CN115292707A - Credibility judgment method and device based on dynamic class call sequence - Google Patents

Abstract

Embodiments of the present invention provide a method and device for judging credibility based on a dynamic class call sequence. The method is applied to a business system developed based on the Java language, including: in response to the Java virtual machine loading a target class, judging whether the target class is a dynamic class; if the target class is a dynamic class, judging the stack corresponding to the dynamic class Whether the call sequence of the target class in the information is included in the dynamic class call sequence whitelist; if the call sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class call sequence whitelist, determine If the target class is untrustworthy, the loading of the target class is intercepted, and alarm information is generated. The embodiments of the present invention can prevent attackers from attacking by constructing malicious dynamic classes, so as to achieve the purpose of security protection.

Description

Credibility Judgment Method and Device Based on Dynamic Class Call Sequence

technical field

The invention relates to the technical field of JAVA server security, in particular to a reliability judgment method and device based on a dynamic class calling sequence.

Background technique

During the running of a Java program, many class objects will be generated. According to whether the class file exists before the Java Virtual Machine (JavaVirtualMachine, JVM for short) runs, it can be divided into static classes and dynamic classes. Many malicious classes used in Java attacks are carefully constructed by the attackers themselves, loaded after the JVM runs, and belong to dynamic classes. Usually, for malicious dynamic classes, monitoring points can be set to match black rules, and the attack behavior that hits the black rules will be alerted when the command is executed. However, based on black rule matching, only known vulnerabilities can be protected, and the judgment is only made when the execution of malicious commands is triggered. The number of monitoring points set will greatly affect the performance of the system. Among them, black rules refer to rules that have been discovered, are harmful, and can be used to launch attacks. Vulnerabilities are generated based on rules. By analyzing the principles of known vulnerabilities, the principles and rules that generate known vulnerabilities are considered as dangerous and untrustworthy black rules. As long as black rules are triggered in the existing protection, it will be considered that these known vulnerabilities are being used to launch attacks.

Contents of the invention

Aiming at the problems in the prior art, the embodiment of the present invention provides a reliability judgment method and device based on a dynamic class calling sequence.

Specifically, the embodiments of the present invention provide the following technical solutions:

In the first aspect, the embodiment of the present invention provides a method for judging credibility based on a dynamic class call sequence, which is applied to a business system developed based on the Java language, including:

In response to the Java virtual machine loading the target class, it is determined whether the target class is a dynamic class;

If the target class is a dynamic class, determine whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist;

If the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence whitelist, then determine that the target class is untrustworthy, intercept the loading of the target class, and generate an alarm message.

Further, before the loading of the target class in response to the Java virtual machine, before judging whether the target class is a dynamic class, it also includes:

Simulate the execution of the source code of the business system to trigger the generation of various dynamic classes;

Obtain the call sequence generated in the corresponding stack information when each dynamic class is generated, generate a white list of the dynamic class call sequence, and each dynamic class corresponds to a piece of stack information.

Further, each piece of stack information contains a plurality of class methods, and the acquisition of the call sequence generated in the corresponding stack information when each dynamic class is generated generates a whitelist of the dynamic class call sequence, including:

Analyze each class method one by one from the end of the corresponding stack information;

Determine a group of class methods that satisfy the closed principle of dynamic class call sequence as a call sequence generated when a dynamic class is generated;

The determined call sequence generated when the dynamic class is generated is recorded to obtain a white list of the call sequence of the dynamic class.

Further, the closure principle of the dynamic class call sequence is: belonging to a class framework, irrelevant to business, templated, fixed content, and not affected by parameters and objects calling class methods.

Further, in response to loading the target class by the Java virtual machine, judging whether the target class is a dynamic class includes:

In response to the Java virtual machine loading the target class, determine whether the name of the target class is the name of the class in the source code of the business system;

If the name of the target class is the name of the class in the source code of the business system, then determine that the target class is a static class;

If the name of the target class is not the name of a class in the source code of the business system, then determine that the target class is a dynamic class.

Further, before the loading of the target class in response to the Java virtual machine, before judging whether the target class is a dynamic class, it also includes:

The source code of the business system is scanned, and the name of the class in the source code of the business system is recorded.

