CN102438023B - Method and device for detecting malicious remote procedure call (RPC) behaviors - Google Patents

Abstract

The invention discloses a method and a device for detecting malicious remote procedure call behaviors, which are used to solve the problems in the prior art that the detection effect of malicious RPC behaviors is poor and there are many false positives. The method includes: when the client computer queries the server for the high-order port corresponding to the RPC service, record the UUIDs of all RPC services requested by the client computer; Analyze the data packet to obtain the RPC flow carried on the session connection; obtain all UUIDs related to the RPC process according to the recorded UUID and RPC flow; judge whether each UUID in all obtained UUIDs conforms to the policy Predetermined control strategy in the library to detect whether the client executes malicious RPC behavior. Improve the effectiveness of the protection device to detect malicious RPC behavior, and strengthen the security of the protected RPC server.

Description

Method and device for detecting malicious remote procedure call behavior

technical field

The invention relates to the technical field of computer networks, in particular to a method for detecting malicious remote procedure call (RPC, Remote Procedure Call) behavior and a detection device for malicious RPC behavior.

Background technique

The RPC protocol provides an inter-process communication mechanism through which a program running on one computer can request services from a program on another computer in the network. When the RPC protocol is applied, it adopts the client/server mode, the program that requests the service acts as a client, and the program that provides the service acts as a server.

In order to distinguish multiple different RPC protocol-based services (hereinafter referred to as RPC services) provided by the same computer, the prior art uses a UUID to uniquely identify each RPC service on the same server. When each PRC service on the server is started, it will apply for a high-order port with a port number ranging from 1024 to 65525, and register the high-order port according to the UUID of the PRC service, that is, save the UUID and the high-order port number. One-to-one mapping relationship. When the client requests an RPC service from the server, it needs to establish a connection with the high-order port corresponding to the RPC service on the server, and then request the service through the connection. Specifically: the client needs to first establish a connection with the server through a predetermined query port, such as port 135, query the server for the high-order port number corresponding to the RPC service according to the UUID of the RPC service to be requested, and close the query after obtaining the high-order port number returned by the server connection; then, use the obtained high-order port number corresponding to the RPC service to be requested to establish a connection request service with the server.

Due to loopholes in the design of the server system, the client can perform dangerous operations by requesting RPC services corresponding to certain UUIDs, such as creating buffer overflows by sending packets with incorrect formats or parameters when requesting RPC services. Thus gaining full control over the server. In order to solve this problem, the prior art proposes to detect the RPC call process through an intrusion prevention system (IPS, Intrusion Prevention System). If the service corresponding to the UUID bound to the RPC call process is dangerous and has loopholes, it should be prohibited from calling , or the executed operation is prohibited, block the calling process.

In the process of realizing the present invention, the inventor finds that the prior art has at least the following defects:

When a malicious client binds multiple UUIDs during the RPC process, including the UUID of the malicious RPC service, or attempts to perform prohibited operations, the existing IPS cannot effectively detect the malicious RPC behavior, resulting in many false positives , so that the security of the server cannot be ensured.

Contents of the invention

An embodiment of the present invention provides a method for detecting malicious RPC behavior, which is used to solve the problem of poor detection effect and many false positives in the prior art.

Correspondingly, the embodiment of the present invention also provides a detection device for malicious RPC behavior.

The technical scheme that the embodiment of the present invention provides is as follows:

A detection method for malicious remote procedure call RPC behavior, comprising:

When the client queries the server for the high port corresponding to the RPC service, record the UUIDs of all RPC services requested by the client;

In the RPC process, the data packet transmitted in the session connection between the client and the server is analyzed to obtain the RPC stream carried on the session connection;

Obtain all UUIDs related to the RPC process according to the recorded UUID and RPC flow;

Judging whether each UUID among all obtained UUIDs conforms to the predetermined control policy in the policy library, so as to detect whether the client computer executes malicious RPC behavior.

A detection device for malicious RPC behavior, comprising:

The recording module is used to record the UUIDs of all RPC services requested by the client when the client queries the server for the high port corresponding to the RPC service;

The analysis module is used to analyze the data packets transmitted in the session connection between the client and the server during the RPC process, and obtain the RPC stream carried on the session connection;

An acquisition module, configured to obtain all UUIDs related to the RPC process according to the UUID recorded by the recording module and the RPC flow obtained by the parsing module;

The detection module is used to judge whether each UUID among all the UUIDs obtained by the acquisition module conforms to the predetermined control strategy in the strategy library, so as to detect whether the client computer executes malicious RPC behavior.

The embodiment of the present invention obtains all UUIDs bound by the client in the RPC process by analyzing the interactive data packets, and detects the legitimacy of each UUID according to the policies in the policy library, so as to detect whether the client executes malicious RPC behavior. It prevents the client from evading the detection of the protection device by binding multiple UUIDs, improves the effectiveness of the protection device in detecting malicious RPC behaviors, and thus strengthens the security of the protected RPC server.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is the flow chart of main realization principle of the embodiment of the present invention;

FIG. 2 is a schematic diagram of a network deployment structure provided by an embodiment of the present invention;

Fig. 3 is the detailed flowchart of the detection method of malicious RPC behavior that the embodiment of the present invention provides;

Fig. 4 is the schematic diagram that server provides RPC service to client computer through RPC flow in the embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a detection device for malicious RPC behavior provided by an embodiment of the present invention;

FIG. 6 is another schematic structural diagram of a detection device for malicious RPC behavior provided by an embodiment of the present invention.

Detailed ways

The inventor conducted an in-depth analysis of the fact that the existing IPS cannot effectively detect the malicious RPC service call behavior when multiple UUIDs are bound in the RPC process, and found that the reason is: in view of the fact that the RPC call process needs to use UUID, and the The port number corresponding to the UUID registration is a parameter, and the connection is established to provide services. Therefore, the design premise of the existing IPS is that only one UUID is bound in the process of an RPC call, that is, a TCP session connection that transmits RPC content. As long as the IPS detects the first UUID carried in it, the purpose of protecting against malicious RPC calls can be achieved.

However, a malicious client can evade detection by binding multiple UUIDs in one RPC call. As long as the RPC service corresponding to the first UUID is allowed, the IPS will determine that the RPC call is non-malicious. Malicious clients can achieve the purpose of binding multiple UUIDs in one RPC call in various ways, such as using the Alter Context option of RPC to call RPC services corresponding to multiple UUIDs in a TCP session connection, or in a TCP session The session connection carries multiple UUIDs, but the first UUID corresponds to the way the server does not support the service to avoid detection.

On the basis of the above analysis, the inventor provides a method for detecting malicious RPC call behaviors in order to evade detection by binding multiple UUIDs during an RPC call process.

The main realization principles, specific implementation modes and corresponding beneficial effects that can be achieved of the technical solutions of the embodiments of the present invention will be described in detail below in conjunction with each accompanying drawing.

As shown in Figure 1, the main implementation principle flow of the embodiment of the present invention is as follows:

Step 10, when the client computer queries the server for the high-order port corresponding to the RPC service, record the UUIDs of all RPC services requested by the client computer.

Optionally, since the address or port of the client is usually fixed, the protection device deployed between the client and the server can obtain all the traffic requested by each client by monitoring the flow of a predetermined query port on the server, such as port 135. The UUID of the RPC service. The protective devices include, but are not limited to, IPS and firewalls.

Step 20, during the RPC process, analyze the data packets transmitted in the session connection between the client and the server, and obtain the RPC flow carried by the session connection.

Wherein, the load part of each TCP data packet in the TCP session connection can carry the data of the upper layer protocols such as the session layer and the application layer, and by performing protocol analysis on the load part of each TCP data packet in the TCP session connection, the client can be obtained The RPC flow carried by the data packets exchanged between the machine and the server in a session connection.

Since the protection device cannot know which port the RPC service will use in advance, the protection device usually allows the data packets of all high-order ports to pass through. Therefore, in order to ensure security, the protection device needs to monitor the session connections of all high-order ports on the server.

