CN105100065A - Cloud-based webshell attack detection method, cloud-based webshell attack detection device and gateway - Google Patents

Abstract

The invention discloses a cloud-based webshell attack detection method, a cloud-based webshell attack detection device and a gateway, relating to the technical field of internets. The cloud-based webshell attack detection method, the cloud-based webshell attack detection device and the gateway can solve the problem that deformed webshell attacks are difficult to identify in the prior art. The method disclosed by the invention comprises the following steps: intercepting and capturing a script file sent to a website server; detecting whether a pre-set characteristic deformation mark exists in the script file or not on the basis of a cloud platform, wherein the characteristic deformation mark is a mark generated by changing the form of a characteristic sentence in the script file; reducing the changed characteristic sentence according to a pre-set reducing rule if the characteristic deformation mark exists in the script file, wherein the reducing rule is an inverse rule of a characteristic deformation rule; detecting whether the reduced characteristic sentence is the same to a pre-set basic characteristic sentence, wherein the basic characteristic sentence is an attack sensitive sentence; and determining that the script file is a webshell attack file if the reduced characteristic sentence is the same to the basic characteristic sentence. The cloud-based webshell attack detection method, the cloud-based webshell attack detection device and the gateway disclosed by the invention are applicable to a scene that a hacker sends the webshell attack file to the website server.

Description

Cloud-based webshell attack detection method, device and gateway

technical field

The invention relates to the technical field of the Internet, in particular to a cloud-based webshell attack detection method, device and gateway.

Background technique

Webshell is a command execution that exists in the form of web files such as asp (active server pages, dynamic server pages), php (hypertext preprocessor, hypertext preprocessor), jsp (java server pages, java server pages) or cgi (commongateway interface, public gateway interface) environment. Since webshell is a web backdoor, it becomes a script attack tool for hackers to invade web servers. In practical applications, after a hacker has invaded a website, he usually mixes these asp or php and other backdoor files with the normal webpage files in the web directory of the website server, and then accesses these asp or php and other backdoor files through a browser. Thereby controlling the web server.

Therefore, protecting against webshell attacks is very important for website security. In the existing webshell attack detection technology, after the gateway obtains the script file externally sent to the website server, it determines whether there is a webshell attack by detecting whether there are basic attack characteristics in the script file. However, in order to avoid webshell attacks being detected, hackers have written many webshell attack methods with deformed features. For example, adding other non-letter symbols such as "%" and "*" to some feature strings, so that the feature strings become a new custom string. In this case, since the basic attack characteristics of webshell attacks have been disrupted, it is difficult to detect them according to the basic attack characteristics, so the detection of webshell attacks has become a major problem today.

Contents of the invention

In view of this, the present invention provides a cloud-based webshell attack detection method, device and gateway, which can solve the problem in the prior art that it is difficult to identify deformed webshell attacks.

In a first aspect, the present invention provides a cloud-based webshell attack detection method, the method comprising:

Intercept script files sent to the website server;

Detecting whether there is a preset feature deformation trace in the script file based on the cloud platform, the feature deformation trace is a trace produced by modifying the form of the feature statement in the script file;

If there are traces of the characteristic deformation in the script file, the modified characteristic sentence is restored according to a preset restoration rule, and the restoration rule is an inverse rule of the characteristic deformation rule;

Detecting whether the restored characteristic sentence is the same as the preset basic characteristic sentence, and the basic characteristic sentence is an attack sensitive sentence;

If the restored feature statement is the same as the basic feature statement, it is determined that the script file is a webshell attack file.

In a second aspect, the present invention provides a cloud-based webshell attack detection device, the device comprising:

An intercepting unit, configured to intercept script files sent to the website server;

The detection unit is used to detect whether there is a preset characteristic deformation trace in the script file intercepted by the intercepting unit based on the cloud platform, and the characteristic deformation trace is generated by modifying the form of the characteristic sentence in the script file trace;

A restoration unit, configured to restore the changed characteristic sentence according to a preset restoration rule when the detection unit detects that there are traces of the characteristic deformation in the script file, and the restoration rule is the inverse of the characteristic deformation rule rule;

The detection unit is also used to detect whether the characteristic sentence restored by the reduction unit is the same as the preset basic characteristic sentence, and the basic characteristic sentence is an attack-sensitive sentence;

A determination unit is configured to determine that the script file is a webshell attack file when the detection unit detects that the restored characteristic statement is identical to the basic characteristic statement.

In a third aspect, the present invention provides a cloud-based webshell attack detection gateway, where the gateway includes the device as described in the second aspect.

By means of the above-mentioned technical scheme, the cloud-based webshell attack detection method, device and gateway provided by the present invention can intercept the script file when the script file is sent to the website server externally, and perform feature deformation on the script file based on the cloud platform Trace detection, and then restore the modified characteristic statement, and finally compare the restored characteristic statement with the basic characteristic statement, if they are the same, it is determined that the script file is a webshell attack file. Compared with the detection method of only basic feature sentences in the prior art, the present invention restores the changed feature sentences first, so that the disrupted feature sentences are restored to the original feature sentences, and then the basic feature sentences are combined Comparison, so that the basic feature statement hidden in the script file is detected, thereby determining that the script file is a webshell attack file.

The above description is only an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention, it can be implemented according to the contents of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and understandable , the specific embodiments of the present invention are enumerated below.

Description of drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiment. The drawings are only for the purpose of illustrating a preferred embodiment and are not to be considered as limiting the invention. Also throughout the drawings, the same reference numerals are used to designate the same components. In the attached picture:

Fig. 1 shows a flow chart of a cloud-based webshell attack detection method provided by an embodiment of the present invention;

Fig. 2 shows a block diagram of a cloud-based webshell attack detection device provided by an embodiment of the present invention;

FIG. 3 shows a block diagram of another cloud-based webshell attack detection device provided by an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided for more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

Embodiments of the present invention provide a cloud-based webshell attack detection method, as shown in Figure 1, the method includes:

101. Intercepting the script file sent to the website server.

When the outside (including ordinary users, hackers, etc.) sends a script file to the website server, it needs to go through the gateway, so when the script file reaches the gateway, the gateway can intercept the script file so as to perform security detection on the script file , so as to ensure that the script files reaching the server side of the website are safe.

It should be noted that the above-mentioned script files can be asp (active server pages, dynamic server pages) files, php (hypertext preprocessor, hypertext preprocessor) files, jsp (java server pages, java server pages) files, cgi (commongateway interface, public gateway interface) files, or web files in other formats.

102. Based on the cloud platform, it is detected whether there are preset characteristic deformation traces in the script file.

Wherein, the feature deformation trace is a trace produced by modifying the form of the feature statement in the script file. The feature statement may be a statement at a typical position, such as a statement containing a function, or a statement with other characteristics, and may generally refer to an executable code statement.

Specifically, the characteristic deformation trace may be one or any combination of the following: comment statement, variable assignment character, preset characteristic character and preset characteristic function name. If the feature deformation trace includes only one content (such as only including the preset feature function name), the gateway will only detect the content of the script file; if the feature deformation trace includes at least two contents, the gateway will respectively check the script file Check each item. In practical applications, the gateway can sequentially detect all content in the feature deformation trace of the script file according to the preset detection order, or can simultaneously detect all content of the script file.

It should be noted that the cloud-based platform mentioned in this step mainly means that the gateway needs to obtain the latest feature deformation traces, restoration rules, and basic feature statements from the cloud platform before it can detect script files. Among them, the latest feature deformation traces, restoration rules, and basic feature sentences can be obtained directly from the cloud platform, or through the cloud platform to update the local feature deformation traces, restoration rules, and basic feature sentences. The method is not limited here.

103. If there are traces of characteristic deformation in the script file, restore the modified characteristic statement according to a preset restoration rule.

