CN115048647A - Safety protection method and device - Google Patents

Abstract

The embodiment of the invention provides a safety protection method and a safety protection device, wherein the method comprises the following steps: acquiring a file to be compiled read in a compiling process through a first monitoring point; matching the file to be compiled with a legal file included in a white list to obtain a first matching result; and determining whether the file to be compiled is safe or not based on the first matching result. The safety protection method and the safety protection device only allow the known legal files in the white list to be compiled, do not allow the unknown files to be compiled, belong to the protection idea of the white list, and cannot be compiled even if the files to be compiled are uploaded, so that the attack caused by the uploading of the unknown files to be compiled can be avoided, and the safety protection of the network is realized.

Description

Safety protection method and device

technical field

The present invention relates to the technical field of safety protection, and in particular, to a safety protection method and device.

Background technique

With the continuous development of information technology, the degree of informatization of human society is getting higher and higher, and the whole society is more and more dependent on network information, so the importance of network security is also higher and higher. At present, there are more and more attacks that threaten network security. For example, attackers use the inherent vulnerabilities of business systems to upload arbitrary files to achieve the purpose of attacks.

In related technologies, the protection idea of scanning configuration baselines is usually adopted. For example, OpenRASP scans the configuration baselines of some common vulnerabilities and assists in modifying the more dangerous configuration items in the configuration baselines to repair configuration item vulnerabilities, thereby preventing arbitrary file uploads. , so as to protect against attacks caused by arbitrary file uploads. However, this protection method can only protect against the vulnerabilities that have appeared in the past. When a new vulnerability appears, the corresponding configuration file cannot be modified, which will cause the attacker to use the new vulnerability to upload arbitrary files to achieve the purpose of the attack.

SUMMARY OF THE INVENTION

In view of the problems in the prior art, embodiments of the present invention provide a security protection method and device.

Specifically, the embodiments of the present invention provide the following technical solutions:

In a first aspect, an embodiment of the present invention provides a security protection method, including:

Obtain the to-be-compiled file read during the compilation process through the first monitoring point;

Matching the to-be-compiled file with the legal files included in the whitelist to obtain a first matching result;

Whether the to-be-compiled file is safe is determined based on the first matching result.

Further, the described to-be-compiled file is matched with the legal file included in the whitelist to obtain a first matching result, including:

When it is determined that the legal files included in the whitelist include all files to be compiled read during the compilation process, determine that the first matching result is a successful match;

When it is determined that the legal files included in the whitelist do not contain all the files to be compiled read during the compilation process, it is determined that the first matching result is a matching failure.

Further, the whitelist also includes a legal class file that inherits the compilation specification and a legal compilation result file corresponding to the to-be-compiled file; the legal class file is a file in the legal file;

The method also includes:

In the case that the to-be-compiled file is determined to be safe based on the first matching result, obtain the to-be-loaded file in the class loading process through the second monitoring point;

Matching the to-be-loaded file with the legal class file and the legal compilation result file in the whitelist to obtain a second matching result;

Whether the to-be-loaded file is safe is determined based on the second matching result.

Further, the described to-be-loaded file is matched with the legal class file and the legal compilation result file in the whitelist to obtain a second matching result, including:

determining the intersection of the set of legal class files in the whitelist and the set of legal compilation result files;

When it is determined that all files to be loaded in the class loading process are included in the intersection, it is determined that the second matching result is a successful match;

When it is determined that the intersection set does not contain all the files to be loaded in the class loading process, it is determined that the second matching result is a matching failure.

Further, before the to-be-compiled file is matched with the legal file included in the whitelist to obtain a first matching result, the method further includes:

Scan the deployment code to obtain legal files in the deployment code, and record the legal files in the whitelist.

Further, the method also includes:

A class file inheriting the compilation specification is determined in the legal file, and the class file inheriting the compilation specification is recorded in the white list.

Further, before the to-be-loaded file is matched with the legal class file and the legal compilation result file in the whitelist to obtain a second matching result, the method further includes:

Obtain a legal compilation result file corresponding to the to-be-compiled file through the first monitoring point, and record the legal compilation result file in the whitelist.