Step 30, according to the recorded UUID and RPC flow, obtain the issued UUID related to the RPC process.

The solution protection device provided by this embodiment obtains all UUIDs bound in the RPC stream by parsing the RPC stream, instead of stopping parsing when the first UUID is parsed as in the prior art.

Step 40, by querying the policy library, judging whether each UUID obtained related to the RPC process conforms to the predetermined control policy in the policy library, so as to detect whether the client computer executes malicious RPC behavior.

Specifically, the policy library and query requirements can be set according to the requirements of different security levels of the network environment where protective devices such as IPS or firewalls are located. For example, for a network environment with high security requirements, normal control policies can be configured in the policy library , the normal control policy includes a normal UUID related to the RPC process, if it is judged that at least one UUID related to the RPC process of the client does not comply with the normal control policy, then it is determined that the client has executed a malicious RPC behavior; for For a network environment with low security requirements, an exception control policy can be configured in the policy library, and the exception control policy includes UUIDs related to malicious RPC behaviors. If it is determined that at least one UUID related to the client RPC process conforms to the exception control policy, it is determined that the client computer has executed a malicious RPC behavior, as long as each UUID does not comply with the abnormality control strategy, it is considered that the client computer executes a normal RPC behavior.

Optionally, after detecting that the client executes the malicious RPC behavior, the method further includes: blocking a data packet corresponding to the malicious RPC behavior in the TCP session connection, and of course, blocking the TCP session connection.

The method for detecting malicious RPC behavior provided by the embodiment of the present invention obtains all UUIDs bound by the client during the RPC process by analyzing the payload content of the data packet in the TCP session connection, and checks each UUID according to the policy in the policy library. The legitimacy of the UUID is detected to detect whether the client executes malicious RPC behavior. It eliminates the possibility that the client can evade the detection of the protection device by binding multiple UUIDs, improves the effectiveness of the protection device in detecting malicious RPC behaviors, and thus strengthens the security of the protected RPC server.

In the following, an embodiment will be introduced in detail based on the above-mentioned inventive principles of the present invention to elaborate and describe the main realization principles of the method of the present invention in detail.

Figure 2 is a schematic diagram of a network deployment structure provided by an embodiment of the present invention. The protection device is deployed between the client and the server, and the data packets exchanged between the client and the server need to be detected by the protection device before being sent to the other party. Figure 2 shows several examples of data packet forwarding processes in chronological order. Protective devices include but are not limited to IPS, firewalls, etc. Of course, there may be multiple clients and servers. For the sake of simplicity, only one client and one server are used as examples in FIG. 2 and FIG. 3 for illustration.

Figure 3 is a detailed flowchart of the detection method for malicious RPC behavior provided by the embodiment of the present invention.

In step 301, the protection device obtains the port query request of the client ClientA by monitoring the traffic of the predetermined query port (such as port 135) of the server.

Optionally, when the client queries the server for the high-order port number corresponding to the UUID of the RPC service, the Packet Flag field in the port query request sent is set to 0x03. The protection device can identify the query request based on the characteristic fields including the Packet Flag field.

If the content of the Packet Flag field is not 0x03, it means that the packet payload carries fragmented data (sometimes there are many UUIDs queried, which cannot be carried in the same packet), and the protection device will check the fragmented data sent by the client. Splicing and reorganization to splice out a complete query request.

In step 302, the protection device performs protocol analysis on the port query request of client A, obtains and records UUIDs of all RPC services requested by the client.

Optionally, the protection device may store the UUID requested by the client in the form of a record table, a one-way linked list, or a tree. When stored in the form of a record table, as shown in Table 1.

Table 1

Optionally, since the server does not support RPC services corresponding to all UUIDs requested by the client, even if the client requests unsupported RPC services from the server, the server will not provide these services. Therefore, in order to reduce the subsequent traffic monitoring burden of the protection device, Table 1 can be deleted, and step 303 is executed.