Among them, the restoration rule is the inverse rule of the feature deformation rule. When the gateway detects that there are traces of feature deformation in the script file, it means that the feature statement has been changed according to the preset feature deformation rules. At this time, the gateway can restore the modified feature sentence according to the inverse rule (restoration rule) of the feature deformation rule, so as to obtain the original (before modification) feature sentence, so as to perform the operations of subsequent steps 104 and 105 .

For example, the gateway detects a sentence as "e/*aaaa*/val($_POST['a']);", by matching with the preset characteristic deformation trace, it can be known that there is a characteristic deformation trace in the sentence, That is, the comment statement. The rule of this feature deformation is to add a comment sentence in the sentence, so the inverse rule (reverting rule) of this feature deformation rule is to delete the added comment sentence.

104. Detect whether the restored feature sentence is the same as the preset basic feature sentence.

Among them, the basic feature statement is an attack-sensitive statement, that is, a statement that can directly determine the presence of a webshell attack feature calculated by a programmer. After the modified feature sentence is restored through the restoration rule, the original feature sentence can be obtained. At this time, the gateway can judge whether the restored feature sentence is a preset basic feature by comparing it with the basic feature sentence statement, so as to determine whether the script file is a webshell attack file.

105. If the restored feature statement is the same as the basic feature statement, determine that the script file is a webshell attack file.

Since the basic characteristic sentence is an attack-sensitive sentence, when the gateway detects that the restored characteristic sentence is the same as the basic characteristic sentence, it can determine that the restored characteristic sentence is an attack-sensitive sentence, thereby knowing that there is an attack-sensitive sentence in the script file, Then it is determined that the script file is a webshell attack file. Conversely, when the gateway detects that the restored feature statement is different from the basic feature statement, it can be determined that the restored feature statement is not an attack-sensitive statement, thereby knowing that there is no attack-sensitive statement in the script file, and then determining that the script file is not a webshell attack file.

Exemplarily, the gateway detects that there are two kinds of characteristic deformation traces in "eval($/*xyz*/{“_P".“OST"}['op']);", which are comment sentences and preset characteristic characters , so the gateway needs to restore it according to the restoration rules of the corresponding feature deformation traces. In practical applications, the restoration rules for comment statements and preset characteristic characters are all deletion operations, so after deleting both comment statements and preset characteristic characters, the restored characteristic statement obtained is "eval($_POST['op ']);". Comparing the characteristic statement with the basic characteristic statement can determine whether the script file is a webshell attack file. If the basic feature statement contains "eval($_POST['op']);", the restored feature statement is the same as the basic feature statement, so that the script file is a webshell attack file; if the basic feature statement does not contain "eval($_POST['op']);", the restored characteristic statement is different from the basic characteristic statement, so it is necessary to continue to judge other characteristic statements in the script file to determine whether the script file is a webshell attack file.

It should be noted that, in practical applications, only when the gateway determines that the script file intercepted by it is not a webshell attack file, it continues to upload the script file to the website server, and when the script file is a webshell attack file, no longer The script file is uploaded to the website server, thereby ensuring that the script file uploaded to the website server is a safe file.

The cloud-based webshell attack detection method provided by the embodiment of the present invention can intercept the script file when the script file is sent to the website server externally, and first detect the characteristic deformation trace of the script file based on the cloud platform, and then convert the modified The characteristic statement is restored, and finally the restored characteristic statement is compared with the basic characteristic statement. If they are the same, the script file is determined to be a webshell attack file. Compared with the detection method of only basic feature sentences in the prior art, the present invention restores the changed feature sentences first, so that the disrupted feature sentences are restored to the original feature sentences, and then the basic feature sentences are combined Comparison, so that the basic feature statement hidden in the script file is detected, thereby determining that the script file is a webshell attack file.

