CN118734310A - Vulnerability shielding method, engine, electronic device, storage medium and program product - Google Patents

Abstract

The application relates to a vulnerability shielding method, an engine, electronic equipment, a storage medium and a program product, wherein the method comprises the following steps: receiving a vulnerability shielding plug-in, wherein the vulnerability shielding plug-in comprises relevant information of a vulnerability function and relevant information of a shielding function, and the shielding function is used for detecting whether the vulnerability function is attacked or used for repairing the vulnerability function; generating a template function according to the vulnerability shielding plug-in, wherein when the shielding function is used for repairing the vulnerability function, the template function is used for calling the shielding function to repair the vulnerability function when being executed; and replacing the attribute of the backup function with the attribute of the loophole function, replacing the attribute of the loophole function with the attribute of the template function, wherein the backup function is the backup of the loophole function. According to the vulnerability shielding method provided by the embodiment of the application, the Python application program has the capability of executing the template function to repair the vulnerability function when the application program runs to the vulnerability function, so that dynamic instrumentation can be realized on the vulnerability of the running Python application program to shield the vulnerability.

Description

Vulnerability shielding method, engine, electronic device, storage medium and program product

Technical Field

The present application relates to the field of computer technology, and in particular to a vulnerability shielding method, engine, electronic device, storage medium and program product.

Background Art

A vulnerability is a defect in the specific implementation of hardware, software, or a protocol, or in the system security policy, which can allow an attacker to access or damage the system without authorization. The International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) have jointly developed standards for the collection, investigation, repair, and disclosure of vulnerabilities. From the perspective of the standards, for any application vulnerability, the repair measures in the vulnerability handling process currently mainly refer to officially released patches, repair documents, or configuration updates. However, the standards also point out that in the case of a high risk of a vulnerability to an application, temporary intermediate remedial measures may be required, which is very necessary for high-risk vulnerabilities.

The period from when a vulnerability is disclosed to when the vulnerability patch takes effect is called the vulnerability exposure period. When a vulnerability is in the vulnerability exposure period for a long time, it provides a large attack window for attackers. Existing solutions either require pre-setting of instrumentation points or only implement vulnerability shielding for C applications. It is not possible to implement dynamic instrumentation to shield vulnerabilities in running Python applications.

Summary of the invention

In view of this, a vulnerability shielding method, engine, electronic device, storage medium and program product are proposed. According to the vulnerability shielding method of the embodiment of the present application, a template function is automatically generated based on a vulnerability shielding plug-in. When the template function is executed, the shielding function can be called to patch the vulnerable function, and the attributes of the vulnerable function are replaced with the attributes of the template function. This enables the Python application to execute the template function to patch the vulnerable function when running to the vulnerable function, thereby being able to dynamically insert vulnerabilities in the running Python application to shield the vulnerabilities.

In a first aspect, an embodiment of the present application provides a vulnerability shielding method, which is applied to a vulnerability shielding engine, and the vulnerability shielding engine is integrated in a Python application of a client, and the method comprises: receiving a vulnerability shielding plug-in, the vulnerability shielding plug-in comprising relevant information of a vulnerability function and relevant information of a shielding function, the shielding function being used to detect whether the vulnerability function is attacked or to patch the vulnerability function; generating a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when executed; replacing the attributes of a backup function with the attributes of the vulnerability function, and replacing the attributes of the vulnerability function with the attributes of the template function, the backup function being a backup of the vulnerability function.

According to the vulnerability shielding method of the embodiment of the present application, by receiving the vulnerability shielding plug-in, the relevant information of the vulnerability function included in the vulnerability shielding plug-in and the relevant information of the shielding function can be obtained; the template function is generated according to the vulnerability shielding plug-in, and there is no need to manually write the template function, which reduces the difficulty of operation for security maintenance personnel; because the vulnerability shielding engine is integrated in the Python application, the attributes of the function can be replaced based on the ability of the Python language, and the attributes of the vulnerability function are replaced with the attributes of the template function, so that the Python application has the ability to execute the template function when the vulnerability function is executed, and there is no need to preset the insertion point for different vulnerability functions, thereby completing the dynamic insertion of the vulnerability function. The shielding function is used to detect whether the vulnerability function is attacked or used to patch the vulnerability function. When the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when it is executed, so that the execution of the template function can realize the vulnerability shielding function, and the shielding function is loaded in a similar way to a hot patch, and there is no need to restart the Python application every time, and there is no need to recompile the business code, so the business will not be interrupted. The backup function is a backup of the vulnerability function, and the attributes of the backup function are replaced with the attributes of the vulnerability function, so that when the Python application wants to execute the vulnerability function itself, it can also achieve the same effect by executing the backup function. In summary, the vulnerability shielding method of the embodiment of the present application can implement dynamic plugging of vulnerabilities in running Python applications to shield vulnerabilities. The application program does not need to be restarted and the business is not interrupted, which can reduce the vulnerability exposure period and improve the vulnerability shielding effect.

According to the first aspect, in a first possible implementation of the vulnerability shielding method, when the shielding function is used to detect whether the vulnerable function is attacked, the template function is used to: call the shielding function when being executed, output the detected information when it is detected that the vulnerable function is attacked, and call the backup function when it is detected that the vulnerable function is not attacked.

In this way, vulnerability shielding can be implemented in the form of attack detection, making the vulnerability shielding method more flexible.

According to the first aspect or the first possible implementation of the first aspect, in a second possible implementation of the vulnerability shielding method, the method further includes: under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, executing the template function; under the condition that the vulnerability shielding plug-in is not enabled, when the Python application runs to the vulnerable function, executing the backup function.

In this way, the vulnerability shielding engine can more specifically complete the shielding work of the vulnerability function, making the working mode of the vulnerability shielding engine more flexible.

According to the first aspect or any possible implementation of the first aspect above, in a third possible implementation of the vulnerability shielding method, the relevant information of the vulnerability function includes the module, class, function name, parameters, shielding position, and shielding method of the vulnerability function; the relevant information of the shielding function includes the module, class, function name, and parameters of the shielding function; wherein the shielding position includes one of the starting position, the ending position, and the exception handling position of the vulnerability function, and the shielding method includes one of the function overall replacement method, the regular matching detection method, the keyword matching detection method, and the script function detection method.

According to the third possible implementation method of the first aspect, in the fourth possible implementation method of the vulnerability shielding method, when the shielding method of the vulnerability function is the function overall replacement method, the shielding function is used to patch the vulnerability function, and the shielding position field of the vulnerability function is invalid; when the shielding method of the vulnerability function is one of the regular matching detection method, the keyword matching detection method, and the script function detection method, the shielding function is used to detect whether the vulnerability function is attacked, and the shielding position field of the vulnerability function is valid; when the shielding position field is valid and includes one of the end position and exception handling position of the vulnerability function, the parameter field of the vulnerability function is invalid.

In this way, the information that needs to be processed for vulnerability shielding can be further reduced.

According to any one of the first to fourth possible implementations of the first aspect, in a fifth possible implementation of the vulnerability shielding method, generating a template function based on the vulnerability shielding plug-in includes: selecting a matching template function from a preset template function library based on the shielding position and shielding method of the vulnerability function; the template function includes an outer function and an inner function, the relevant information of the vulnerability function and the relevant information of the shielding function serve as inputs of the outer function, and the return value of the inner function serves as the return value of the outer function; the parameters of the vulnerability function, the relevant information of the vulnerability function, and the relevant information of the shielding function serve as inputs of the inner function, and the call result of the shielding function serves as the return value of the inner function.

In this way, parameter passing can be completed.

According to any one of the second to fifth possible implementations of the first aspect, in a sixth possible implementation of the vulnerability shielding method, under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, the template function is executed, including: under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, querying whether the vulnerable function is occupied; when the vulnerable function is not occupied, occupying the vulnerable function and executing the template function.

In this way, thread conflicts in Python applications can be avoided.

According to the first aspect or any possible implementation of the first aspect above, in a seventh possible implementation of the vulnerability shielding method, the attributes are stored in the form of a C structure, and the attributes include at least function code, global variables used in the function, closure relationships, and method code.

In this way, the vulnerability shielding method can support multiple flexible uses of the Python language.

According to the first aspect or any possible implementation of the first aspect above, in an eighth possible implementation of the vulnerability shielding method, the method also includes: storing the vulnerability function, the shielding function, the backup function, and the template function in the memory of the Python application, respectively, and performing address space management by the Python application.

By uniformly managing the address space of vulnerable functions, shielded functions, backup functions, and template functions (objects), it is possible to avoid address reallocation caused by the automatic address recycling mechanism of Python applications, which may lead to address conflicts in functions (objects).

In the second aspect, an embodiment of the present application provides a vulnerability shielding engine, which is integrated in a Python application of a client, and the vulnerability shielding engine includes: a plug-in receiving module, used to receive a vulnerability shielding plug-in, the vulnerability shielding plug-in includes relevant information of a vulnerability function and relevant information of a shielding function, the shielding function is used to detect whether the vulnerability function is attacked or is used to patch the vulnerability function; a function generation module, used to generate a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when executed; an attribute replacement module, used to replace the attributes of a backup function with the attributes of the vulnerability function, and replace the attributes of the vulnerability function with the attributes of the template function, the backup function is a backup of the vulnerability function.

According to the second aspect, in a first possible implementation of the vulnerability shielding engine, when the shielding function is used to detect whether the vulnerability function has been attacked, the template function is used to: call the shielding function when being executed, output the detected information when it is detected that the vulnerability function has been attacked, and call the backup function when it is detected that the vulnerability function has not been attacked.

According to the second aspect or the first possible implementation of the second aspect, in the second possible implementation of the vulnerability shielding engine, the vulnerability shielding engine also includes: a shielding module, which is used to execute the template function when the Python application runs to the vulnerability function under the condition that the vulnerability shielding plug-in is enabled; and execute the backup function when the Python application runs to the vulnerability function under the condition that the vulnerability shielding plug-in is not enabled.

According to the second aspect or any possible implementation of the second aspect above, in a third possible implementation of the vulnerability shielding engine, the relevant information of the vulnerability function includes the module, class, function name, parameters, shielding position, and shielding method of the vulnerability function; the relevant information of the shielding function includes the module, class, function name, and parameters of the shielding function; wherein the shielding position includes one of the starting position, the ending position, and the exception handling position of the vulnerability function, and the shielding method includes one of the function overall replacement method, the regular matching detection method, the keyword matching detection method, and the script function detection method.

According to the third possible implementation method of the second aspect, in the fourth possible implementation method of the vulnerability shielding engine, when the shielding method of the vulnerability function is the overall function replacement method, the shielding function is used to patch the vulnerability function, and the shielding position field of the vulnerability function is invalid; when the shielding method of the vulnerability function is one of the regular matching detection method, the keyword matching detection method, and the script function detection method, the shielding function is used to detect whether the vulnerability function is attacked, and the shielding position field of the vulnerability function is valid; when the shielding position field is valid and includes one of the end position and exception handling position of the vulnerability function, the parameter field of the vulnerability function is invalid.

According to any one of the first to fourth possible implementations of the second aspect, in a fifth possible implementation of the vulnerability shielding engine, generating a template function based on the vulnerability shielding plug-in includes: selecting a matching template function from a preset template function library based on the shielding position and shielding method of the vulnerability function; the template function includes an outer function and an inner function, and the relevant information of the vulnerability function and the relevant information of the shielding function serve as inputs of the outer function, and the return value of the inner function serves as the return value of the outer function; the parameters of the vulnerability function, the relevant information of the vulnerability function, and the relevant information of the shielding function serve as inputs of the inner function, and the calling result of the shielding function serves as the return value of the inner function.

According to any one of the second to fifth possible implementations of the second aspect, in a sixth possible implementation of the vulnerability shielding engine, under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, the template function is executed, including: under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, querying whether the vulnerable function is occupied; when the vulnerable function is not occupied, occupying the vulnerable function and executing the template function.

According to the second aspect or any possible implementation of the second aspect above, in a seventh possible implementation of the vulnerability shielding engine, the attributes are stored in the form of a C structure, and the attributes include at least function code, global variables used in the function, closure relationships, and method codes.

According to the second aspect or any possible implementation of the second aspect above, in an eighth possible implementation of the vulnerability shielding engine, the vulnerability shielding engine also includes: an address management module, used to store the vulnerability function, the shielding function, the backup function, and the template function in the memory of the Python application, respectively, and the Python application performs address space management.

In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor; a memory for storing processor executable instructions; wherein the processor is configured to implement the vulnerability shielding method of the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect when executing the instructions.

In a fourth aspect, an embodiment of the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, which, when executed by a processor, implement the vulnerability shielding method of the above-mentioned first aspect or one or more of the multiple possible implementation methods of the first aspect.

In a fifth aspect, an embodiment of the present application provides a computer program product, comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the vulnerability shielding method of the above-mentioned first aspect or one or several of the multiple possible implementation methods of the first aspect.

These and other aspects of the present application will become more apparent from the following description of the embodiment(s).

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present application and, together with the description, serve to explain the principles of the present application.

FIG1 shows an exemplary application scenario of a vulnerability shielding method according to an embodiment of the present application.

FIG. 2 is a schematic diagram showing the relationship between various functional modules in a Python application according to an embodiment of the present application.

FIG3 is a schematic diagram showing a process of a vulnerability shielding method according to an embodiment of the present application.

FIG. 4 shows an example of a vulnerability shielding plug-in according to an embodiment of the present application.

FIG. 5 is a schematic diagram showing replacement of function attributes according to an embodiment of the present application.

FIG6 a shows a schematic diagram of a template function library according to an embodiment of the present application.

FIG. 6 b is a schematic diagram showing the form of a template function according to an embodiment of the present application.

FIG. 7 is a schematic diagram showing a schematic diagram of executing a template function when a Python application runs to a vulnerable function according to an embodiment of the present application.

FIG8 shows an exemplary structural diagram of a vulnerability shielding engine according to an embodiment of the present application.

FIG. 9 is a schematic diagram showing an exemplary structure of an electronic device according to an embodiment of the present application.

DETAILED DESCRIPTION

Various exemplary embodiments, features and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

In addition, in order to better illustrate the present application, numerous specific details are provided in the following specific embodiments. It should be understood by those skilled in the art that the present application can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present application.

The following are terms that may appear in this article.

Zero-day vulnerability: also known as zero-time attack, refers to a security vulnerability that is immediately exploited after being discovered. In layman's terms, the related malicious program appears on the same day that the security patch and vulnerability are disclosed. This type of attack is often very sudden and destructive.