Further, determining whether the to-be-loaded file is safe based on the second matching result includes:

When the second matching result is that the matching fails, it is determined that the to-be-loaded file is not safe;

When the second matching result is that the matching is successful, it is determined that the file to be loaded is safe.

Further, determining whether the to-be-compiled file is safe based on the first matching result includes:

When the first matching result is a matching failure, it is determined that the to-be-compiled file is not safe;

When the first matching result is that the matching is successful, it is determined that the to-be-compiled file is safe.

In a second aspect, an embodiment of the present invention also provides a safety protection device, including:

a first acquisition unit, configured to acquire the to-be-compiled file read during the compilation process through the first monitoring point;

a first matching unit, configured to match the to-be-compiled file with a legal file included in the whitelist to obtain a first matching result;

A first determining unit, configured to determine whether the to-be-compiled file is safe based on the first matching result.

In a third aspect, an embodiment of the present invention further provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the first program when executing the program The steps of the security protection method described in the aspect.

In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of the security protection method described in the first aspect.

In a fifth aspect, an embodiment of the present invention further provides a computer program product that stores executable instructions thereon, and when the instructions are executed by a processor, enables the processor to implement the steps of the security protection method described in the first aspect.

In the security protection method and device provided by the embodiments of the present invention, the to-be-compiled file read in the compilation process is acquired through the first monitoring point, the to-be-compiled file is matched with the legal files included in the whitelist, and finally the first matching result is based on Determines whether the file to be compiled is safe. It can be seen that the present invention only allows the compilation of known legal files in the whitelist, and does not allow the compilation of unknown files to be compiled, which belongs to the protection idea of the whitelist. Even if the files to be compiled have been uploaded, they cannot be compiled, thereby avoiding unknown waiting. The attack caused by the upload of compiled files realizes the security protection of the network.

Description of drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained according to these drawings without creative efforts.

1 is one of the schematic flowcharts of a security protection method provided by an embodiment of the present invention;

2 is a second schematic flowchart of a security protection method provided by an embodiment of the present invention;

3 is a third schematic flowchart of a security protection method provided by an embodiment of the present invention;

4 is a fourth schematic flowchart of a security protection method provided by an embodiment of the present invention;

5 is a fifth schematic flowchart of a security protection method provided by an embodiment of the present invention;

6 is a schematic structural diagram of a safety protection device provided by an embodiment of the present invention;

FIG. 7 is a schematic diagram of a physical structure of an electronic device provided by an embodiment of the present invention.

Detailed ways

In order to make the purposes, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments These are some embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

FIG. 1 is one of the schematic flow charts of the security protection method provided by the embodiment of the present invention. As shown in FIG. 1 , the security protection method includes the following steps:

Step 101: Acquire the to-be-compiled file read during the compilation process through the first monitoring point.

For example, the first monitoring point can be set during the compilation process of JAVA server pages (Java Server Pages, JSP) through technologies such as a security manager (SecurityManager) or a Java agent (javaagent), and when running to the first monitoring point, the first monitoring point can be set through the first monitoring point. A monitoring point acquires the to-be-compiled file read during the compilation process, the to-be-compiled file is the code file to be compiled, and the to-be-compiled file may be one or multiple.

Step 102: Match the to-be-compiled file with the legal files included in the whitelist to obtain a first matching result.

The legal files are all files included in the deployment code of a specific project, for example, all class files in the deployment code, all code files that need to be compiled, video files, picture files, and other files related to the project.

For example, when the to-be-compiled file read during the compilation process is obtained through the first monitoring point, the security of the to-be-compiled file is analyzed using the protection idea of a whitelist, that is, the to-be-compiled file is compared with the pre-stored whitelist. The specific matching method is to traverse all legal files in the whitelist to find out whether the set of all legal files contains the files to be compiled, and obtain the first matching result.

It should be noted that the matching of the to-be-compiled file with the legal files included in the whitelist may be to match the name or identifier of the to-be-compiled file with the name or identifier of the legal file in the whitelist, which is not limited in the present invention.

Step 103: Determine whether the to-be-compiled file is safe based on the first matching result.

Specifically, when the first matching result is that the matching fails, it is determined that the to-be-compiled file is not safe; when the first matching result is that the matching is successful, it is determined that the to-be-compiled file is safe.