Step 303 , the protection device performs protocol analysis on the port query response returned by the server, obtains information about whether the server supports the UUID requested by the client, and deletes the UUID of the RPC service not supported by the server from the record.

If the server supports the service corresponding to the UUID carried in the query request sent by the client, it will return the corresponding high-order port number in the query response, otherwise it will return rejection information, such as Providerrejection (0x02). If the protection device can obtain the high-order port number corresponding to the UUID from the query response, it means that the server supports the RPC service identified by the UUID; otherwise, it means that the server does not support the RPC service identified by the UUID.

In this embodiment, the server does not support the RPC service corresponding to UUID121 and UUID80, and Table 2 is the result after deleting Table 1.

Table 2

Step 304, the client establishes a TCP session connection with the server according to the high-order port number corresponding to the queried UUID. The server and the client carry the RPC flow through the TCP session connection, and exchange parameters and data, thereby providing RPC services.

Among them, the process of the server providing RPC service to the client through RPC flow is as follows:

Step 401, the client computer sends "UUID sequence number + operator" to the server, and the sequence number indicates the sequence when the client computer sends UUID during the port query phase;

Operators include, but are not limited to: operator "w" corresponding to a write operation, operator "r" corresponding to a read operation, operator "q" corresponding to a query operation, and so on.

Step 402, the server performs corresponding processing according to the "sequence number + operator";

Step 403, when the processing corresponding to the "sequence number + operator" includes the need to return information to the client, the server returns the processing result to the client;

For example, when the operator is the operator "r" corresponding to the read operation, the server needs to return the read data to the client; when the operator is the operator "w" corresponding to the write operation, the server needs to Returns success or failure of the write to the client.

The above step 401 and step 403 may be repeated multiple times, and the sequence number and operator sent by the client may be different each time.

Step 305, the protection device analyzes the data packets transmitted in the TCP session connection between the client and the server passing through the protection device, and obtains the RPC flow.

The protection device reassembles the IP fragmentation of the data packets sent by the client and flows through the protection device, and then reassembles the session content on this basis. Then protocol analysis is performed on the session content, and the RPC stream is obtained from it.

The protection device obtains all UUIDs related to the client RPC process through steps 306 to 308 .

Step 306, the protection device parses out the sequence number of each RPC service carried in the RPC stream.

Optionally, the protection device may also parse the RPC stream to obtain operators corresponding to each sequence number.

For example, the protection device obtains S1, S2+"r", and S3+"w" from the RPC flow between the client ClientA and the server.

In step 307, the protection device obtains the sequence number corresponding to each recorded UUID according to the sequence in which the UUIDs are recorded, and saves the corresponding relationship between the UUID and the sequence number, as shown in Table 3.

table 3

Step 308 , for each parsed sequence number, the protection device searches for the corresponding UUID in the corresponding relationship, so as to obtain all UUIDs related to the RPC process.

Optionally, a combination of a UUID and an operator related to the RPC process can also be obtained after searching.

For example, after searching, it can also be found that the combinations of UUIDs related to the RPC process, and the combinations of UUIDs and operators are: UUID2, UUID75+"r", UUID105+"w".

In step 309, the protection device queries the policy database to determine whether each UUID related to this RPC process conforms to the predetermined control policy, so as to detect whether the client has executed a malicious RPC behavior. If so, go to step 310; otherwise, go to step 311.

Optionally, it is also judged whether the combinations of UUIDs and operators related to this RPC process conform to a predetermined control strategy.

Specific detection methods include but are not limited to the following two:

Mode 1: If the policy library contains normal control policies, and the normal control policies include UUIDs related to normal RPC behaviors, then if the protection device judges that at least one UUID related to this RPC behavior does not conform to the normal control policies, then It is determined that the client computer has performed a malicious RPC behavior.

The normal policy library is shown in Table 4,

Table 4

After query, the protection device confirmed that among the UUIDs related to ClientA's RPC behavior, and the combination of each UUID and operator, UUID2 conforms to policy 1; UUID75+"r" conforms to policy 2; UUID105+"w" does not conform to policy 3, because policy 3 It stipulates that for the RPC service identified by UUID105, only read operations are allowed, and ClientA tries to perform write operations on the RPC service identified by UUID105. Since policy 3 is not met, the protection device confirms that ClientA has performed a malicious RPC behavior.