Further, if the target class is a dynamic class, after judging whether the call sequence of the target class in the stack information is included in the dynamic class call sequence whitelist, it also includes:

If the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence whitelist, it is determined that the target class is credible, and the loading of the target class is executed.

In the second aspect, the embodiment of the present invention also provides a reliability judgment device based on a dynamic class call sequence, which is applied to a business system developed based on the Java language, including:

A dynamic class judging module, configured to load a target class in response to a Java virtual machine, and judge whether the target class is a dynamic class;

The credibility judging module is used to judge whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist if the target class is a dynamic class;

An interception alarm module, configured to determine that the target class is not credible if the call sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class call sequence whitelist, and intercept the loading of the target class , and generate an alarm message.

In the third aspect, the embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the program, the first The steps of the reliability judging method based on the dynamic class calling sequence described in the aspect.

In the fourth aspect, the embodiment of the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the dynamic class call sequence based on the first aspect is implemented. The steps of the reliability judgment method.

In the fifth aspect, the embodiment of the present invention also provides a computer program product, on which executable instructions are stored, and when the instructions are executed by the processor, the processor can realize the reliability based on the dynamic class call sequence described in the first aspect. steps in the judgment method.

The method and device for judging credibility based on dynamic class calling sequences provided by the embodiments of the present invention are applied to business systems developed based on the Java language. By loading the target class in response to the Java virtual machine, it is judged whether the target class is a dynamic class. If the class is a dynamic class, determine whether the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence white list, if the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence white list list, determine that the target class is untrustworthy, intercept the loading of the target class, and generate an alarm message; when the Java virtual machine loads a dynamic class, according to the white list of the dynamic class call sequence, it is judged that the loaded dynamic class is generated in the stack information Whether the call sequence of the loaded dynamic class is a credible call sequence. When the call sequence generated by the loaded dynamic class in the stack information is an untrusted call sequence, the loading of the dynamic class is intercepted and alerted, which can prevent attackers from constructing malicious The malicious dynamic class is used to implement the attack to achieve the purpose of security protection. Since the interception of the malicious dynamic class is carried out when the virtual machine is loaded, it can prevent the malicious dynamic class from entering the virtual machine and triggering the execution of malicious commands. Because it is based on the dynamic class The call sequence whitelist judges the call sequence of dynamic classes, which can protect against unknown vulnerabilities and effectively deal with java script attacks.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic flowchart of a method for judging credibility based on a dynamic class calling sequence provided by an embodiment of the present invention;

FIG. 2 is a schematic flow diagram of generating a dynamic class call sequence whitelist provided by an embodiment of the present invention;

Fig. 3 is a schematic flowchart of another method for judging credibility based on a dynamic class calling sequence provided by an embodiment of the present invention;

Fig. 4 is a schematic flowchart of an application scenario of a method for analyzing execution permissions based on bytecode provided by the present invention;

Fig. 5 is a schematic structural diagram of a reliability judging device based on a dynamic class calling sequence provided by an embodiment of the present invention;

FIG. 6 is a schematic diagram of a physical structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

The method for judging credibility based on the dynamic class calling sequence provided by the embodiment of the present invention will be described below with reference to FIGS. 1-4 .

Please refer to Fig. 1, Fig. 1 is the schematic flow chart of the reliability judgment method based on the dynamic class calling sequence provided by the embodiment of the present invention, the reliability judging method based on the dynamic class calling sequence shown in Fig. 1 can be applied to Java-based The business system developed by language can be executed by the reliability judgment device based on the dynamic class call sequence, and the reliability judgment device based on the dynamic class call sequence can be set on the server of the business system. The type of server is not limited. For example, the business system may be a financial business system, etc., and the server may be a physical server including an independent host, a virtual server hosted by a host cluster, or a cloud server. As shown in Figure 1, the credibility judgment method based on the dynamic class call sequence at least includes:

101. In response to loading a target class by the Java virtual machine, determine whether the target class is a dynamic class.

In the embodiment of the present invention, a static class refers to a class that exists before the Java virtual machine runs, and a file with a suffix of .class can be found in the storage memory of the operating system. Generated in the Java virtual machine, it will not be generated if the Java virtual machine is not running. Generally, it exists in the running memory of the operating system and does not form a class file. When the server of the business system loads the target class through the Java virtual machine, it can first judge whether the loaded target class is a dynamic class. For example, it can be judged whether the loaded target class is a dynamic class according to the source code of the business system. If the target If the name of the class is in the source code of the business system, it can be determined that the target class is a static class; if the name of the target class is not in the source code of the business system, it can be determined that the target class is a dynamic class.

The embodiment of the present invention does not limit the implementation method of judging whether the target class is a dynamic class in response to the Java virtual machine loading the target class. For example, when loading the target class in response to the Java virtual machine, the name of the target class can be obtained through the Hook function. Whether the target class is a dynamic class is judged according to the name of the class in the source code of the pre-recorded business system.

102. If the target class is a dynamic class, determine whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist.

In the embodiment of the present invention, since each dynamic class will generate a stack information, which contains multiple class methods of the dynamic class, it can be composed of multiple class methods of the dynamic class. The record of the running process information is called the calling sequence of the dynamic class. Therefore, after determining that the target class is a dynamic class, the stack information can be further obtained, and according to the dynamic class call sequence whitelist, it can be judged whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist. Wherein, the dynamic class call sequence whitelist is composed of credible call sequences generated when the dynamic class of the corresponding business system is generated, and each business system has its own dynamic class call sequence whitelist.

For example, when a dynamic class named com.jvm.work.agentaop.JDKProxy is generated, the call sequence generated in the stack information is:

java.lang.reflect.Proxy.newProxyInstance ->

java.lang.reflect.Proxy.getProxyClass0 ->

java.lang.reflect.WeakCache.get ->

java.lang.reflect.WeakCache$Factory.get->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy.access$300->

java.lang.reflect.Proxy.defineClass0 ->

Among them, newProxyInstance, getProxyClass0, WeakCache.get, ..., defineClass0 are the names of the class methods.

103. If the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence whitelist, determine that the target class is untrustworthy, intercept loading of the target class, and generate an alarm message.

In the embodiment of the present invention, according to the fact that the target class is a dynamic class, it is further determined that the call sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class call sequence whitelist, and it can be determined that the call sequence of the target class is not credible. Indicating that the target class is a malicious class, the loading of the target class can be further intercepted to prevent the target class from entering the Java virtual machine for execution and generate an alarm message.

The credibility judgment method based on the dynamic class calling sequence provided by the embodiment of the present invention is applied to a business system developed based on the Java language. By loading the target class in response to the Java virtual machine, it is judged whether the target class is a dynamic class. If the target class is Dynamic class, to determine whether the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence white list, if the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence white list , then determine that the target class is untrustworthy, intercept the loading of the target class, and generate an alarm message; when the Java virtual machine loads the dynamic class, according to the dynamic class call sequence whitelist, judge the call generated by the loaded dynamic class in the stack information Whether the sequence is a credible call sequence. When the call sequence generated by the loaded dynamic class in the stack information is an untrusted call sequence, the loading of the dynamic class is intercepted and alerted, which can prevent attackers from constructing malicious dynamic classes to implement attacks to achieve the purpose of security protection, because the interception of malicious dynamic classes is carried out when the virtual machine is loaded, it can prevent malicious dynamic classes from entering the virtual machine to trigger the execution of malicious commands, because it is based on the dynamic class call sequence The white list judges the calling sequence of dynamic classes, which can protect against unknown vulnerabilities and effectively deal with java script attacks.

Please refer to FIG. 2. FIG. 2 is a schematic flow diagram of generating a dynamic class call sequence whitelist provided by an embodiment of the present invention. As shown in FIG. Also includes:

201. Simulate and execute the source code of the business system to trigger generation of various dynamic classes.

In the embodiment of the present invention, the source code of the business system may include a Java language software development kit (Java Development Kit, referred to as JDK) and business engineering source code, and the business engineering source code may be based on a commonly used third-party framework, for example, Tomcat, spring, springboot, weblogic, etc., are source codes developed for specific needs. Tools such as asm and javassist can be used to simulate and execute the source code of the business system, so that the source code of the business project can run based on JDK, triggering the generation of various dynamic classes, for example, dynamic proxy classes based on Spring AOP, Hibernate and Cglib.