For example, when the first matching result is that the matching fails, it means that the to-be-compiled file is an unknown file (for example, a malicious JSP file that can implement attacks), so that it can be determined that the to-be-compiled file is an unsafe file; When a matching result is successful, it means that the to-be-compiled file is a known legal file, so it can be determined that the to-be-compiled file is a safe file.

In addition, when it is determined that the to-be-compiled file is an unsafe file, alarm information can be generated, and the alarm information can be stored or output, so that the user can know the unsafe to-be-compiled file.

In the security protection method provided by the embodiment of the present invention, the to-be-compiled file read in the compilation process is acquired through the first monitoring point, the to-be-compiled file is matched with the legal files included in the whitelist, and finally the to-be-compiled file is determined based on the first matching result. Is it safe to compile the file. It can be seen that the present invention only allows the compilation of known legal files in the whitelist, and does not allow the compilation of unknown files to be compiled, which belongs to the protection idea of the whitelist. Even if the files to be compiled have been uploaded, they cannot be compiled, thereby avoiding unknown waiting. The attack caused by the upload of compiled files realizes the security protection of the network.

Optionally, step 102 in FIG. 1 can be specifically implemented in the following manner:

When it is determined that the legal files included in the whitelist include all files to be compiled read during the compilation process, determine that the first matching result is a successful match;

When it is determined that the legal files included in the whitelist do not contain all the files to be compiled read during the compilation process, it is determined that the first matching result is a matching failure.

For example, when the to-be-compiled file read in the compilation process is obtained through the first monitoring point, the set of all legal files in the whitelist is traversed to find out whether the set of all legal files contains the to-be-compiled file, if all legal files are If the to-be-compiled file is found in the set of , it means that the to-be-compiled file read during the compilation process is legal, and it can be determined that the first matching result is a successful match. If the to-be-compiled file is not found in the set of all legal files, it means that the to-be-compiled file read during the compilation process is illegal, and it can be determined that the first matching result is a matching failure.

In the security protection method provided by the embodiment of the present invention, when it is determined that the set of all legal files in the whitelist does not contain the file to be compiled, the first matching result is determined to be a matching failure, so as to avoid the attack on the network caused by uploading any file, and realize the protection against Network security protection.

Optionally, the whitelist further includes a legal class file that inherits the compilation specification and a legal compilation result file corresponding to the to-be-compiled file; the legal class file is a file in the legal file.

The compilation specification is a pre-set JSP compilation rule, and the specific compilation specification type can be set based on actual requirements; for example, the compilation specification of the container Tomcat is org.apache.jasper.runtime.HttpJspBase, and the compilation specification of the container WebLogic is weblogic.servlet.jsp.JspBase; the legal class file that inherits the compilation specification refers to the class file that needs to conform to the compilation specification; the legal compilation result file corresponding to the to-be-compiled file refers to the file obtained after legal compilation of the to-be-compiled file; for example , the file to be compiled is a certain code file, and the legal compilation result file refers to a class file obtained by legally compiling a certain code file.

Optionally, FIG. 2 is the second schematic flow chart of the security protection method provided by the present invention. As shown in FIG. 2 , the whitelist also includes the legal class file that inherits the compilation specification and the legal compilation result file corresponding to the to-be-compiled file. Next, the security protection method further includes the following steps:

Step 104: In the case that the to-be-compiled file is determined to be safe based on the first matching result, acquire the to-be-loaded file in the class loading process through the second monitoring point.

For example, a second monitoring point can also be set in the JSP class loading process through technologies such as SecurityManager or Java agent, and when running to the second monitoring point, the file to be loaded in the class loading process can be obtained through the second monitoring point. The loaded file is the compilation result file, that is, the class file.

Step 105: Match the to-be-loaded file with the legal class file and the legal compilation result file in the whitelist to obtain a second matching result.

Specifically, determine the intersection of the set of legal class files in the whitelist and the set of legal compilation result files; when it is determined that the intersection set includes all files to be loaded in the class loading process, determine the second matching result The matching is successful; when it is determined that the intersection set does not contain all the files to be loaded in the class loading process, it is determined that the second matching result is a matching failure.

For example, when the file to be loaded in the loading process is obtained through the second monitoring point, the security of the file to be loaded needs to be analyzed, that is, the file to be loaded, the legal class file in the pre-stored whitelist and the legal compilation result file. The specific matching method is to traverse all legal class files and all legal compilation result files in the whitelist, and determine the intersection of the set of all legal class files and the set of all legal compilation result files, for example, in the set of all legal class files Including file 1, file 2 and file 3, the set of all legal compilation result files includes file 2 and file 3, then the files included in the intersection are file 2 and file 3; when determining the intersection, check whether the intersection contains files to be loaded. If the file to be loaded is included in the intersection set, it is determined that the second matching result is a successful match; if the file to be loaded is not included in the intersection set, it is determined that the second matching result is a matching failure.

It should be noted that to match the file to be loaded with the legal class file included in the whitelist and the legal compilation result file, it may be to match the name or identifier of the file to be loaded with the name or identifier of the legal class file in the whitelist, and the legal The names or identifiers of the compilation result files are matched, which is not limited in the present invention.

Step 106: Determine whether the file to be loaded is safe based on the second matching result.

Specifically, when the second matching result is that the matching fails, it is determined that the file to be loaded is not safe; when the second matching result is that the matching is successful, it is determined that the file to be loaded is safe.

For example, when the second matching result is that the matching fails, it means that the to-be-loaded file is an unknown file (for example, a malicious file that can implement attacks), so that it can be determined that the to-be-loaded file is an unsafe file; in the second When the matching result is that the matching is successful, it means that the file to be loaded is a known legal file, so that it can be determined that the file to be loaded is a safe file.

In addition, when it is determined that the file to be loaded is an unsafe file, alarm information can be generated, and the alarm information can be stored or output, so that the user can know the unsafe file to be loaded.

In the security protection method provided by the embodiment of the present invention, when it is determined that the file to be compiled is safe, the file to be loaded in the class loading process is further obtained through the second monitoring point, and the file to be loaded is compared with the legal class file in the whitelist and the legal compilation. The result file is matched, and finally, based on the second matching result, it is determined whether the file to be loaded is safe. In this way, the security of the files to be compiled and the files to be loaded can be ensured, thereby avoiding the attack on the network caused by the uploading of the unknown files to be compiled and the unknown files to be loaded, and realizing further security protection of the network.

FIG. 3 is a third schematic flow diagram of a security protection method provided by an embodiment of the present invention. As shown in FIG. 3 , the security protection method further includes the following steps:

Step 107: Scan the deployment code to obtain legal files in the deployment code, and record the legal files in the whitelist.

The deployment code may be the deployment code of a specific project; each legal file in the whitelist may be all legal files involved in the deployment code.

For example, scan the deployment code, analyze and obtain all types of files in the deployment code, record all types of files as legal files in the whitelist, and specifically record the names or identifiers of all types of files in the whitelist.

It should be noted that, step 107 may be performed before step 102, or may be performed before step 101, which is not limited in the present invention.

FIG. 4 is a fourth schematic flowchart of a security protection method provided by an embodiment of the present invention. As shown in FIG. 4 , after step 107 is performed, the security protection method further includes the following steps:

Step 108: Determine the class file inheriting the compilation specification in the legal file, and record the class file inheriting the compilation specification in the white list.

For example, when all types of files in the deployment code are obtained by analysis, class files inheriting the compilation specification are selected for all types of files, and the names or identifiers of the class files inheriting the compilation specification are recorded in the whitelist.

FIG. 5 is a fifth schematic flowchart of a security protection method provided by an embodiment of the present invention. As shown in FIG. 5 , the security protection method further includes the following steps:

Step 109: Acquire a legal compilation result file corresponding to the to-be-compiled file through the first monitoring point, and record the legal compilation result file in the whitelist.

For example, when running to the first monitoring point, legal compilation result files corresponding to the files to be compiled may also be obtained, and the names or identifiers of all legal compilation result files may be recorded in the whitelist.

It should be noted that, the above step 109 may be performed before any step before step 105, which is not limited in the present invention.

In the security protection method provided by the embodiment of the present invention, under the scenario of an attack caused by any file upload, all legal files in the deployment code, all class files inheriting the compilation specification, and all legal compilation result files are recorded in the whitelist in advance, It is convenient for the security protection idea based on the whitelist to avoid the attack on the network caused by the upload of unknown files to be compiled or unknown files to be loaded.

FIG. 6 is a schematic structural diagram of a safety protection device provided by an embodiment of the present invention. As shown in FIG. 6 , the safety protection device includes a first obtaining unit 601, a first matching unit 602 and a first determining unit 603; wherein:

A first obtaining unit 601, configured to obtain the to-be-compiled file read during the compilation process through the first monitoring point;

a first matching unit 602, configured to match the to-be-compiled file with a legal file included in the whitelist to obtain a first matching result;

A first determining unit 603, configured to determine whether the to-be-compiled file is safe based on the first matching result.

The security protection device provided by the embodiment of the present invention acquires the files to be compiled read during the compilation process through the first monitoring point, matches the to-be-compiled files with the legal files included in the whitelist, and finally determines the to-be-compiled files based on the first matching result. Is it safe to compile the file. It can be seen that the present invention only allows the compilation of known legal files in the whitelist, and does not allow the compilation of unknown files to be compiled, which belongs to the protection idea of the whitelist. Even if the files to be compiled have been uploaded, they cannot be compiled, thereby avoiding unknown waiting. The attack caused by the upload of compiled files realizes the security protection of the network.

Based on any of the foregoing embodiments, the first matching unit 602 is specifically configured to:

When it is determined that the legal files included in the whitelist include all files to be compiled read during the compilation process, determine that the first matching result is a successful match;

When it is determined that the legal files included in the whitelist do not contain all the files to be compiled read during the compilation process, it is determined that the first matching result is a matching failure.

Based on any of the foregoing embodiments, the whitelist further includes a legal class file that inherits the compilation specification and a legal compilation result file corresponding to the to-be-compiled file; the legal class file is a file in the legal file; the device Also includes:

a second acquiring unit, configured to acquire the to-be-loaded file in the class loading process through the second monitoring point under the condition that the to-be-compiled file is determined to be safe based on the first matching result;

a second matching unit, configured to match the to-be-loaded file with a legal class file and a legal compilation result file in the whitelist to obtain a second matching result;

A second determining unit, configured to determine whether the to-be-loaded file is safe based on the second matching result.

Based on any of the foregoing embodiments, the second matching unit is specifically configured to:

determining the intersection of the set of legal class files in the whitelist and the set of legal compilation result files;

When it is determined that all files to be loaded in the class loading process are included in the intersection, it is determined that the second matching result is a successful match;

When it is determined that the intersection set does not contain all the files to be loaded in the class loading process, it is determined that the second matching result is a matching failure.

Based on any of the foregoing embodiments, the apparatus further includes:

A scanning unit, configured to scan the deployment code, obtain legal files in the deployment code, and record the legal files in the whitelist.

Based on any of the foregoing embodiments, the apparatus further includes:

The third determining unit is configured to determine the class file inheriting the compilation specification in the legal file, and record the class file inheriting the compilation specification in the white list.

Based on any of the foregoing embodiments, the apparatus further includes:

A third obtaining unit, configured to obtain a legal compilation result file corresponding to the to-be-compiled file through the first monitoring point, and record the legal compilation result file in the white list.

Based on any of the foregoing embodiments, the second determining unit is specifically configured to:

When the second matching result is that the matching fails, it is determined that the to-be-loaded file is not safe;

When the second matching result is that the matching is successful, it is determined that the file to be loaded is safe.

Based on any of the foregoing embodiments, the first determining unit 603 is specifically configured to:

When the first matching result is a matching failure, it is determined that the to-be-compiled file is not safe;

When the first matching result is that the matching is successful, it is determined that the to-be-compiled file is safe.

FIG. 7 is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. As shown in FIG. 7 , the electronic device may include: a processor (processor) 710, a communication interface (Communications Interface) 720, a memory (memory) 730 and The communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 complete the communication with each other through the communication bus 740. The processor 710 can call the logic instruction in the memory 730 to execute the following method: obtain the to-be-compiled file read during the compilation process through the first monitoring point;

Matching the to-be-compiled file with the legal files included in the whitelist to obtain a first matching result;

Whether the to-be-compiled file is safe is determined based on the first matching result.