Further, according to the above method embodiment, when the preset characteristic deformation trace only contains one kind of characteristic deformation trace, the gateway only detects whether the characteristic deformation trace exists in the script file; when the preset characteristic deformation trace includes multiple When the feature deformation traces are detected, the gateway will simultaneously detect whether the multiple feature deformation traces exist in the script file, or detect whether the multiple feature deformation traces exist in the script file in sequence. After the feature deformation traces are detected, the modified feature sentences need to be restored. However, there are different restoration methods for different types of feature deformation traces. The following is an introduction for different situations:

Situation 1: When the feature deformation trace includes a comment statement, the gateway will detect whether there is a comment statement in the script file based on the cloud platform. If there is a comment statement in the script file, delete the comment statement; if there is no comment statement in the script file, then there is no need to delete the comment statement.

Since the comment statement does not participate in the execution of the program, when a hacker adds a comment statement to a feature statement, the function of the feature statement itself will not be affected. When the feature statement is a basic feature statement, the script file is a webshell attack file. However, after the comment statement is added to the feature statement, the changed feature statement is no longer the same as the basic feature statement. Therefore, the added comment statement needs to be deleted to obtain the original feature statement in order to detect the essence more accurately. The above statement is the same as the basic feature statement, so as to avoid the phenomenon of missed detection of webshell attack files.

In practical applications, the detection of comment statements is mainly through the detection of comment marks, for example: "//", "/*", "*/" and so on. For example, if the gateway detects that a feature statement "eva/*xxxxx*/l($_POST['a']);" contains "/*" and "*/" annotations, it will carry the annotations with annotations Delete, so as to obtain the statement before adding the comment statement, that is, "eval($_POST['a']);". After obtaining the feature sentence before modification, compare it with the basic feature sentence. If the basic feature statement contains "eval($_POST['a']);", the restored feature statement is the same as the basic feature statement, so that the script file is a webshell attack file; if the basic feature statement does not contain "eval($_POST['a']);", the restored characteristic statement is different from the basic characteristic statement, so it is necessary to continue to judge other characteristic statements in the script file to determine whether the script file is a webshell attack file.

Case 2: When the feature deformation traces include variable assignment characters, the gateway will detect whether there are variable assignment characters in the script file based on the cloud platform. If there is a variable assignment character in the script file, the assigned variable will be restored; if there is no variable assignment character in the script file, there is no need to restore the variable.

In practical applications, programmers often assign values to the variables in the feature statement, that is, replace the old variable with a new variable, so that the form of the feature statement changes, but the actual function remains unchanged. In this case, it is impossible to detect its hidden webshell attack characteristics only by comparing the characteristic statement after variable assignment with the basic characteristic statement. Therefore, the gateway needs to restore the assigned variable first to obtain the original characteristic statement, and then it can accurately determine whether the characteristic statement is a basic characteristic statement, thereby correctly judging whether the script file is a webshell attack file.

Specifically, the variable assignment characters mainly include variable assignment identifiers, namely "=", and may also include other characters with assignment functions, which are not limited here.

For example, the script file has the following code:

$aaa=e;

$bbb = v;

$ccc = a;

$ddd = l;

$xsser = $_POST['op'];

"$aaa"."$bbb"."$ccc"."$ddd"($xsser);

The gateway detects the variable characteristic character (that is, "=") in the above code, and detects the $ aaa, $bbb, $ccc, $ddd, and $xsser are new variables assigned to e, v, a, l, and $_POST['op'] respectively, so the gateway needs to restore these new variables to the original variables, restore The following code becomes "eval($_POST['op']);", and then compares this characteristic statement with the basic characteristic statement. If the basic feature statement contains "eval($_POST['op']);", the script file is a webshell attack file; if the basic feature statement does not contain "eval($_POST['op']);", It is necessary to continue to judge other characteristic statements in the script file to determine whether the script file is a webshell attack file.

Case 3: When the characteristic deformation trace includes preset characteristic characters, the gateway will detect whether there are preset characteristic characters in the script file based on the cloud platform. If the preset characteristic characters exist in the script file, the preset characteristic characters are deleted; if the preset characteristic characters do not exist in the script file, the operation of deleting the preset characteristic characters does not need to be performed.