202. Obtain the call sequence generated in the corresponding stack information when each dynamic class is generated, and generate a dynamic class call sequence whitelist, and each dynamic class corresponds to a stack information.

In the embodiment of the present invention, when the source code of the business system is simulated and executed, a piece of stack information generated when each dynamic class is generated can be obtained, and each piece of stack information corresponds to a credible call sequence generated by a dynamic class. The obtained credible call sequence builds a white list of dynamic class call sequences of the business system. In some optional examples, since each stack information contains multiple class methods, each class method can be analyzed one by one starting from the end of the corresponding stack information, and a group of class methods that satisfy the dynamic class call sequence closure principle , determine a call sequence generated when a dynamic class is generated, and then record the determined call sequence generated when the dynamic class is generated, to obtain a white list of dynamic class call sequences. Optionally, the closure principle of the dynamic class call sequence is as follows: belonging to a class framework, irrelevant to business, templated, fixed content, and not affected by two external factors of parameters and objects calling class methods. In some optional examples, the trusted calling sequence generated by each dynamic class can be written into a designated file, and this file can be used as a dynamic class calling sequence whitelist.

For example, the stack info is:

com.jvm.work.agentaop.JDKProxy.getProxyInstance->

java.lang.reflect.Proxy.newProxyInstance ->

java.lang.reflect.Proxy.getProxyClass0 ->

java.lang.reflect.WeakCache.get ->

java.lang.reflect.WeakCache$Factory.get->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy.access$300->

java.lang.reflect.Proxy.defineClass0 ->

sun.instrument.InstrumentationImpl.transform ->

sun.instrument.TransformerManager.transform ->

com.jvm.work.agent.MyMonitorTransformer.transform ->

java.lang.Thread.getStackTrace->…

Analyze each class method one by one from the end of the stack information, trace upwards from the class method java.lang.reflect.Proxy.defineClass0, look at the parameters of the class method, the object calling the class method, and the specific implementation content of the code, and find that The dynamic classes generated by the Proxy framework start with the class method java.lang.reflect.Proxy.newProxyInstance, and the content of the generated dynamic classes is fixed, templated, and not subject to parameters and objects that call class methods. Influenced by factors, the process composed of these class methods satisfies the closed principle of dynamic class call sequence, and can be considered as a credible call sequence, which is recorded in the whitelist. The credible call sequence obtained from the stack information is:

java.lang.reflect.Proxy.newProxyInstance ->

java.lang.reflect.Proxy.getProxyClass0 ->

java.lang.reflect.WeakCache.get ->

java.lang.reflect.WeakCache$Factory.get->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy$ProxyClassFactory.apply->

java.lang.reflect.Proxy.access$300->

java.lang.reflect.Proxy.defineClass0->.

This embodiment triggers the generation of various dynamic classes by simulating the execution of the source code of the business system, and generates a whitelist of dynamic class call sequences by obtaining the credible call sequence generated in the stack information when each dynamic class is generated. Make the generated dynamic class call sequence whitelist include credible call sequences generated when all dynamic classes in the business system are generated, which can be used to judge the credibility of the target class loaded by the Java virtual machine according to the dynamic class call sequence whitelist Provide evidence.

Please refer to FIG. 3. FIG. 3 is a schematic flowchart of another credibility judgment based on a dynamic class call sequence provided by an embodiment of the present invention. As shown in FIG. 3, the method for analyzing execution permissions based on bytecode at least includes:

301. In response to loading a target class by the Java virtual machine, determine whether the name of the target class is the name of a class in the source code of the business system.

If the name of the target class is the name of the class in the source code of the business system, then determine that the target class is a static class; if the name of the target class is not the name of the class in the source code of the business system, go to 302 .

302. Determine that the target class is dynamic, and determine whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist.

In some optional examples, when the Java virtual machine loads a certain target class, the Java virtual machine can notify the Hook function through a callback, and the Hook function can obtain the name of the loaded target class, according to the class in the source code of the business system to determine whether the name of the target class is the name of the class in the source code of the business system, if the name of the target class is not the name of the class in the source code of the business system, it indicates that the name of the target class is not in the source code of the business system , it can be determined that the target class is a dynamic class, and it can be further judged whether the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence white list, if the name of the target class is the class in the source code of the business system name, it indicates that the name of the target class is in the source code of the business system, and it can be determined that the target class is a static class. Optionally, after determining that the target class is a static class, it can be indicated that the target class is a safe class, and the Java virtual machine is returned to execute the loading of the target class, or the target class can be further judged by other methods for judging the credibility of the static class The credibility of this is not limited in this embodiment of the present invention.

In some optional examples, before judging whether the name of the target class is the name of a class in the source code of the business system in response to the Java virtual machine loading the target class, the source code of the business system can be scanned to record the business system The name of the class in the source code of the business system provides a basis for judging whether the target class is a dynamic class based on the name of the class in the source code of the business system.

If the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence whitelist, execute 303; if the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence whitelist , execute 304.

303. Determine that the target class is untrustworthy, intercept loading of the target class, and generate alarm information.

304. Determine that the target class is credible, and execute loading of the target class.

In some optional examples, after the Hook function further determines whether the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence whitelist, if the calling sequence of the target class in the stack information corresponding to the dynamic class If it is not included in the dynamic class call sequence whitelist, it indicates that the call sequence of the target class is untrustworthy, and the target class is a malicious class. The loading of the target class can be intercepted to prevent the target class from entering the Java virtual machine for execution and generate an alarm. information, if the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence whitelist, it indicates that the calling sequence of the target class is credible, the target class is a safe class, and the Java virtual machine can return to execute the target class. Loading, the target class enters the Java virtual machine for execution.

In this embodiment, when the Java virtual machine loads the target class, it is judged whether the target class is a dynamic class according to the name of the class in the source code of the business system, and after the target class is determined to be a dynamic class, the sequence whitelist is called according to the dynamic class , to judge whether the call sequence of the dynamic class is a credible call sequence, it can accurately distinguish the dynamic class from the static class, so that the credibility of the dynamic class can be judged according to the call sequence in the stack information, which can simplify the guarantee for the class The accuracy of the credibility judgment.

Please refer to FIG. 4. FIG. 4 is a schematic diagram of an application scenario of a method for judging credibility based on a dynamic class calling sequence provided by an embodiment of the present invention. As shown in FIG. 4, the method for judging credibility based on a dynamic class calling sequence Include at least:

1. Collect and analyze the source code of JDK and business engineering, and trigger the generation of various dynamic classes, for example, dynamic proxy classes based on Spring AOP, Hibernate, and Cglib.

2. Obtain the stack information when the dynamic class is generated. Each dynamic class corresponds to a stack information. A stack information includes multiple class methods, which are composed of multiple class methods of the dynamic class. The record of the running process information of the dynamic class can be The authentic call sequence generated by the called dynamic class.

Starting from the end of the stack information, analyze each class method one by one, until a group of class methods are confirmed, satisfying the dynamic class call sequence closure principle, then this group of class method methods can be regarded as a credible call sequence generated by a dynamic class.

The closed principle of the dynamic class call sequence: belongs to a class of framework, has nothing to do with business, templates, fixed content, and is not affected by the two external factors of parameters and objects calling class methods.

3. Write the credible call sequence generated by each dynamic class into a specified file, and use this file as a white list of dynamic class call sequences.

4. When the JVM loads a class, first confirm that the class is a dynamic class, and then judge whether the dynamic class call sequence in the stack information is included in the dynamic class call sequence whitelist. If it is included in the dynamic class call sequence whitelist, it means The dynamic class is credible. If it is not included in the dynamic class call sequence whitelist, it means that the dynamic class is untrustworthy and malicious. Intercept its loading, prevent it from being loaded into the JVM, and generate Warning message.

