Application program anti-attack method and system based on code injection and behavior analysis

Abstract

The invention provides an application program anti-attack method and system based on code injection and behavior analysis. The method is characterized in that a protection code is injected into an application program needing to be protected, and attack behaviors in the application program are recognized. The method comprises the steps of injecting the protection code into the application program needing to be protected, and mounting a hook point at a preset key calling position, wherein the protection code monitors marked parameters and operation behaviors of calling a key function in the application program; running a unified protection plug-in, performing security risk analysis based on the operation behavior, the marked parameters and the context information, and identifying whether a suspicious webshell exists in a monitored code in the application or not; and sending out corresponding alarm prompt information according to the security risk analysis result, or directly blocking theoperation of the application program. According to the method, through reasonable deployment of the protection codes, attacks can be detected and self-protection can be carried out during operation,so that less missing report and false report, more comprehensive and accurate protection and faster vulnerability response are realized.

Description

Technical field [0001] The invention relates to the technical field of application safety protection, in particular to a run-time application self-protection technology based on code injection, which is mainly applied to the safety protection of Web applications. Background technique [0002] Currently, there are two main categories of web application security protection technologies: [0003] 1. WAF (Web Application Firewall): Provide protection for web applications by implementing a series of security policies for HTTP / HTTPS. The initial stage of WAF is a protection device based on rule protection. WAF manufacturers maintain this rule base and update it in real time. Users can protect the application in all aspects according to these rules. However, as the offensive and defensive sides continue to attack, this traditional defense system has appeared with various bypass techniques, breaking the line of defense. At the same time, this set of defense ideas has a natural flaw, that ...

AI Technical Summary

Problems solved by technology

However, the WAF function has natural defects. He is only interested in requests and responses, but does not pay attention to the web application itself

Images