In practical applications, hackers often scramble a complete function name or variable name by adding characters such as splicing characters in the feature statement, so that the webshell attack characteristics existing in the feature statement cannot be detected only through the basic feature statement. Therefore, it is necessary to restore the characteristic statement containing the preset characteristic characters, so as to further detect whether the characteristic statement is a statement containing webshell attack characteristics, thereby judging whether the script file is a webshell attack file.

For example, the gateway detects that ""e". "v". "a". "l"($_POST['a']);" contains splicing double quotes and dots, so the double quotes in the feature statement After the and point are deleted, the original statement can be obtained, namely "eval($_POST['a']);". At this point, compare "eval($_POST['a']);" with the basic feature statement, if the basic feature statement contains "eval($_POST['a']);", then the script file is webshell For an attack file, if the basic feature statement does not contain "eval($_POST['a']);", you need to continue to judge other feature statements in the script file to determine whether the script file is a webshell attack file.

Situation 4: When the feature deformation trace includes the preset feature function name, the gateway will detect whether the preset feature function name exists in the script file based on the cloud platform. If there is a preset feature function name in the script file, the statement corresponding to the feature function is restored according to the inverse function of the feature function function; if there is no preset feature function name in the script file, there is no need to restore the feature function.

In practical applications, hackers often use some special functions to transform the feature statement, so that the function of the feature statement itself does not change, but only through the basic feature statement, it is often impossible to detect its hidden webshell attack features. Therefore, the gateway needs to restore the characteristic statement changed by the characteristic function before it can more accurately detect the hidden webshell attack characteristics, thereby completing the identification of the webshell attack file.

Specifically, the preset feature function names include str_replace, preg_replace, pack, chr, base64_decode, strrev, str_rot13, rot_13, create_function, urldecode, strtr, gzuncompress, gzinflate, and gzdecode. The feature function corresponding to each feature function name has a certain function, so the gateway can restore the changed feature sentence through the inverse function of the feature function function, so as to obtain the original feature sentence for subsequent basic feature sentence detection.

For example, the script file has the following code

$abcd = str_repalce("abc", "eva", "abcl");

$abcd($_POST['a']);

The gateway detects that str_repalce exists in the above code, and the str_repalce function implemented in this statement is: replace abc in abcl with eva, so "$abcd($_POST['a']);" is actually " eval($_POST['a']);". It can be seen from this that it is necessary to use the inverse function of the str_repalce function to restore "$abcd($_POST['a']);" to obtain "eval($_POST['a']);", and then "eval( $_POST['a']);" is compared with the basic feature statement. If the basic feature statement includes eval($_POST['a']);", then the script file is a webshell attack file; if the basic feature statement does not include eval($_POST['a']);", then it cannot According to the above code, it is judged that the script file is a webshell attack file.

As another example, the script file has the following code

$xxyz = strtr("exyz", "xyz", "val");

$xxyz($_POST['a']);

The gateway detects that strtr exists in the above code, and the function of strtr function in this statement is: replace x, y, and z in exyz with v, a, and l respectively, so "$xxyz($_POST['a ']);" is actually "eval($_POST['a']);". It can be seen from this that it is necessary to use the inverse function of the strtr function to restore "$xxyz($_POST['a']);" to obtain "eval($_POST['a']);", and then "eval( $_POST['a']);" is compared with the basic feature statement. If the basic feature statement includes eval($_POST['a']);", then the script file is a webshell attack file; if the basic feature statement does not include eval($_POST['a']);", then it cannot According to the above code, it is judged that the script file is a webshell attack file.

Furthermore, before detecting whether there are preset feature deformation traces in the script file, the gateway side needs to obtain the feature deformation traces, restoration rules and basic feature statements before performing subsequent detection or restoration operations.

Specifically, since the cloud platform side stores webshell attack files appearing in different websites, the cloud platform side has the most complete feature deformation traces, restoration rules and basic feature sentences related to webshell attacks. Therefore, the gateway can obtain the latest feature deformation traces, restoration rules and basic feature statements from the cloud platform.