The credibility judging device based on the dynamic class calling sequence provided by the present invention is described below. The credibility judging device based on the dynamic class calling sequence described below can be compared with the credibility judging method based on the dynamic class calling sequence described above. refer to each other.

Please refer to FIG. 5. FIG. 5 is a schematic structural diagram of a reliability judgment device based on a dynamic class call sequence provided by an embodiment of the present invention. The reliability judgment device based on a dynamic class call sequence shown in FIG. 5 can be applied to a Java-based The business system developed by the language can be used to execute the reliability judgment method based on the dynamic class call sequence of Figure 1, and the reliability judgment device based on the dynamic class call sequence can be set in the server of the business system. There are no limitations on the type of the server and the type of the server. For example, the business system can be a financial business system, etc., and the server can be a physical server including an independent host, a virtual server hosted by a host cluster, or a cloud server. As shown in Figure 5, the reliability judging device based on the dynamic class calling sequence at least includes:

The dynamic class judging module 510 is configured to judge whether the target class is a dynamic class in response to the loading of the target class by the Java virtual machine.

The credibility judging module 520 is configured to judge whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class call sequence whitelist if the target class is a dynamic class.

The interception alarm module 530 is configured to determine that the target class is untrustworthy if the call sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class call sequence whitelist, intercept the loading of the target class, and generate an alarm message.

Optionally, the device for judging the reliability based on the dynamic class calling sequence also includes:

The simulation execution module is used to simulate the execution of the source code of the business system and trigger the generation of various dynamic classes.

The whitelist generation module is used to obtain the call sequence generated in the corresponding stack information when each dynamic class is generated, and generate a dynamic class call sequence whitelist, and each dynamic class corresponds to a stack information.

Optionally, each stack message contains multiple class methods, and the whitelist generation module includes:

The class method analysis unit is configured to analyze each class method one by one starting from the end of the corresponding stack information.

The call sequence determination unit is used to determine a group of class methods satisfying the closed principle of dynamic class call sequence as a call sequence generated when a dynamic class is generated.

The white list generating unit is configured to record the calling sequence generated when the determined dynamic class is generated, and obtain a white list of the calling sequence of the dynamic class.

Optionally, the closure principle of the dynamic class call sequence is: belonging to a class framework, irrelevant to business, templated, fixed content, and not affected by parameters and objects calling class methods.

Optionally, the dynamic class judgment module 510 is used for:

In response to the Java virtual machine loading the target class, determine whether the name of the target class is the name of the class in the source code of the business system;

If the name of the target class is the name of the class in the source code of the business system, it is determined that the target class is a static class;

If the name of the target class is not the name of the class in the source code of the business system, it is determined that the target class is a dynamic class.

Optionally, the device for judging the reliability based on the dynamic class calling sequence also includes:

The source code scanning module is used to scan the source code of the business system and record the name of the class in the source code of the business system.

Optionally, the device for judging the reliability based on the dynamic class calling sequence also includes:

The loading execution module is used to determine that the target class is credible and execute the loading of the target class if the calling sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class calling sequence white list.

FIG. 6 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 6, the electronic device may include: a processor (processor) 610, a communication interface (Communications Interface) 620, a memory (memory) 630 and a communication bus 640, Wherein, the processor 610 , the communication interface 620 , and the memory 630 communicate with each other through the communication bus 640 . The processor 610 can call the logical instructions in the memory 630 to perform the following method: in response to the loading of the target class by the Java virtual machine, determine whether the target class is a dynamic class; if the target class is a dynamic class, determine whether the dynamic class Whether the calling sequence of the target class in the corresponding stack information is included in the dynamic class calling sequence whitelist; if the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class calling sequence whitelist , then it is determined that the target class is untrustworthy, intercepting the loading of the target class, and generating an alarm message.

In addition, the logic instructions in the above-mentioned memory 630 may be implemented in the form of software functional units and when sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it is implemented to perform the methods provided by the above-mentioned embodiments, for example, including: In response to the loading of the target class by the Java virtual machine, it is judged whether the target class is a dynamic class; if the target class is a dynamic class, it is judged whether the call sequence of the target class in the stack information corresponding to the dynamic class is included in the dynamic class In the call sequence whitelist; if the call sequence of the target class in the stack information corresponding to the dynamic class is not included in the dynamic class call sequence whitelist, then determine that the target class is not credible, and intercept the loading of the target class , and generate an alarm message.