Vulnerability exposure period: The period from when a zero-day vulnerability is discovered to when the official vulnerability patch takes effect is called the vulnerability exposure period.

Exception handling statement (try-except): It can be used in Python language. It defines a section of code for exception monitoring and provides a mechanism for handling exceptions. It consists of a try block and an except block (try_suite and except_suite), and can also have an optional error reason. First try to execute the try clause. If there is no error, ignore all except clauses and continue to execute. If an exception occurs, the interpreter will look for a matching exception in this string of handlers (except clauses).

Instrumentation: It refers to inserting probes into the program on the basis of ensuring the logical integrity of the original program. The probes collect information in the code (the method itself, method parameter values, return values, etc.), thereby collecting dynamic context information when the program is running.

Runtime application self-protection (RASP): is a security technology that improves the security of software by monitoring inputs to the software and blocking inputs that could allow attacks while protecting the runtime environment from unwanted changes and tampering.

In the current vulnerability handling process in the industry, the main measure to deal with vulnerabilities is still to repair the vulnerabilities, and there is a lack of systematic/process-based mitigation solutions for high-risk vulnerabilities to reduce the impact of attacks on the system. The main problems are as follows:

The versions under development have not been fully fixed: vulnerability perception is incomplete and the distribution chain is inefficient, self-checking efficiency is low, and the interception probability is low. Some versions on the market contain known vulnerabilities.

Existing versions lack pipeline planning: There is a lack of lifecycle vulnerability patching rules. Existing versions lack pipeline planning, and a large number of vulnerabilities are patched in the next version.

A large number of vulnerabilities remain in the existing network: Most customers are not aware of the vulnerabilities, and the vulnerabilities left in the existing network pose a security risk.

The above problems in the process have caused a large number of applications to be vulnerable during the vulnerability exposure period from the disclosure of the zero-day vulnerability to the effectiveness of the official vulnerability patch, making them extremely vulnerable to external attacks. From the current vulnerability handling process, the vulnerability exposure period is usually more than one month, which provides a large attack window for attackers. It is urgent to implement vulnerability shielding during the vulnerability exposure period to reduce the impact of attacks on applications during the vulnerability exposure period.

Two existing technical solutions for implementing vulnerability shielding during the vulnerability exposure period are introduced below.

Prior art 1 proposes a vulnerability shielding solution based on runtime application self-protection RASP technology. RASP technology runs inside the application runtime, and blocks network programs and APIs that automate and attack high-risk vulnerabilities by analyzing data passed in through a specified application programming interface (API), potential structured query language (SQL) queries, command prompts (cmd), and other specific behaviors.

The disadvantage of the first prior art is that the RASP technology cannot realize the ability to dynamically insert plug-ins to shield vulnerabilities. It is necessary to pre-embed plug-in points for API method calls such as command execution, file access, and network access, and to have corresponding detection logic and processing methods. This brings great difficulty to programmers.

The second prior art proposes a solution of automatically generating a temporary patch to cope with the scenario of being attacked during the vulnerability exposure period.

The program is divided into the following modules:

1. Data collection and target identification module.

This module is divided into two sub-modules: unknown vulnerability discovery and prediction of future threats. Unknown vulnerability discovery mainly discovers vulnerabilities through vulnerability mining. The prediction of future threats sub-module is mainly used to identify future attack targets, such as predicting security events through deep learning, with high prediction accuracy.

2. Real-time patch module.

The real-time patch mainly performs two functions: selective reinforcement and isolation. Once a vulnerability is discovered, the real-time patch module needs to respond immediately and provide automated patches (selective reinforcement function) implemented through plugging/reinforcement technology. Selective reinforcement mainly uses binary plugging technology, etc. to implant patch code into the vulnerability location of the binary code. The patch code performs anomaly detection on the vulnerability code. If the vulnerability has been attacked when the vulnerability is discovered, and the host where the vulnerability is located has been infected, the real-time patch module needs to immediately isolate the host where the vulnerability is located from other hosts in the network (isolation function). Isolation technology is divided into two parts: host detection and host isolation. Host detection is mainly used to identify infected hosts, and host isolation is mainly used to isolate infected hosts from other hosts in the network through network isolation.

3. Evidence preparation module.

The forensic preparation module mainly implants forensic codes in some key locations for subsequent forensic analysis.

The solution of the second prior art can temporarily eliminate the impact of the vulnerability by generating a temporary patch until the official patch is installed. The disadvantages of this solution are that, first, the application source code is required and the application needs to be recompiled and restarted, and the vulnerability cannot be shielded when the application is in the running state. Second, this solution is a vulnerability shielding solution for C applications and lacks support for Python applications.

In summary, existing solutions either cannot implement dynamic instrumentation of vulnerabilities, or are vulnerability shielding solutions for C applications, lack support for Python applications, and cannot shield vulnerabilities when the application is in the running state. Therefore, how to implement dynamic instrumentation of vulnerabilities in running Python applications to shield vulnerabilities has become a research hotspot in this field.

In view of this, a vulnerability shielding method, engine, electronic device, storage medium and program product are proposed. According to the vulnerability shielding method of the embodiment of the present application, a template function is automatically generated based on a vulnerability shielding plug-in. When the template function is executed, the shielding function can be called to patch the vulnerable function, and the attributes of the vulnerable function are replaced with the attributes of the template function. This enables the Python application to execute the template function to patch the vulnerable function when running to the vulnerable function, thereby being able to dynamically insert vulnerabilities in the running Python application to shield the vulnerabilities.

FIG1 shows an exemplary application scenario of a vulnerability shielding method according to an embodiment of the present application.

As shown in FIG1 , the vulnerability shielding method of the embodiment of the present application can be applied to a vulnerability shielding engine, which can be provided as a software development kit (SDK) for Python applications, or as a unit module of system services, integrated in Python applications to shield and protect vulnerability attack behaviors. The Python application can be located in a client's host, virtual machine (VM) or container (docker).

The client can be used by the user. For example, the client of the present application can be a smart phone, a netbook, a tablet computer, a laptop computer, a wearable electronic device (such as a smart bracelet, a smart watch, etc.), a TV, a virtual reality device, a speaker, an electronic ink, etc. The present application does not limit the specific type of the client.

A service end corresponding to the client, such as a server, may also be provided in the application scenario. The service end may be used by application security maintenance personnel. When the vulnerability has been disclosed, the security maintenance personnel analyze the vulnerability and write scripts (including relevant information of the shielding function) and configuration files (including relevant information of the vulnerable function), which are packaged into a vulnerability shielding plug-in in the form of a compressed package. The vulnerable function may be a function in the business code of a Python application where a vulnerability occurs, and the shielding function may be used to detect whether the vulnerable function has been attacked or to patch the vulnerable function. Examples of relevant information of the vulnerable function and relevant information of the shielding function are further given below.

Before the Python application is started, the vulnerability shielding engine can be written into the Python environment variable or introduced into the Python application to ensure that the vulnerability shielding engine is started when the Python application is started. The server can also send the configuration management information (such as processor, memory, etc.) of the vulnerability shielding engine to the client's Python application. In this case, when the user starts the Python application, the vulnerability shielding engine is also started at the same time. The Python application can initialize the vulnerability shielding engine based on the configuration management information so that the vulnerability shielding engine can work normally.