Specifically, if the gateway does not have feature deformation traces, restoration rules, and basic feature statements locally, the gateway can obtain the latest feature deformation traces, restoration rules, and The file of the basic feature statement; if there are feature deformation traces, restoration rules, and basic feature sentences locally in the gateway, the gateway can directly update the local feature deformation traces, restoration rules, and basic feature sentences through the cloud platform, for example, by obtaining updates from the cloud platform package to update local feature deformation traces, restoration rules, and basic feature statements.

In addition, in practical applications, after the gateway intercepts the script file, it can directly report the script file to the cloud platform, let the cloud platform use the above detection method to detect the script file, and then send the detection result to the gateway, so that the gateway can determine the script file. Whether the script file can continue to be sent to the web server.

Furthermore, since the cloud platform side needs to continuously update and improve the local feature deformation traces, restoration rules and basic feature statement files, after the gateway determines that the script file is a webshell attack file, it needs to report the detected results to the cloud platform. The webshell script file, so that the cloud platform can update the files of feature deformation traces, restoration rules and basic feature statements.

Further, according to the above-mentioned method embodiment, the embodiment of the present invention also provides a cloud-based webshell attack detection device, as shown in Figure 2, the device includes: an interception unit 21, a detection unit 22, a restoration unit 23 and a determination unit twenty four. in,

An intercepting unit 21, configured to intercept the script file sent to the website server;

The detection unit 22 is used to detect whether there is a preset feature deformation trace in the script file intercepted by the interception unit 21 based on the cloud platform, and the feature deformation trace is a trace produced by modifying the form of the feature sentence in the script file;

The restoration unit 23 is used to restore the changed characteristic sentence according to the preset restoration rule when the detection unit 22 detects that there are characteristic deformation traces in the script file, and the restoration rule is the inverse rule of the characteristic deformation rule;

The detection unit 22 is also used to detect whether the characteristic sentence restored by the reduction unit 23 is the same as the preset basic characteristic sentence, and the basic characteristic sentence is an attack sensitive sentence;

The determination unit 24 is configured to determine that the script file is a webshell attack file when the detection unit 22 detects that the restored characteristic statement is identical to the basic characteristic statement.

Further, the characteristic deformation trace detected by the detection unit 22 is one or any combination of the following:

Comment statement, variable assignment character, default characteristic character and default characteristic function name.

Specifically, as shown in Figure 3, the detection unit 22 includes:

The first detection module 221 is used to detect whether there is an annotation sentence in the script file based on the cloud platform when the feature deformation trace includes the annotation sentence;

Reducing unit 23, comprising:

The first deletion module 231 is configured to delete the comment statement when there is a comment statement in the script file.

Further, as shown in Figure 3, the detection unit 22 includes:

The second detection module 222 is used to detect whether there is a variable assignment character in the script file based on the cloud platform when the characteristic deformation trace includes a variable assignment character;

Reducing unit 23, comprising:

The first restoration module 232 is configured to restore the assigned variable when there is a variable assignment character in the script file.

Further, as shown in Figure 3, the detection unit 22 includes:

The third detection module 223 is used to detect whether there is a preset feature character in the script file based on the cloud platform when the feature deformation trace includes a preset feature character;

Reducing unit 23, comprising:

The second deletion module 233 is configured to delete the preset characteristic characters when there are preset characteristic characters in the script file.

Further, as shown in Figure 3, the detection unit 22 includes:

The fourth detection module 224 is used to detect whether there is a preset feature function name in the script file based on the cloud platform when the feature deformation trace includes a preset feature function name;

Reducing unit 23, comprising:

The second restoration module 234 restores the statement corresponding to the characteristic function according to the inverse function of the characteristic function when there is a preset characteristic function name in the script file.