In addition, the above-mentioned logic instructions in the memory 730 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

In another aspect, the present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can Executing the security protection method provided by the above methods, the method includes: acquiring the to-be-compiled file read during the compilation process through the first monitoring point;

Matching the to-be-compiled file with the legal files included in the whitelist to obtain a first matching result;

Whether the to-be-compiled file is safe is determined based on the first matching result.

In another aspect, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, the computer program is implemented by a processor to execute the security protection method provided by the above methods, and the method includes: Obtain the to-be-compiled file read during the compilation process through the first monitoring point;

Matching the to-be-compiled file with the legal files included in the whitelist to obtain a first matching result;

Whether the to-be-compiled file is safe is determined based on the first matching result.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (13)

1. A method of safety protection, comprising:

acquiring a file to be compiled read in a compiling process through a first monitoring point;

matching the file to be compiled with a legal file included in a white list to obtain a first matching result;

and determining whether the file to be compiled is safe or not based on the first matching result.

2. The security protection method according to claim 1, wherein the matching the file to be compiled with a legal file included in a white list to obtain a first matching result includes:

when it is determined that the legal files included in the white list include all files to be compiled read in the compiling process, determining that the first matching result is successful in matching;

and when determining that the legal files included in the white list do not contain all the files to be compiled read in the compiling process, determining that the first matching result is matching failure.

3. The security protection method according to claim 1, wherein the white list further includes a legal class file inheriting the compilation specification and a legal compilation result file corresponding to the file to be compiled; the legal class file is a file in the legal file;

the method further comprises the following steps:

under the condition that the safety of the file to be compiled is determined based on the first matching result, the file to be loaded in the class loading process is obtained through a second monitoring point;

matching the file to be loaded with a legal class file and a legal compiling result file in the white list to obtain a second matching result;

and determining whether the file to be loaded is safe or not based on the second matching result.

4. The security protection method according to claim 3, wherein the matching the file to be loaded with the legal class file and the legal compilation result file in the white list to obtain a second matching result includes:

determining the intersection of the set of legal class files in the white list and the set of legal compiling result files;

when determining that the intersection contains all files to be loaded in the class loading process, determining that the second matching result is successful in matching;

and when determining that the intersection does not contain all files to be loaded in the class loading process, determining that the second matching result is matching failure.

5. The security protection method according to any one of claims 1 to 4, wherein before the matching the file to be compiled with the legal file included in the white list to obtain a first matching result, the method further comprises:

and scanning the deployment code to obtain a legal file in the deployment code, and recording the legal file in the white list.

6. The method of safeguarding according to claim 5, further comprising:

and determining a class file inheriting the compiling specification in the legal file, and recording the class file inheriting the compiling specification in the white list.

7. The security protection method according to claim 3, wherein before the matching the file to be loaded with the legal class file and the legal compilation result file in the white list to obtain a second matching result, the method further comprises:

and acquiring a legal compiling result file corresponding to the file to be compiled through the first monitoring point, and recording the legal compiling result file in the white list.

8. The security protection method according to claim 3, wherein the determining whether the file to be loaded is secure based on the second matching result comprises:

when the second matching result is matching failure, determining that the file to be loaded is unsafe;

and when the second matching result is successful matching, determining that the file to be loaded is safe.

9. The security protection method according to claim 1, wherein the determining whether the file to be compiled is secure based on the first matching result comprises:

when the first matching result is matching failure, determining that the file to be compiled is unsafe;

and when the first matching result is that the matching is successful, determining that the file to be compiled is safe.

10. A safety shield apparatus, comprising:

the first acquisition unit is used for acquiring the file to be compiled read in the compiling process through a first monitoring point;

the first matching unit is used for matching the file to be compiled with a legal file included in a white list to obtain a first matching result;

a first determining unit, configured to determine whether the file to be compiled is safe based on the first matching result.

11. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the security method of any of claims 1 to 9 when executing the program.

12. A non-transitory computer-readable storage medium having stored thereon a computer program, wherein the computer program, when executed by a processor, implements the security method of any of claims 1 to 9.

13. A computer program product having executable instructions stored thereon, which when executed by a processor cause the processor to implement a method of safeguarding as claimed in any one of claims 1 to 9.

Images