After the Python application is started, a vulnerability may be disclosed. The server can issue a corresponding vulnerability shielding plug-in. After the client receives the vulnerability shielding plug-in, it can verify the security of the vulnerability shielding plug-in. The verification method can be implemented based on existing technologies and will not be described here. After the verification is passed, the vulnerability shielding engine executes the vulnerability shielding method, which can generate a template function with vulnerability shielding capabilities and complete the attribute replacement of the template function, so that the Python application has the ability to execute the template function to patch the vulnerable function when running to the vulnerable function.

The client can feed back the loading information of the vulnerability shielding plug-in to the server, and the loading information of the vulnerability shielding plug-in can indicate the generation status of the template function. After that, the server can choose whether to enable the vulnerability shielding plug-in of the client. The different effects corresponding to different choices can be further described below. When the vulnerability shielding plug-in of the client is enabled, if the client detects that the vulnerability has been attacked, the detected information (such as the attack location, attack method, etc.) can be reported to the server.

Since the server in the application scenario shown in FIG1 can provide cloud services, it is more adaptable to distributed scenarios with multiple clients.

FIG. 2 is a schematic diagram showing the relationship between various functional modules in a Python application according to an embodiment of the present application.

As shown in FIG2 , on the client, the vulnerability shielding engine is used as a software development kit provided to the Python application for vulnerability shielding. The client is also provided with another software development kit serving the vulnerability shielding plug-in. The Python application is located in the client's language virtual machine. The Python application contains business components and multiple open source components (API1, etc.), and is integrated with the vulnerability shielding engine.

A plurality of functional modules may also be provided in the language virtual machine, including a configuration management module, an alarm processing module, a plug-in management module, a shielding strategy module, an insertion module and a shielding module. Among them, the configuration management module may initialize the vulnerability shielding engine according to the configuration management information issued by the server, the alarm processing module may be used to report the information of the vulnerability being attacked to the server, the plug-in management module may be responsible for enabling the vulnerability shielding plug-in, and the shielding strategy module may be responsible for recording the information recorded by the vulnerability shielding plug-in. The insertion module executes the template function generation and attribute replacement part in the vulnerability shielding method of the embodiment of the present application, and inserts the open source components involved in the vulnerability in the Python application; the shielding module may execute the template function to realize the vulnerability shielding. Among them, the alarm processing module, the insertion module and the shielding module may be provided in the vulnerability shielding engine. The remaining modules may be implemented by other engines in the language virtual machine, and the present application does not limit this.

Those skilled in the art should understand that the functional modules described above are logical modules rather than physical modules, and multiple functional modules may also be integrated or further decomposed into more detailed modules, which is not limited in this application.

In another exemplary application scenario of the vulnerability shielding method of the embodiment of the present application, the difference from the application scenario shown in FIG1 is that the server may not exist, and the client may also be used by security maintenance personnel. When the vulnerability has been disclosed, the security maintenance personnel can operate the client's system to analyze the vulnerability and write scripts and configuration files, which are packaged into a vulnerability shielding plug-in in a compressed package. The vulnerability shielding plug-in can be stored in the client's system memory.

The configuration management information of the vulnerability shielding engine can be output from the system memory and received by the vulnerability shielding engine in the Python application. After the Python application is started, a vulnerability may be disclosed. The client system can output the corresponding vulnerability shielding plug-in to the vulnerability shielding engine in the Python application. At this time, the vulnerability shielding plug-in is already a local vulnerability shielding plug-in with a certain degree of security, and the vulnerability shielding engine can be set to verify the vulnerability shielding plug-in. The vulnerability shielding engine executes the vulnerability shielding method and can implement dynamic plugging of the vulnerabilities of the running Python application to shield the vulnerabilities.

Those skilled in the art should understand that in addition to using the system, security maintenance personnel may also operate other operable objects of the client to implement functions performed by the server in the application scenario of Figure 1, such as outputting configuration management information, outputting vulnerability shielding plug-ins, receiving information on vulnerability attacks, etc., such as other applications, etc. The embodiments of the present application do not limit this.

Since there is no server, the configuration management information, vulnerability shielding plug-ins, and vulnerability attack information in the application scenario do not need to be transmitted over the network, making the vulnerability shielding engine easier to deploy.

The vulnerability shielding method of the embodiment of the present application can not only be used for vulnerability shielding of Python applications, but can also be used in various scenarios such as vulnerability shielding of Python-based network services and resident application processes on Windows and Linux platforms, to achieve vulnerability detection, alarm, interception and patching capabilities.

FIG3 is a schematic diagram showing a process of a vulnerability shielding method according to an embodiment of the present application.

As shown in FIG3 , in a possible implementation, the present application provides a vulnerability shielding method, which is applied to a vulnerability shielding engine, and the vulnerability shielding engine is integrated in a Python application of a client, and the method includes steps S31-S33:

Step S31, receiving a vulnerability shielding plug-in, the vulnerability shielding plug-in includes relevant information of the vulnerability function and relevant information of the shielding function, the shielding function is used to detect whether the vulnerability function is attacked or to repair the vulnerability function;

Step S32, generating a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when being executed;

Step S33, replacing the attributes of the backup function with the attributes of the vulnerable function, and replacing the attributes of the vulnerable function with the attributes of the template function, the backup function is a backup of the vulnerable function.

For example, the vulnerability shielding method of the embodiment of the present application can be executed during the vulnerability exposure period of the Python application. First, in step S31, the vulnerability shielding engine first receives the vulnerability shielding plug-in. The source and generation method of the vulnerability shielding plug-in have been described above and will not be repeated here.

FIG. 4 shows an example of a vulnerability shielding plug-in according to an embodiment of the present application.

As shown in Figure 4, the vulnerability shielding plug-in may include a configuration file (policy) and a script (script), wherein the configuration file records the relevant information of the vulnerability function, and the script records the relevant information of the shielding function. The relevant information of the vulnerability function includes the module, class, function name, parameters, shielding position, and shielding method of the vulnerability function; the relevant information of the shielding function includes the module, class, function name, and parameters of the shielding function; wherein the shielding position includes one of the starting position, the ending position, and the exception handling position of the vulnerability function, and the shielding method includes one of the function overall replacement method, the regular matching detection method, the keyword matching detection method, and the script function detection method.

Modules, classes, function names, and parameters are all common probes of the Python language, and we will not introduce them in detail here. The shielding position and shielding method determine the shielding strategy. The shielding position can be a position that can detect whether the vulnerable function has been attacked. For example, attacks often appear in the form of parameters, and the position where the parameters enter the vulnerable function is the starting position; if the parameters with attacks have entered the vulnerable function, the return value of the vulnerable function will inevitably be abnormal, and the position of the return value of the vulnerable function is the end position; Python applications can use exception handling statements (try-except), and the position of the exception handling statement is the exception handling position. Since the above positions can detect whether the vulnerable function has been attacked, the shielding position can include one of them in the relevant information of the vulnerable function.

There are roughly two shielding methods. One is to patch the vulnerable function. The shielding method under this method can include replacing the entire function, that is, the shielding function is a function without vulnerabilities. The shielding function is used to directly replace the vulnerable function with vulnerabilities. Even if it is attacked, it will not affect the security of the application because the shielding function has no vulnerabilities.

Another is to detect whether the vulnerability function is attacked. The shielding method under this idea may include a regular matching detection method, a keyword matching detection method, and a script function detection method. Among them, the regular matching detection method can specify the regular expression to be matched (in the embodiment of the present application, it can be the code of the shielding position), the string to be processed (in the embodiment of the present application, it can be the vulnerability function code), and the specified matching mode (multi-line matching and other existing matching modes in the prior art can be used), that is, the string at the corresponding shielding position can be located from the vulnerability function, and it can be determined whether it is attacked by comparing it with the expected value. The keyword matching detection method can provide keywords (in the embodiment of the present application, it can be the code at the shielding position) and the object to be detected (in the embodiment of the present application, it can be the vulnerability function code), that is, the string at the corresponding shielding position can be located from the vulnerability function, and it can be determined whether it is attacked by comparing it with the expected value. The script function detection method can be to provide the address to be detected (in the embodiment of the present application, it can be the address of the shielding position), and use the address to locate the string at the corresponding shielding position from the vulnerability function, and it can be determined whether it is attacked by comparing it with the expected value.

Those skilled in the art should understand that the shielding positions and shielding methods listed above are only examples. As long as the shielding position is a position that can detect whether the vulnerable function is attacked, and the shielding method indicates the vulnerability shielding strategy, the embodiments of the present application do not limit the specific contents of the shielding position and the shielding method.

Since the information included in the vulnerability shielding plug-in of the embodiment of the present application is usually fixed in different open source component versions, there is no need to write shielding functions and determine vulnerability shielding strategies for each open source component version, which greatly reduces the difficulty of writing the vulnerability shielding plug-in.

According to the vulnerability shielding plug-in, the vulnerability shielding engine can create a hash queue in memory to store all the information included in the vulnerability shielding plug-in as a string. The vulnerability shielding engine can also create a priority queue, taking each vulnerability function involved as an object, and storing the shielding position, shielding method, etc. of the vulnerability function respectively. If a vulnerability function involves multiple shielding positions, each shielding position and the corresponding shielding method of the shielding position can be stored in the priority queue according to the priority of the shielding position.

In step S32, a template function can be generated according to the vulnerability shielding plug-in. This step can be automatically completed by the vulnerability shielding engine to realize the automatic generation of the template function. Therefore, there is no need to manually write the template function, which reduces the difficulty of operation for security maintenance personnel. The template function can be, for example, a hook function, which can associate the vulnerability function with the template function. When the shielding function is used for different purposes, the association method between the vulnerability function and the template function can be different. For example, when the shielding function is used to patch the vulnerability function, the template function can be used to call the shielding function to patch the vulnerability function when it is executed. Other association methods between the vulnerability function and the template function will be introduced below.

Since everything is an object in Python, functions are also objects, supporting modification and replacement of attributes. Therefore, when the vulnerability shielding engine is integrated into a Python application, in step S33, the vulnerability shielding engine can replace the attributes of the function. FIG5 shows a schematic diagram of replacing function attributes according to an embodiment of the present application.

As shown in FIG5 , the attributes of the backup function can be replaced with the attributes of the vulnerability function, and the attributes of the vulnerability function can be replaced with the attributes of the template function. The backup function is a backup of the vulnerability function. Among them, the attribute replacement of the backup function can be completed first, and the attribute replacement of the vulnerability function can be completed later. After replacing the attributes of the vulnerability function with the attributes of the template function, the Python application can have the ability to execute the template function when executing the vulnerability function, that is, the original parameters of the vulnerability function can be passed into the template function. When the shielding function is used to patch the vulnerability function, the template function completes its function and can call the shielding function to patch the vulnerability function, thereby having the vulnerability shielding capability. Whether this vulnerability shielding capability is enabled can be determined by whether the vulnerability shielding plug-in is enabled. For an example, see the relevant description below.

Since the properties of the vulnerable function are replaced with the properties of the template function, the vulnerable function itself cannot be executed even if the vulnerability shielding capability is not enabled. To this end, the properties of the backup function can be replaced with the properties of the vulnerable function, so that the backup function becomes the backup of the vulnerable function. When you want to execute the vulnerable function without jumping to the template function (i.e., executing the vulnerable function itself), you can directly execute the backup function. The effect of executing the backup function can be the same as the effect of executing the vulnerable function itself. For an example, see the relevant description below.

According to the vulnerability shielding method of the embodiment of the present application, by receiving the vulnerability shielding plug-in, the relevant information of the vulnerability function included in the vulnerability shielding plug-in and the relevant information of the shielding function can be obtained; the template function is generated according to the vulnerability shielding plug-in, and there is no need to manually write the template function, which reduces the difficulty of operation for security maintenance personnel; because the vulnerability shielding engine is integrated in the Python application, the attributes of the function can be replaced based on the ability of the Python language, and the attributes of the vulnerability function are replaced with the attributes of the template function, so that the Python application has the ability to execute the template function when the vulnerability function is executed, and there is no need to preset the insertion point for different vulnerability functions, thereby completing the dynamic insertion of the vulnerability function. The shielding function is used to detect whether the vulnerability function is attacked or used to patch the vulnerability function. When the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when it is executed, so that the execution of the template function can realize the vulnerability shielding function, and the shielding function is loaded in a similar way to a hot patch, and there is no need to restart the Python application every time, and there is no need to recompile the business code, so the business will not be interrupted. The backup function is a backup of the vulnerability function, and the attributes of the backup function are replaced with the attributes of the vulnerability function, so that when the Python application wants to execute the vulnerability function itself, it can also achieve the same effect by executing the backup function. In summary, the vulnerability shielding method of the embodiment of the present application can implement dynamic plugging of vulnerabilities in running Python applications to shield vulnerabilities. The application program does not need to be restarted and the business is not interrupted, which can reduce the vulnerability exposure period and improve the vulnerability shielding effect.

Furthermore, in one example, for the vulnerabilities of open source components of Python applications with a common vulnerability scoring system (CVSS) score of 7 or above from 2019 to September 2021, the vulnerability shielding engine can be used to shield the 10 most common types of attacks (cross site script attack (XSS), structured query language SQL injection, lack of input validation, system OS command injection, directory traversal, dangerous file upload, deserialization, command injection, server-side request forgery (SSRF), code injection) that occur frequently.

In one example, after performance testing, the performance overhead of the client after loading the vulnerability shielding plug-in increased slightly compared to before loading, and the client central processing unit CPU usage overhead increased by less than 2%.

In a possible implementation, when the shielding function is used to detect whether the vulnerable function is attacked, the template function is used to:

The shielding function is called when it is executed, the detected information is output when it is detected that the vulnerable function is attacked, and the backup function is called when it is detected that the vulnerable function is not attacked.

For example, in addition to the use of patching the vulnerability function mentioned above, another use of the shielding function can be to detect whether the vulnerable function has been attacked. In this case, the association between the vulnerable function and the template function can be that the template function is used to call the shielding function when it is executed, and output the detected information when the vulnerable function is detected to be attacked. When it is detected that the vulnerable function has been attacked, it means that it is unsafe to execute the vulnerable function. At this time, the Python application can suspend the execution of the business code or execute the next function in the business code. The specific selection can be preset, and this application does not limit this.

When it is detected that the vulnerable function has not been attacked, it means that it is safe to execute the vulnerable function, but the properties of the vulnerable function have been replaced and cannot be called again. To achieve the same effect, the backup function can be called instead. That is, when the shielding function is used to detect whether the vulnerable function has been attacked, the template function is also used to call the backup function when it is detected that the vulnerable function has not been attacked.

In this way, vulnerability shielding can be implemented in the form of attack detection, making the vulnerability shielding method more flexible.

In a possible implementation, the method further includes:

When the vulnerability shielding plug-in is enabled, the template function is executed when the Python application runs to the vulnerable function;

When the vulnerability shielding plug-in is not enabled, when the Python application runs to the vulnerable function, the backup function is executed.

For example, the shielding of one or several vulnerable functions based on the vulnerability shielding plug-in is mainly performed during the vulnerability exposure period of the vulnerable function. After the vulnerability exposure period of the vulnerable function ends, the shielding of one or several vulnerable functions based on the vulnerability shielding plug-in may no longer be performed. Alternatively, there may be a situation where you want to execute the vulnerable function without jumping to the template function for execution (i.e., execute the vulnerable function itself).

In this regard, whether the vulnerability shielding plug-in is enabled can be used to indicate whether the vulnerable function is shielded based on the vulnerability shielding plug-in. For example, if the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, the template function can be executed to shield the vulnerability; if the vulnerability shielding plug-in is not enabled, when the Python application runs to the vulnerable function, the backup function can be directly executed. As a backup of the vulnerable function, the backup function has the same properties as the vulnerable function, so it will not change the execution effect.

In this way, the vulnerability shielding engine can more specifically complete the shielding work of the vulnerability function, making the working mode of the vulnerability shielding engine more flexible.

In a possible implementation, when the shielding method of the vulnerable function is the overall function replacement method, the shielding function is used to patch the vulnerable function, and the shielding position field of the vulnerable function is invalid;

When the shielding method of the vulnerability function is one of the regular matching detection method, keyword matching detection method, and script function detection method, the shielding function is used to detect whether the vulnerability function is attacked, and the shielding position field of the vulnerability function is valid;

When the mask position field is valid and includes one of the end position and exception handling position of the vulnerable function, the parameter field of the vulnerable function is invalid.

For example, the module, class, function name, parameter, shielding position, shielding method of the vulnerability function and the module, class, function name, parameter of the shielding function can have corresponding fields in the vulnerability shielding plug-in. Not all fields in a vulnerability shielding plug-in must be valid. Which fields are valid and which fields are invalid depends on the shielding method of the vulnerability function.

For example, when the shielding method of the vulnerability function is to replace the entire function, the operation method at a specific shielding position may no longer be concerned. Therefore, the shielding position field of the vulnerability function may be invalid, and the remaining fields may be valid.

For another example, when the shielding method of the vulnerability function is one of the regular matching detection method, the keyword matching detection method, and the script function detection method, the shielding function is used to detect whether the vulnerability function is attacked. At this time, it is necessary to pay attention to the specific shielding position. Therefore, the shielding position field of the vulnerability function can be effective.

Furthermore, when the shielding position field is valid and includes the start position of the vulnerable function, it means that the shielding strategy focuses on the parameters of the vulnerable function, so the parameter field of the vulnerable function can be valid. When the shielding position field is valid and includes the end position of the vulnerable function, it means that the shielding strategy focuses on the return value of the vulnerable function but not the parameters of the vulnerable function, so the parameter field of the vulnerable function can be invalid. When the shielding position field is valid and includes the exception handling position of the vulnerable function, it means that the shielding strategy focuses on the exception handling statement of the vulnerable function but not the parameters of the vulnerable function, so the parameter field of the vulnerable function can be invalid.

In this way, the information that needs to be processed for vulnerability shielding can be further reduced.

In a possible implementation, step S32 includes:

According to the shielding position and shielding method of the vulnerable function, a matching template function is selected from the preset template function library;

The template function includes an outer function and an inner function. The relevant information of the vulnerability function and the relevant information of the shielding function are used as the input of the outer function, and the return value of the inner function is used as the return value of the outer function.

The parameters of the vulnerable function, the related information of the vulnerable function, and the related information of the shielding function are used as the input of the inner function, and the call result of the shielding function is used as the return value of the inner function.

For example, there are multiple possible shielding positions and multiple possible shielding methods for a vulnerability function. Under different combinations of shielding positions and shielding methods, the matching template functions may be different. In this regard, a template function library can be pre-set according to different possible combinations of shielding positions and shielding methods allowed by the shielding strategy. FIG6a shows a schematic diagram of a template function library according to an embodiment of the present application.

As shown in FIG6a, the shielding position includes the start position, the end position and one of the exception handling positions of the vulnerability function, and the shielding method includes one of the function overall replacement method, the regular matching detection method, the keyword matching detection method, and the script function detection method. Each shielding position can be combined with one of the regular matching detection method, the keyword matching detection method, and the script function detection method, corresponding to 9 shielding strategies, and the function overall replacement method itself corresponds to 1 shielding strategy. Therefore, the template function library can be preset with 10 template functions (template function 1-template function 10), and each template function corresponds to 1 shielding strategy. When selecting, select a corresponding template function according to the instructions of the shielding position and the shielding method.

The purpose of the template function has been described above and will not be repeated here. The following introduces possible forms of the template function. FIG6 b shows a schematic diagram of the form of a template function according to an embodiment of the present application.

As shown in FIG6b, the template function may include an outer function and an inner function, wherein the relevant information of the vulnerability function and the relevant information of the shielding function are used as inputs of the outer function, and the return value of the inner function is used as the return value of the outer function. When the relevant information of the vulnerability function and the relevant information of the shielding function are used as inputs of the outer function, they can be input as a string (equivalent to the function identifier) as a whole. In the outer function, the string can be decomposed to obtain the relevant information of the shielding function and the relevant information of the vulnerability function (i.e., two strings are separated from one string), and passed to the inner function. Since it is a composite function, the return value of the inner function is also the return value of the outer function.

The parameters of the vulnerable function, the related information of the vulnerable function, and the related information of the shielding function are used as the input of the inner function, and the call result of the shielding function is used as the return value of the inner function. A parameter dictionary can be provided in the inner function, and the parameter dictionary indicates each parameter and its type. Possible types include positional parameters, key parameters, extended positional parameters (*args), extended key parameters (**kwargs), and mixed parameters, etc. The parameter dictionary can separate the parameters by identifying the parameter type and pass them to the called shielding parameters. There are three possible call results of the shielding parameter. First, when the shielding parameter is used to patch the vulnerable function, the execution result of the shielding parameter itself can be the call result. Second, when the shielding parameter is used to detect whether the vulnerable function is attacked, if the vulnerable function is detected to be attacked, the detected information can be the call result of the shielding parameter. Third, when the shielding parameter is used to detect whether the vulnerable function is attacked, if the vulnerable function is not detected to be attacked and the backup function is called instead, the call result of the backup function can be the call result of the shielding parameter.

In this way, parameter passing can be completed.

In a possible implementation, when the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, the template function is executed, including:

Under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerability function, it queries whether the vulnerability function is occupied;

When the vulnerable function is not occupied, occupy the vulnerable function and execute the template function.

FIG. 7 is a schematic diagram showing a schematic diagram of executing a template function when a Python application runs to a vulnerable function according to an embodiment of the present application.

