信息网络安全

信息网络安全 ›› 2025, Vol. 25 ›› Issue (1): 134-148.doi: 10.3969/j.issn.1671-1122.2025.01.012

• 理论研究 • 上一篇    下一篇

一个用于Java应用程序运行时保护的混合系统

江昊, 刘成杰, 文伟平()   

  1. 北京大学软件与微电子学院，北京 100091
  • 收稿日期:2024-11-04 出版日期:2025-01-10 发布日期:2025-02-14
  • 通讯作者: 文伟平 E-mail:weipingwen@pku.edu.cn
  • 作者简介:江昊（2000—），男，湖北，硕士研究生，主要研究方向为软件与系统安全、漏洞挖掘|刘成杰（1998—），男，湖南，博士研究生，主要研究方向为软件安全、漏洞挖掘和入侵检测|文伟平（1976—），男，湖南，教授，博士，主要研究方向为系统与网络安全、大数据与云安全、智能计算安全
  • 基金资助:
    国家自然科学基金(61872011)

A Hybrid System for Runtime Protection inside Java Application

JIANG Hao, LIU Chengjie, WEN Weiping()   

  1. School of Software & Microelectronics, Peking University, Beijing 100091, China
  • Received:2024-11-04 Online:2025-01-10 Published:2025-02-14
  • Contact: WEN Weiping E-mail:weipingwen@pku.edu.cn

RichHTML

5

PDF (PC)

9

摘要：

近年来，应用程序运行时自我保护RASP技术作为一种嵌入式防护机制，广泛应用于检测和防御Web应用程序中的常见攻击，如SQL注入、跨站脚本XSS攻击以及Java反序列化攻击。然而，现有RASP系统多采用基于黑名单的检测方法，容易被绕过且难以应对新型攻击。为此，文章提出一种混合系统HP-RASP，该系统结合启发式规则和深度学习模型，在应用程序运行时提供自适应的安全保护。文章将BERT模型引入RASP系统，用于分析和检测SQL注入攻击，同时通过对常见方法调用栈进行监控和黑名单匹配，防御XSS和反序列化攻击。HP-RASP利用Java插桩技术，动态插入关键类和方法的监控逻辑，实现对Web请求的实时分析。文章在多个开源数据集上评估了该系统的检测性能，并将其与当前主流RASP系统OpenRASP进行了对比。实验结果表明，在检测准确率、性能开销和系统鲁棒性方面，HP-RASP相较现有方案均有显著提升；在SQL注入方面，准确率达到81.9%，比OpenRASP提升了1.84倍，召回率和F1分数也显著高于OpenRASP；在XSS防护方面，HP-RASP对反射型XSS和存储型XSS的召回率均达到99.9%，对反序列化攻击的召回率达到84.6%；在响应时间和资源消耗方面，HP-RASP表现良好，并未显著增加响应时间和资源消耗。

关键词: RASP, BERT模型, 软件安全, Java网络应用程序

Abstract:

In recent years, Runtime Application Self-Protection (RASP) has emerged as an embedded defense mechanism widely used to detect and prevent common web application attacks, such as SQL injection, cross-site scripting (XSS), and Java deserialization attacks. However, existing RASP systems often rely on blacklist-based detection, which is prone to evasion and struggles against novel threats. This paper introduced a hybrid system, HP-RASP, which combined heuristic rules and deep learning models to provide adaptive security at runtime. Notably, it incorporated a BERT model into the RASP framework to analyze and detect SQL injection attacks, while employing stack monitoring and blacklist matching to defend against XSS and deserialization attacks. HP-RASP used Java instrumentation to dynamically insert monitoring logic into critical classes and methods, enabling real-time analysis of web requests. The system was evaluated on multiple open-source datasets and compared to the current mainstream RASP system, OpenRASP. Experimental results demonstrate significant improvements in detection accuracy, performance overhead, and robustness over existing approaches. For SQL injection, HP-RASP achieved an accuracy of 81.9%, 1.84 times higher than OpenRASP, with recall and F1 scores also notably surpassing OpenRASP. For XSS protection, HP-RASP achieved a 99.9% recall rate for both reflective and stored XSS attacks, and an 84.6% recall rate for deserialization attacks. HP-RASP also performed well in terms of response time and resource consumption, without significant increases in either metric.

Key words: RASP, BERT model, software security, Java web application

中图分类号: