应用程序运行时防护技术的实现研究  

Research on the Implementation of Application Runtime Protection Technology

作　　者：刘旭 冯义磊 戴发玉 武梦娟 崔粉霞 LIU Xu;FENG Yilei;DAI Fayu;WU Mengjuan;CUI Fenxia(Beijing China Power Puhua Inform Ation Technology Co.,Ltd.,Beijing 100192,China)

机构地区：[1]北京中电普华信息技术有限公司,北京100192

出　　处：《移动信息》2024年第4期328-330,共3页MOBILE INFORMATION

基　　金：应用主动安全防御技术研究(TB123017192)。

摘　　要：文中重点介绍了应用程序运行时的自我防护机制,实现了满足信息化系统三级等保安全防护要求的应用系统安全防护能力。通过RASP安全防护理念,文中自研实现了一套应用运行时的安全防护组件,包括攻击监测、安全加固、安全检查、规则维护等功能。通过java探针技术的集成,满足安全模块对应用的无侵入集成方式。经过实验证明,该方法不但解决了web应用安全问题,且对性能无明显影响。This paper mainly introduces the self-protection mechanism of application program when it is running,and realizes the application system security protection ability that meets the third-class security protection requirements of information system.Through the concept of RASP security protection,a set of application runtime security protection components is developed,including attack monitoring,security reinforcement,security check,rule maintenance and other functions.Through the integration of java probe technology,the non-invasive integration mode of security module to application is satisfied.Experiments show that this method not only solves the security problem of web application,but also has no obvious influence on performance.

关 键 词：AGENT技术 RASP安全防护 应用运行时安全防护 

分 类 号：TP391.9[自动化与计算机技术—计算机应用技术]