Method 2:

If the policy library contains an abnormality control strategy, the abnormality control strategy includes UUIDs related to malicious RPC behaviors, and if the protection device judges that at least one UUID related to this RPC process conforms to the abnormality control strategy, then determine that the client executes malicious RPC behavior.

The normal policy library is shown in Table 5,

table 5

After query, the protection device confirmed that among the UUIDs related to ClientA's RPC behavior, and the combination of each UUID and operator, UUID2 conforms to policy 4; UUID75+"r" conforms to policy 5; UUID105+"w" does not conform to policy 6, because policy 3 It stipulates that for the RPC service identified by UUID105, the read operation is not allowed, and the write operation that ClientA tries to perform on the RPC service identified by UUID105 is allowed. Since policies 4 and 5 are met, the protection device confirms that ClientA has performed malicious RPC behavior.

It should be noted that the specific detection methods are not limited to the above two, and can be flexibly set. For example, execute a normal control strategy for UUIDs in the first predetermined range, for example, execute a normal control strategy for UUIDs with UUIDs in the range of 0 to 100, and combinations of UUIDs and operators within this range; for UUIDs in the second predetermined range UUID implements an exception control strategy, for example, executes an exception control strategy for UUIDs whose UUIDs are in the range of 101 to 200, and combinations of UUIDs and operators within this range.

In step 310, the protection device blocks the data packets corresponding to the malicious RPC behavior after detecting that the client computer executes the malicious RPC behavior.

Specifically, the protection device blocks data packets corresponding to malicious RPC behaviors. For example, when the protection device adopts the first detection method in step 309, it blocks the data packet that ClientA tries to perform a write operation on the RPC service identified by UUID105. Of course, the protection device can also perform other control measures on the client computer according to the preset blocking strategy. For example, as long as it detects that the client computer has performed malicious RPC behavior, it will block all data packets in the current TCP session connection of the client computer, and send all The identification of the client computer, such as user name, address, etc., is added to the blacklist library and so on.

Step 311 , if the protection device detects that the client computer does not perform malicious RPC behavior, the RPC flow is allowed to pass through the protection device, and the server provides remote RPC services to the client computer.

In the detection method of the malicious RPC behavior provided by the embodiment of the present invention, the protection device arranged between the client computer and the server analyzes the data packets in the TCP session connection flowing through the protection device, and obtains the client computer and the server during the execution of the RPC process. RPC stream, and obtain all the UUIDs bound by the client in the RPC process; according to the policy in the policy library, the validity of each UUID is detected, only in the detection results, all UUIDs conform to the normal control strategy, Or it is confirmed that the RPC behavior of the client is normal only when there is no UUID conforming to the exception control policy; otherwise, it is confirmed that the client executes a malicious RPC behavior. It eliminates the possibility that the client can evade IPS detection by binding multiple UUIDs, improves the effectiveness of IPS in detecting malicious RPC behaviors, and thus strengthens the security of the protected RPC server.

Correspondingly, the embodiment of the present invention also provides a malicious RPC behavior detection device, which can be integrated into protection equipment such as IPS or firewall, as shown in Figure 5, the device includes a recording module 501, an analysis module 502, an Module 503 and detection module 504, specifically as follows:

The recording module 501 is used to record the UUIDs of all RPC services requested by the client when the client queries the server for the high port corresponding to the RPC service;

The analysis module 502 is used to analyze the data packets transmitted in the session connection between the client and the server during the RPC process, and obtain the RPC stream carried on the session connection;

The obtaining module 503 is used to obtain all UUIDs related to the RPC process according to the UUID recorded by the recording module 501 and the RPC flow obtained by the parsing module 502;

The detection module 504 is configured to judge whether each UUID among all the UUIDs obtained by the acquisition module 503 conforms to a predetermined control policy in the policy library, so as to detect whether the client executes malicious RPC behavior.

