collected runtime parameters into JSON format event description information;

[0069] The event description information from different heterogeneous executors is time-sequentially aligned based on the business operation tags.

[0070] The aligned event description information is vectorized, multiple adjudication factors are calculated and weighted and fused to generate a confidence score;

[0071] The confidence score is used to determine whether to trigger the execution body rotation operation.

[0072] Specifically, after mimicry modifications and the implantation of relevant probes (i.e., instrumentation code), any network traffic passing through a left parenthesis undergoes a multi-processing operation, and is received by the parameter acquisition module at the execution body entry point, where the HTTP request parameters are parsed and then tracked. When a critical method (also known as a critical function) is reached, its input and output parameters are collected and reported. The event conversion module converts the parameter information into JSON event description information based on parameter identifiers and an event function mapping table. After passing through the sequence alignment module, event information from multiple execution bodies for the same event is input into the risk adjudication module. The event description information is first converted into a text vector, then a three-variable adjudication factor is calculated, including a consistency score, a maximum risk score, and a maximum time tolerance. Finally, a weighted fusion is performed using a weighted matrix to calculate the final adjudication score. Finally, a preset threshold is used to determine whether the event is abnormal. If it is a normal event, no additional processing is performed; if it is an abnormal event, the adjudication result is notified to the feedback control module, which then performs an execution body rotation operation to intercept network attacks. The above is the overall risk adjudication process.

[0073] Example 2

[0074] This invention innovatively combines mimicry defense technology with code instrumentation technology to heterogeneously process web applications, monitor runtime parameters in real time rather than network traffic, and promptly rotate abnormal execution entities to achieve detection and protection of web applications. Figure 1 As shown, the web application mimicry adjudication system based on runtime data includes a parameter acquisition module, an event conversion module, a sequence alignment module, and a risk adjudication module. This embodiment of the invention is currently only applicable to web application scenarios and uses the Java programming language.

[0075] Traditional mimicry defense technology relies on the redundancy of multiple heterogeneous execution entities. It collects network traffic data (including source and destination IPs, transmission protocols, access frequency, and packet structure) from each entity and identifies anomalous entities by comparing the consistency of traffic across multiple entities. Under normal circumstances, the traffic characteristics of heterogeneous execution entities should converge. If an execution entity exhibits deviations such as a sudden increase in traffic, illegal port access, or abnormal packet format, it is marked as anomalous. A feedback control component then rotates and replaces the anomalous execution entity.

[0076] Java code instrumentation technology is based on JVM bytecode enhancement technology, using the Java Instrumentation API and JVMTI to achieve non-intrusive modification of class behavior. Its core principle is to intercept bytecode streams through a custom `ClassFileTransformer` during class loading or runtime. After being parsed and modified by bytecode manipulation tools (such as the ASM library and Javassist library), the bytecode is then submitted to the JVM for loading or redefinition. The specific process is as follows: 1) The instrumentation program is mounted to the target JVM via the `premain` (startup time) or `agentmain` (runtime) methods, registering the bytecode transducer; 2) When the target class is loaded (or a retransformation is triggered), the transducer intercepts the byte array of the `.class` file and modifies the bytecode structure according to business requirements (such as inserting monitoring logic at method entry / exit points) (e.g., adding local variables, calling helper methods); 3) The modified bytecode is loaded and executed by the JVM, thus achieving functional enhancements (such as request parameter collection, call chain tracing) without modifying the source code.

[0077] Mimicked Left Bracket Component: When an attacker launches an attack, all network requests triggered by the mimicked left bracket are first received, further preprocessed, and then redistributed to three heterogeneous entities—a three-way traffic split. During preprocessing, some custom control fields are added. Relevant to this solution, the business traffic identifier `mimicTag` and `requestTime` are appended to the HTTP / HTTPS header for use by the sequence alignment module.

[0078] Parameter Acquisition Module: First, a probe (instrument code) is embedded into the web application. At the web application's access point, it parses HTTP / HTTPS request parameters, including: 1. Request method, 2. Request URI, 3. Request URL, 4. Parameter type, 5. Request header information, 6. Request path parameter (param), 7. Request body, 8. Cookie information, 9. Full path name of the request method, 10. Request API, 11. Request protocol, 12. Domain name, 13. Request port, 14. Business traffic identifier (mimicTag), and 15. Left bracket arrival time (requestTime). Then, the probe tracks the call history of the request parameters and saves the method name (full path class name) and the runtime parameters (input and output parameters) of the methods along the call path. This data is temporarily stored in Redis and then pushed to the event transformation module via the Kafka message middleware. Figure 2 As shown, parameter data is collected through data bypass, and the collection of parameters will not affect the business program itself.