For example, as shown in FIG. 7 , a Python application may include a business thread, and after the vulnerability shielding engine is integrated, it may also include an engine thread. The business thread itself may execute functions in a loop, such as looping through functions A, B, C, and D. When a function is executed, the function (object) is occupied. When the vulnerability shielding engine shields a vulnerability function, the vulnerability function (object) is also occupied. It can be set so that the same function (object) can only be occupied by one thread at a time.

On this basis, when the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, it can first check whether the vulnerable function is occupied. If the vulnerable function is not occupied, occupy the vulnerable function and execute the template function. Before the template function is executed, the business thread will not be able to occupy the vulnerable function again.

In this way, thread conflicts in Python applications can be avoided.

In a possible implementation, the attributes are stored in the form of a C structure, and the attributes include at least function code, global variables used in the function, closure relationships, and method code.

For example, now mainstream Python applications are mostly implemented based on C language. Therefore, Python functions (objects) can be described using C structures and replaced with other functions (objects). Attributes may at least include function codes, global variables (func_globals) used in functions, closure relationships (func_closure), and method codes (func_code). Those skilled in the art will appreciate that attributes may also include more content, as long as they are related to functions, and the embodiments of the present application do not limit the specific content of attributes.

In this way, the vulnerability shielding method can support multiple flexible uses of the Python language.

In a possible implementation, the method further includes:

The vulnerable function, shielding function, backup function, and template function are stored in the memory of the Python application respectively, and the address space is managed by the Python application.

For example, the address of the vulnerability function can be stored in the memory for address management after receiving the vulnerability shielding plug-in. The shielding function, backup function, and template function are all generated during the execution of the vulnerability shielding method, and the vulnerability shielding method is executed by the vulnerability shielding engine in the Python application. Therefore, for the newly generated functions, they can also be stored in the memory of the Python application respectively, and the address management method of the Python language for the object is used for address management.

By uniformly managing the address space of vulnerable functions, shielded functions, backup functions, and template functions (objects), it is possible to avoid address reallocation caused by the automatic address recycling mechanism of Python applications, which may lead to address conflicts in functions (objects).

The present application also provides a vulnerability shielding engine. FIG8 shows an exemplary structural diagram of a vulnerability shielding engine according to an embodiment of the present application.

As shown in FIG8 , the vulnerability shielding engine is integrated in the Python application of the client, and the vulnerability shielding engine includes:

A plug-in receiving module 80 is used to receive a vulnerability shielding plug-in, wherein the vulnerability shielding plug-in includes information related to a vulnerability function and information related to a shielding function, wherein the shielding function is used to detect whether the vulnerability function is attacked or to patch the vulnerability function;

A function generation module 81, used to generate a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when executed;

The attribute replacement module 82 is used to replace the attributes of the backup function with the attributes of the vulnerable function, and replace the attributes of the vulnerable function with the attributes of the template function, wherein the backup function is a backup of the vulnerable function.

Among them, the functions performed by the plug-in receiving module, the function generating module, and the attribute replacing module may be the same as the function of the plug-in module in the relevant description of FIG. 2 above.

In a possible implementation, when the shielding function is used to detect whether the vulnerable function is attacked, the template function is used to:

The shielding function is called when being executed, the detected information is output when it is detected that the vulnerable function is attacked, and the backup function is called when it is detected that the vulnerable function is not attacked.

In a possible implementation, the vulnerability shielding engine further includes:

The shielding module is used to execute the template function when the Python application runs to the vulnerable function under the condition that the vulnerability shielding plug-in is enabled; and to execute the backup function when the Python application runs to the vulnerable function under the condition that the vulnerability shielding plug-in is not enabled.

The function performed by the shielding module may be the same as the function of the shielding module in the relevant description of FIG. 2 above.

In a possible implementation, the relevant information of the vulnerable function includes the module, class, function name, parameters, shielding position, and shielding method of the vulnerable function; the relevant information of the shielded function includes the module, class, function name, and parameters of the shielded function; wherein the shielding position includes one of the starting position, the ending position, and the exception handling position of the vulnerable function, and the shielding method includes one of the function overall replacement method, the regular matching detection method, the keyword matching detection method, and the script function detection method.

In a possible implementation, when the shielding method of the vulnerable function is the overall function replacement method, the shielding function is used to patch the vulnerable function, and the shielding position field of the vulnerable function is invalid; when the shielding method of the vulnerable function is one of the regular matching detection method, the keyword matching detection method, and the script function detection method, the shielding function is used to detect whether the vulnerable function is attacked, and the shielding position field of the vulnerable function is valid; when the shielding position field is valid and includes one of the end position and exception handling position of the vulnerable function, the parameter field of the vulnerable function is invalid.

In a possible implementation, generating a template function according to the vulnerability shielding plug-in includes:

According to the shielding position and shielding method of the vulnerability function, a matching template function is selected from a preset template function library;

The template function includes an outer function and an inner function, the relevant information of the vulnerability function and the relevant information of the shielding function are used as inputs of the outer function, and the return value of the inner function is used as the return value of the outer function;

The parameters of the vulnerability function, the related information of the vulnerability function, and the related information of the shielding function are used as inputs of the inner function, and the calling result of the shielding function is used as the return value of the inner function.

In a possible implementation, when the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, executing the template function includes:

Under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, query whether the vulnerable function is occupied;

When the vulnerability function is not occupied, the vulnerability function is occupied and the template function is executed.

In a possible implementation, the attributes are stored in a C structure, and the attributes include at least function code, global variables used in the function, closure relationships, and method code.

In a possible implementation, the vulnerability shielding engine further includes:

The address management module is used to store the vulnerability function, the shielding function, the backup function, and the template function in the memory of the Python application respectively, and the Python application performs address space management.

Those skilled in the art should understand that the vulnerability shielding engine may also include more modules, such as the alarm processing module in the relevant description of FIG. 2 above, etc., and the embodiments of the present application are not limited to this.

An embodiment of the present application provides an electronic device, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions.

FIG. 9 is a schematic diagram showing an exemplary structure of an electronic device according to an embodiment of the present application.

As shown in FIG9 , the electronic device as a client may include at least one of a mobile phone, a foldable electronic device, a tablet computer, a desktop computer, a laptop computer, a handheld computer, a notebook computer, a screen speaker, an ultra-mobile personal computer (UMPC), a netbook, an augmented reality (AR) device, a virtual reality (VR) device, an artificial intelligence (AI) device, a drone, a vehicle-mounted device, a smart home device, or a smart city device. The embodiment of the present application does not impose any special restrictions on the specific type of the electronic device.

The electronic device may include a processor 110, an internal memory 121, a communication module 160, and the like.

The processor 110 may include one or more processing units, for example, the processor 110 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a video codec, a digital signal processor (DSP), a baseband processor, and/or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated into one or more processors. For example, the processor 110 may execute the template function of the embodiment of the present application, etc., to implement the vulnerability shielding method of the embodiment of the present application.

A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 may be a cache memory. The memory may store instructions or data that have been used or are frequently used by the processor 110, such as the shielding position and shielding method in the embodiments of the present application. If the processor 110 needs to use the instruction or data, it may be directly called from the memory. This avoids repeated access, reduces the waiting time of the processor 110, and thus improves the efficiency of the system.