Optionally, the detection device also includes:

The blocking module 505 is configured to block the data packet corresponding to the malicious RPC behavior after the detection module 504 determines that the client computer has executed the malicious RPC behavior.

Optionally, as shown in Figure 6, the detection device also includes:

The storage module 506 is used to obtain the sequence number corresponding to each UUID recorded according to the sequence when the recording module 501 records the UUID, and save the correspondence between the UUID and the sequence number;

Correspondingly, the acquisition module 503 includes:

A parsing unit 601, configured to parse out the sequence number of each RPC service carried from the RPC stream;

The obtaining unit 602 is configured to, for each parsed sequence number, search for a corresponding UUID in the corresponding relationship stored in the storage module 506, so as to obtain all UUIDs related to the RPC process.

Optionally, the detection module 504 includes:

A screening unit 603, configured to screen all UUIDs related to the RPC behavior obtained by the acquisition module 503, and remove UUIDs of RPC services that are not supported by the server;

The detection unit 604 is configured to query the policy library to determine whether each UUID screened and retained by the screening unit 603 conforms to a predetermined control policy.

Optionally, the parsing unit 601 in FIG. 6 is further configured to parse out the combination of sequence number and operator of each RPC service carried in the RPC stream;

The obtaining unit 602 is further configured to, for each sequence number and operator combination parsed by the parsing unit 601, search for the corresponding UUID in the corresponding relationship according to the sequence number therein, so as to obtain the UUID corresponding to the RPC All UUID and operator combinations associated with the process.

Correspondingly, the screening unit 603 is further configured to screen each combination of UUID and operator obtained by the obtaining unit, and remove the combination of UUID and operator of the RPC service not supported by the server;

The detection unit 604 is further configured to query the policy library to determine whether the combination of each UUID and operator screened and retained by the screening unit 603 conforms to a predetermined control policy.

Those of ordinary skill in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as: ROM/RAM, Diskettes, CDs, etc.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (14)

1. a detection method for malice remote procedure call behavior, is characterized in that, comprising:

In the time that client computer is served corresponding high-order port to server lookup RPC, record the UUID of all RPC services of this client requests;

In RPC process, the packet transmitting in session connection between described client computer and server is resolved, obtain the RPC stream carrying in described session connection;

According to the UUID of described record and RPC stream, obtain all UUIDs relevant to described RPC process;

Judge whether the each UUID in all UUID that obtain meets control strategy predetermined in policy library, detect client computer with this and whether carried out malice RPC behavior.

2. the method for claim 1, is characterized in that, before the RPC stream carrying, also comprises in the described session connection of described acquisition:

Sequencing when recording described UUID, obtains the serial number corresponding to each UUID of record, and preserves the corresponding relation of UUID and serial number;

Describedly obtain all UUIDs relevant to described RPC process according to the UUID of described record and RPC stream, comprising:

From described RPC stream, parse the serial number of each RPC service of carrying;

For each serial number parsing, in described corresponding relation, search corresponding UUID, thereby obtain all UUIDs relevant to described RPC process.

3. the method for claim 1, is characterized in that, whether the each UUID in the described all UUID that judge acquisition meets control strategy predetermined in policy library, comprising:

The all UUIDs relevant to described RPC process that obtain are screened, remove the UUID that RPC that wherein said server do not support serves;

By query strategy storehouse, judge whether each UUID that screening retains meets predetermined control strategy.

4. as the method as described in arbitrary in claims 1 to 3, it is characterized in that, described policy library comprises normal control strategy or abnormal control strategy, and described normal control strategy comprises the UUID that normal RPC behavior is relevant, described abnormal control strategy comprises the relevant UUID of malice RPC behavior;

Describedly judge whether each UUID meets control strategy predetermined in policy library, detect client computer with this and whether carried out malice RPC behavior, comprising:

Judge whether each UUID meets the normal control strategy in policy library, if do not meet described normal control strategy, definite described client computer has been carried out malice RPC behavior; Or/and

Judge whether each UUID meets the abnormal control strategy in policy library, if meet described abnormal control strategy, definite described client computer has been carried out malice RPC behavior.