[0079] Event Transformation Module: When a web application reaches a critical method, the probe generates a description of the event based on the method event mapping table, such as... Figure 3 , Figure 4 As shown. Figure 3 All event types are defined. Figure 4 This refers to the fully qualified class name of the key methods for relational database operations (due to the large scale of the project based on a mature commercial product, it's difficult to show all the details). The event occurrence is identified by the event transformation module detecting the execution of the key method through the parameter data received from the message queue and the fully qualified class name in the call path. At this point, it obtains the event's timestamp flag `eventTime` and event type `eventType`, generates a JSON-formatted event description, and finally reports it to the event sequence alignment module. The event description information is as follows: Figure 5 The following are included: event alignment field, instrumentation point method name and input / output parameters, instrumentation point upstream method name and input / output parameters, and instrumentation point downstream method name and input / output parameters.

[0080] The sequence alignment module's main function is to align all JSON-formatted event descriptions for business purposes. Specifically, it matches the time descriptions of identical business operations from three different executors within the same time period, accelerating the decision-making process when submitted to the risk adjudication module. Internally, it maintains three priority queues, storing event descriptions for three heterogeneous entities (entity 1, entity 2, and entity 3) respectively. Event matching is then performed according to the following sequence alignment algorithm:

[0081] Let A1, B1, and C1 represent the first elements of priority queues A, B, and C, respectively.

[0082] 1) If the sequence numbers of mimicTag of A1, B1, and C1 are equal, it is recorded as A1 = B1 = C1, that is, the business event is successfully matched. At the same time, the three JSON format event description information are dequeued and handed over to the risk adjudication module.

[0083] 2) If A1≠B1=Ci or A1≠B1≠C1, it can be determined that the order is out of order, triggering the priority queue reordering operation. After the reordering is successful, it can be determined whether the first element of the three priority queues is equal.

[0084] 3) If, after sorting the priority queue, A1≠B1≠C1 or A1≠B1=C1 still exists, it is determined to be a missing item. First, cache the mismatched item in the buffer pool to avoid affecting the matching of other events in the queue. After waiting for a time period t, re-add it to the original priority queue. If no match is found after 3t, an alert is sent to the risk adjudication module and persisted to the database.

[0085] Risk adjudication module: Its core is the risk adjudication algorithm, and its main operations include: 1. Vectorizing event description information, 2. Calculating adjudication factors, and 3. Informing the user of the adjudication result. Its pseudocode is as follows: Figure 6 As shown. The algorithm initially calculates the maximum time difference tolerance ΔT for the three event descriptions based on the event description information of the three executors. This tolerance is calculated from the timestamps. If ΔT is greater than 5, an alarm is triggered directly. If it is less than 5, the adjudication process begins.

[0086] 1) Perform a hash operation on the event description information of executors A1, A2, and A3 to obtain a consistency vector. Compare the scores of the three consistency vectors and obtain the consistency score C based on the consistency scoring matrix. For example, if h1≠h2≠h3, then C is 0; if h1=h2=h3, then C is 1; if h1=h2≠h3, then C is 2 / 3.

[0087] 2) Input the entire event description information text of execution bodies A1, A2, and A3 into the risk conversion function. First, perform word segmentation and then text vectorization to obtain the risk vector. Then, accumulate the risk vector by multiplying the risk vector with the risk weight vector to obtain the risk score corresponding to A1, A2, and A3. After the extremum operation, obtain the maximum risk score S_max.

[0088] 3) Multiply the inconsistency (1-C), the maximum risk score S_max, and the maximum time tolerance ΔT by the weights α, β, and γ to obtain the final decision score.

[0089] 4) If the adjudication score is greater than the alarm threshold of 0.6, the alarm flag will be set to true and reported to the feedback control component along with the execution unit ID.

[0090] The feedback control module monitors the operational status of heterogeneous executors in real time through multi-mode arbiters (such as risk arbiters, left bracket arbiters, right bracket arbiters, etc.). When abnormal behavior (such as unknown vulnerabilities or backdoor attacks) is detected, a negative feedback controller is immediately triggered to isolate and replace the abnormal executor, preventing the attack from spreading. Isolating and replacing abnormal executors can be further divided into abnormal rotation and periodic cleaning operations. Abnormal rotation refers to selecting a heterogeneous executor from the heterogeneous image and triggering executor switching based on system operational status feedback. When performance anomalies, intrusion traces, or other risk signals are detected, the executor with security vulnerabilities is immediately replaced. Periodic cleaning refers to resetting the executors and operating environment according to a preset cycle, clearing potential hidden attack traces, cached vulnerabilities, or unknown malicious code, restoring the system to its initial security state, and reducing the security risks accumulated over long-term operation. In this solution, the feedback control module determines whether to perform executor rotation based on the alarm flag of the risk arbiter model. Since feedback control is a one-to-many model, with one feedback control model managing multiple executors under multiple applications, it is necessary to determine which executor needs to be rotated based on the executor ID.

[0091] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A web application mimicry adjudication system based on runtime data, characterized in that, include: The parameter acquisition module is used to insert instrumentation code into key functions of web applications to collect their runtime parameters in real time. The event conversion module is used to convert the collected runtime parameters of multiple heterogeneous executors into structured runtime events; The sequence alignment module is used to align runtime events from different heterogeneous executors in sequence according to business operation tags. The risk adjudication module is used to vectorize the text data of aligned runtime events, calculate multiple adjudication factors and weighted fuse them to generate the final confidence score. The feedback control determines whether to trigger the execution body rotation operation based on the confidence score.

2. The web application mimicry adjudication system based on runtime data according to claim 1, characterized in that, The heterogeneous executor refers to multiple web application instances that are based on the same business logic but differ in runtime environment, system components, dependency library versions, or underlying instruction sets. The multiple heterogeneous executors synchronously process the same business request and output runtime parameters to the parameter acquisition module respectively.

3. The web application mimicry adjudication system based on runtime data according to claim 1, characterized in that, The parameter acquisition module uses bytecode instrumentation technology to implant instrumentation code into specified execution nodes of the web application. The collected runtime parameters include: request parameters of the web application and input and output parameters of key functions; full path name of the class, used to identify the program class to which the data belongs; business traffic identifier mimicTag, left bracket arrival time requestTime, and executorID.

4. The web application mimicry adjudication system based on runtime data according to claim 3, characterized in that, The event conversion module includes: The method-event mapping table is used to predefine the mapping relationship between key methods and event types within the program. The event description information generation unit is used to encapsulate runtime parameters into JSON format event description information, and attach the event type (eventType) and the event occurrence time (eventTime).

5. The web application mimicry adjudication system based on runtime data according to claim 4, characterized in that, The sequence alignment module includes: The priority queue storage unit internally maintains multiple priority queues to store event description information from different heterogeneous executors. The sequence alignment algorithm unit is used to match and align events based on the business traffic identifier bit mimicTag, and output the set of events belonging to the same business operation to the risk adjudication module.

6. The web application mimicry adjudication system based on runtime data according to claim 5, characterized in that, The sequence alignment algorithm unit performs the following steps: If the first element of multiple priority queues has the same mimicTag, the business event is considered to be successfully matched, and the corresponding event description information is dequeued and output. If the mimicTag is inconsistent, it is determined that the event is out of order, triggering a priority queue reordering operation, and the matching step is re-executed after reordering. If the mimicTag is still inconsistent after reordering, it is determined that the event is missing, the description information of the mismatched event is cached in the buffer pool, and added back to the original priority queue after a preset time period. If it still cannot be matched after the preset timeout period, an alarm is issued to the risk adjudication module, and the unmatched event is persistently stored.

7. The web application mimicry adjudication system based on runtime data according to claim 4, characterized in that, The risk adjudication module performs the following steps: First, the event description information is vectorized; then, three adjudication factors are calculated: (1-consistency score C), maximum risk score, and maximum time tolerance; next, the above three adjudication factors are weighted and fused through a weight matrix to obtain the confidence score; finally, if the confidence score exceeds a preset threshold, the business event is determined to be abnormal and the execution body rotation is triggered.

8. The web application mimicry adjudication system based on runtime data according to claim 7, characterized in that, The consistency score C is calculated by performing a hash operation on the event description information of multiple heterogeneous executors to obtain a consistency vector, and then comparing these consistency vectors with the consistency scoring matrix to obtain a consistency score; the maximum risk score is calculated by converting the event description information text into a risk vector using a risk transformation function, multiplying the risk vector with the risk weight vector and accumulating the results to calculate the independent risk score for each executor event, and taking the maximum value as the maximum risk score. The maximum time tolerance is calculated by comparing the timestamps of multiple events (eventTime) and calculating the difference ΔT between the maximum and minimum timestamps as the maximum time tolerance.

9. The web application mimicry adjudication system based on runtime data according to claim 1, characterized in that, It also includes a feedback control module, which receives the output of the risk adjudication module and triggers the rotation or cleaning operation of abnormal executors based on the executor ID.

10. A web application mimicry adjudication method based on runtime data, characterized in that, The system is implemented based on the runtime data-based web application mimicry adjudication system as described in any one of claims 1-9, and includes: Insert instrumentation code into web applications to collect runtime parameters; Convert the collected runtime parameters into JSON format event description information; The event description information from different heterogeneous executors is time-sequentially aligned based on the business operation tags. The aligned event description information is vectorized, multiple adjudication factors are calculated and weighted and fused to generate a confidence score; The confidence score is used to determine whether to trigger the execution body rotation operation.

Images