In some embodiments, the processor 110 may include one or more interfaces. The interface may include an inter-integrated circuit (I2C) interface, a universal asynchronous receiver/transmitter (UART) interface, a general-purpose input/output (GPIO) interface, etc. The processor 110 may be connected to a wireless communication module, a display, a camera, and other modules through at least one of the above interfaces.

The memory 121 can be used to store computer executable program codes, which include instructions. The memory 121 may include a program storage area and a data storage area. Among them, the program storage area may store an operating system, an application required for at least one function (such as a Python application, etc.), etc. The data storage area may store data created during the use of the electronic device (such as template functions, backup functions, etc.), etc. In addition, the memory 121 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc. The processor 110 executes various functional methods or data processing of the electronic device by running instructions stored in the memory 121, and/or instructions stored in a memory provided in the processor.

The communication module 160 can be used to receive data from other devices or equipment (such as the server in the embodiment of the present application) through wired communication or wireless communication. For example, wireless communication solutions including WLAN (such as Wi-Fi network), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc. can be provided for application in electronic devices. When the electronic device is connected to other devices or equipment, the communication module 160 can also use a wired communication solution.

It is to be understood that the structure illustrated in the embodiments of the present application does not constitute a specific limitation on the computing device. In other embodiments of the present application, the computing device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

An embodiment of the present application provides a non-volatile computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the above method is implemented.

An embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing.

The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing/processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and/or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and/or edge servers. The network adapter card or network interface in each computing/processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing/processing device.

The computer program instructions for performing the operation of the present application can be assembly instructions, instruction set architecture (Instruction Set Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages-such as Smalltalk, C++, etc., and conventional procedural programming languages-such as "C" language or similar programming languages. Computer-readable program instructions can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer, partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network-including a local area network (Local Area Network, LAN) or a wide area network (WideArea Network, WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA) or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions to implement various aspects of the present application.

Various aspects of the present application are described herein with reference to the flowcharts and/or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each box in the flowchart and/or block diagram and the combination of each box in the flowchart and/or block diagram can be implemented by computer-readable program instructions.

These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions/actions specified in one or more boxes in the flowchart and/or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and/or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions/actions specified in one or more boxes in the flowchart and/or block diagram.

The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, system, method and computer program product according to multiple embodiments of the present application. In this regard, each square frame in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the square frame can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square frames can actually be executed substantially in parallel, and they can also be executed in reverse order sometimes, depending on the functions involved.

It should also be noted that each box in the block diagram and/or flowchart, and the combination of boxes in the block diagram and/or flowchart, can be implemented by hardware (such as a circuit or ASIC (Application Specific Integrated Circuit)) that performs the corresponding function or action, or can be implemented by a combination of hardware and software, such as firmware.

Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

The embodiments of the present application have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims (13)

1. A vulnerability shielding method, characterized in that the method is applied to a vulnerability shielding engine, the vulnerability shielding engine is integrated in a Python application of a client, and the method comprises: Receive a vulnerability shielding plug-in, the vulnerability shielding plug-in including relevant information of a vulnerability function and relevant information of a shielding function, the shielding function being used to detect whether the vulnerability function is attacked or to patch the vulnerability function; Generate a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when executed; The attributes of the backup function are replaced with the attributes of the vulnerable function, and the attributes of the vulnerable function are replaced with the attributes of the template function, and the backup function is a backup of the vulnerable function. 2. The method according to claim 1, characterized in that when the shielding function is used to detect whether the vulnerable function is attacked, the template function is used to: The shielding function is called when being executed, the detected information is output when it is detected that the vulnerable function is attacked, and the backup function is called when it is detected that the vulnerable function is not attacked. 3. The method according to claim 1 or 2, characterized in that the method further comprises: Under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, the template function is executed; Under the condition that the vulnerability shielding plug-in is not enabled, when the Python application runs to the vulnerable function, the backup function is executed. 4. The method according to any one of claims 1 to 3, characterized in that the relevant information of the vulnerable function includes the module, class, function name, parameters, shielding position, and shielding method of the vulnerable function; The relevant information of the shielding function includes the module, class, function name, and parameters of the shielding function; Among them, the shielding position includes one of the starting position, the ending position and the exception handling position of the vulnerable function, and the shielding method includes one of the overall function replacement method, the regular matching detection method, the keyword matching detection method and the script function detection method. 5. The method according to claim 4, characterized in that when the shielding mode of the vulnerability function is the overall replacement mode of the function, the shielding function is used to patch the vulnerability function, and the shielding position field of the vulnerability function is invalid; When the shielding method of the vulnerability function is one of the regular matching detection method, the keyword matching detection method, and the script function detection method, the shielding function is used to detect whether the vulnerability function is attacked, and the shielding position field of the vulnerability function is valid; When the mask position field is valid and includes one of the end position and the exception handling position of the vulnerability function, the parameter field of the vulnerability function is invalid. 6. The method according to any one of claims 2 to 5, characterized in that generating a template function according to the vulnerability shielding plug-in comprises: According to the shielding position and shielding method of the vulnerability function, a matching template function is selected from a preset template function library; The template function includes an outer function and an inner function, the relevant information of the vulnerability function and the relevant information of the shielding function are used as inputs of the outer function, and the return value of the inner function is used as the return value of the outer function; The parameters of the vulnerability function, the related information of the vulnerability function, and the related information of the shielding function are used as inputs of the inner function, and the calling result of the shielding function is used as the return value of the inner function. 7. The method according to any one of claims 3 to 6, characterized in that, when the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, executing the template function comprises: Under the condition that the vulnerability shielding plug-in is enabled, when the Python application runs to the vulnerable function, query whether the vulnerable function is occupied; When the vulnerability function is not occupied, the vulnerability function is occupied and the template function is executed. 8. The method according to any one of claims 1-7 is characterized in that the attributes are stored in the form of a C structure, and the attributes at least include function code, global variables used in the function, closure relations, and method code. 9. The method according to any one of claims 1 to 8, characterized in that the method further comprises: The vulnerability function, the shielding function, the backup function, and the template function are respectively stored in the memory of the Python application, and the address space management is performed by the Python application. 10. A vulnerability shielding engine, characterized in that the vulnerability shielding engine is integrated in a Python application of a client, and the vulnerability shielding engine comprises: A plug-in receiving module, used to receive a vulnerability shielding plug-in, wherein the vulnerability shielding plug-in includes relevant information of a vulnerability function and relevant information of a shielding function, wherein the shielding function is used to detect whether the vulnerability function is attacked or to patch the vulnerability function; A function generation module, used to generate a template function according to the vulnerability shielding plug-in, when the shielding function is used to patch the vulnerability function, the template function is used to call the shielding function to patch the vulnerability function when executed; The attribute replacement module is used to replace the attributes of the backup function with the attributes of the vulnerable function, and replace the attributes of the vulnerable function with the attributes of the template function, wherein the backup function is a backup of the vulnerable function. 11. An electronic device, comprising: processor; a memory for storing processor-executable instructions; Wherein, the processor is configured to implement the method according to any one of claims 1 to 9 when executing the instructions. 12. A non-volatile computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions implement the method according to any one of claims 1 to 9 when executed by a processor. 13. A computer program product, comprising a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code, characterized in that when the computer-readable code is executed in an electronic device, a processor in the electronic device executes the method according to any one of claims 1 to 9.