The device embodiments described above are only illustrative, and the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed to multiple network elements. Part or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. It can be understood and implemented by those skilled in the art without any creative efforts.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims (10)

1. A reliability judging method based on dynamic class calling sequence is characterized in that the reliability judging method is applied to a service system developed based on Java language and comprises the following steps:

responding to a Java virtual machine to load a target class, and judging whether the target class is a dynamic class or not;

if the target class is a dynamic class, judging whether a calling sequence of the target class in stack information corresponding to the dynamic class is contained in a dynamic class calling sequence white list or not;

if the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in a dynamic class calling sequence white list, determining that the target class is not trusted, intercepting the loading of the target class, and generating alarm information.

2. The method according to claim 1, wherein the determining whether the target class is a dynamic class in response to the target class being loaded by the Java virtual machine further comprises:

performing simulation execution on a source code of the service system, and triggering generation of various dynamic classes;

and acquiring a calling sequence generated in corresponding stack information when each dynamic class is generated, and generating a dynamic class calling sequence white list, wherein each dynamic class corresponds to one piece of stack information.

3. The method according to claim 2, wherein each piece of stack information includes a plurality of class methods, and the obtaining a call sequence generated in the corresponding stack information when each dynamic class is generated to generate the dynamic class call sequence white list includes:

analyzing each class method one by one from the end of the corresponding stack information;

determining a group of class methods meeting the dynamic class calling sequence sealing principle as a calling sequence generated when a dynamic class is generated;

and recording the call sequence generated when the determined dynamic class is generated to obtain the white list of the call sequence of the dynamic class.

4. The method for judging the credibility of the dynamic class calling sequence according to claim 3, wherein the dynamic class calling sequence closing principle is as follows: the method belongs to a class of framework, is irrelevant to service, is templated, has fixed content and is not influenced by parameters and objects calling class methods.

5. The method according to any one of claims 1 to 4, wherein the determining whether the target class is a dynamic class in response to the target class being loaded by the Java virtual machine includes:

responding to a Java virtual machine to load a target class, and judging whether the name of the target class is the name of a class in a source code of the service system;

if the name of the target class is the name of a class in a source code of the service system, determining that the target class is a static class;

and if the name of the target class is not the name of the class in the source code of the service system, determining that the target class is a dynamic class.

6. The method according to claim 5, wherein the determining whether the target class is a dynamic class according to the target class loaded by the Java virtual machine further comprises:

and scanning the source code of the service system, and recording the name of the class in the source code of the service system.

7. The method according to claim 1, wherein if the target class is a dynamic class, after determining whether the call sequence of the target class in the stack information is included in a white list of call sequences of the dynamic class, the method further comprises:

and if the call sequence of the target class in the stack information corresponding to the dynamic class is contained in a dynamic class call sequence white list, determining that the target class is trusted, and executing the loading of the target class.

8. A reliability judging device based on a dynamic class calling sequence is characterized by being applied to a service system developed based on Java language, and comprising:

the dynamic class judgment module is used for responding to the loading of a target class by the Java virtual machine and judging whether the target class is a dynamic class;

the credibility judging module is used for judging whether the calling sequence of the target class in the stack information corresponding to the dynamic class is contained in a dynamic class calling sequence white list or not if the target class is the dynamic class;

and the interception warning module is used for determining that the target class is not trusted, intercepting the loading of the target class and generating warning information if the calling sequence of the target class in the stack information corresponding to the dynamic class is not included in a dynamic class calling sequence white list.

9. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the method for determining a trustworthiness based on a dynamic class call sequence according to any of claims 1 to 7 when executing the program.

10. A non-transitory computer readable storage medium, having stored thereon a computer program, wherein the computer program, when being executed by a processor, implements the steps of the method for reliability determination based on dynamic class call sequences according to any one of claims 1 to 7.

Images