5. method as claimed in claim 2, is characterized in that, describedly obtains after all UUID relevant to described RPC behavior according to the UUID of described record and RPC stream, also comprises:

From described RPC stream, parse the serial number of each RPC service of carrying and the combination of operator;

For each described combination, in described corresponding relation, search corresponding UUID according to serial number wherein, thereby obtain the combination of all UUID AND operators relevant to described RPC process.

6. method as claimed in claim 5, is characterized in that, whether the each UUID in the described all UUID that judge acquisition meets control strategy predetermined in policy library, comprising:

To the each UUID obtaining and each UUID AND operator be combined into row filter, remove the UUID of the RPC service that wherein said server do not support and the combination of the UUID AND operator of the RPC service do not supported;

By query strategy storehouse, judge whether each UUID of screening reservation, the combination of each UUID AND operator meet predetermined control strategy.

7. as the method for claim 1,2,3,5 or 6 as described in arbitrary, it is characterized in that, described detection client computer also comprises after having carried out malice RPC behavior:

Block packet corresponding to described malice RPC behavior.

8. a checkout gear for malice RPC behavior, is characterized in that, comprising:

Logging modle, in the time that client computer is served corresponding high-order port to server lookup RPC, records the UUID of all RPC services of this client requests;

Parsing module, in RPC process, resolves the packet transmitting in session connection between described client computer and server, obtains the RPC stream carrying in described session connection;

Acquisition module, for according to the RPC stream of the UUID of logging modle record and parsing module acquisition, obtains all UUIDs relevant to described RPC process;

Detection module, for judging whether each UUID of all UUID that acquisition module obtains meets control strategy predetermined in policy library, detects client computer with this and whether has carried out malice RPC behavior.

9. device as claimed in claim 8, is characterized in that, also comprises:

Memory module, the sequencing when recording described UUID according to logging modle, obtains the serial number corresponding to each UUID of record, and preserves the corresponding relation of UUID and serial number;

Described acquisition module comprises:

Resolution unit, for parsing the serial number of each RPC service of carrying from described RPC stream;

Obtain unit, for for each serial number parsing, in the described corresponding relation of preserving in described memory module, search corresponding UUID, thereby obtain all UUIDs relevant to described RPC process.

10. device as claimed in claim 8, is characterized in that, described detection module comprises:

Screening unit, screens for all UUID relevant to described RPC process that acquisition module is obtained, and removes the UUID that RPC that wherein said server do not support serves;

Detecting unit, for by query strategy storehouse, judges whether each UUID that the screening of screening unit retains meets predetermined control strategy.

11. devices as claimed in claim 9, is characterized in that, described detection module comprises:

Screening unit, screens for all UUID relevant to described RPC process that acquisition module is obtained, and removes the UUID that RPC that wherein said server do not support serves;

Detecting unit, for by query strategy storehouse, judges whether each UUID that the screening of screening unit retains meets predetermined control strategy.

12. devices as claimed in claim 11, is characterized in that,

Described resolution unit, also for parsing the serial number of each RPC service of carrying and the combination of operator from described RPC stream;

Described acquisition unit, also for each serial number of parsing for described resolution unit and the combination of operator, in described corresponding relation, search corresponding UUID according to serial number wherein, thereby obtain the combination of all UUID AND operators relevant to described RPC process.

13. devices as claimed in claim 12, is characterized in that,

Described screening unit, also for each UUID AND operator that described acquisition unit is obtained be combined into row filter, remove the combination of the UUID AND operator of the RPC service that wherein said server do not support;

Described detecting unit, also, for by query strategy storehouse, judges whether the combination of each UUID AND operator of described screening unit screening reservation meets predetermined control strategy.

14. devices as described in as arbitrary in claim 8 to 13, is characterized in that, also comprise:

Blocking-up module, after determining that at detection module described client computer has been carried out malice RPC behavior, blocks packet corresponding to described malice RPC behavior.