Further, as shown in Figure 3, the device further includes:

Acquisition unit 25, used to obtain feature deformation traces, restoration rules and basic feature sentences from the cloud platform before detection unit 22 detects whether there are preset feature deformation traces in the script file;

The update unit 26 is configured to update the local cached feature deformation traces, restoration rules and basic feature sentences through the cloud platform before the detection unit 22 detects whether there are preset feature deformation traces in the script file.

Further, as shown in Figure 3, the device further includes:

The reporting unit 27 is configured to report the script file to the cloud platform after the determining unit 24 determines that the script file is a webshell attack file.

The cloud-based webshell attack detection device provided by the embodiment of the present invention can intercept the script file when the script file is sent to the website server externally, and first detect the characteristic deformation trace of the script file based on the cloud platform, and then convert the modified The characteristic statement is restored, and finally the restored characteristic statement is compared with the basic characteristic statement. If they are the same, the script file is determined to be a webshell attack file. Compared with the detection method of only basic feature sentences in the prior art, the present invention restores the changed feature sentences first, so that the disrupted feature sentences are restored to the original feature sentences, and then performs the detection with the basic feature sentences Comparison, so that the basic feature statement hidden in the script file is detected, thereby determining that the script file is a webshell attack file.

Further, according to the above device embodiment, the embodiment of the present invention also provides a cloud-based webshell attack detection gateway, which includes the device shown in FIG. 2 or 3 .

The cloud-based webshell attack detection gateway provided by the embodiment of the present invention can intercept the script file when the script file is sent to the website server externally, and first detect the characteristic deformation trace of the script file based on the cloud platform, and then convert the modified The characteristic statement is restored, and finally the restored characteristic statement is compared with the basic characteristic statement. If they are the same, the script file is determined to be a webshell attack file. Compared with the detection method of only basic feature sentences in the prior art, the present invention restores the changed feature sentences first, so that the disrupted feature sentences are restored to the original feature sentences, and then performs the detection with the basic feature sentences Comparison, so that the basic feature statement hidden in the script file is detected, thereby determining that the script file is a webshell attack file.

Embodiments of the invention disclose:

A1, a cloud-based webshell attack detection method, said method comprising:

Intercept script files sent to the website server;

Detecting whether there is a preset feature deformation trace in the script file based on the cloud platform, the feature deformation trace is a trace produced by modifying the form of the feature statement in the script file;

If there are traces of the characteristic deformation in the script file, the modified characteristic sentence is restored according to a preset restoration rule, and the restoration rule is an inverse rule of the characteristic deformation rule;

Detecting whether the restored characteristic sentence is the same as the preset basic characteristic sentence, and the basic characteristic sentence is an attack sensitive sentence;

If the restored feature statement is the same as the basic feature statement, it is determined that the script file is a webshell attack file.

A2. According to the method described in A1, the characteristic deformation traces are one or any combination of the following:

Comment statements, variable assignment characters, default signature characters, and preset signature function names.

A3. According to the method described in A2, if the feature deformation trace includes a comment statement, then the cloud-based platform detects whether there is a preset feature deformation trace in the script file, including:

Detecting whether the comment statement exists in the script file based on the cloud platform;

If there are traces of the characteristic deformation in the script file, the modified characteristic statement is restored according to the preset restoration rules, including:

If the comment statement exists in the script file, then delete the comment statement.

A4. According to the method described in A2, if the feature deformation traces include variable assignment characters, then the cloud-based platform detects whether there are preset feature deformation traces in the script file, including:

Detecting whether the variable assignment character exists in the script file based on the cloud platform;

If there are traces of the characteristic deformation in the script file, the modified characteristic statement is restored according to the preset restoration rules, including:

If the variable assignment character exists in the script file, the assigned variable is restored.

A5. According to the method described in A2, if the feature deformation traces include preset feature characters, then the cloud-based platform detects whether there are preset feature deformation traces in the script file, including:

Detecting whether the preset characteristic characters exist in the script file based on the cloud platform;

If there are traces of the characteristic deformation in the script file, the modified characteristic statement is restored according to the preset restoration rules, including:

If the preset characteristic character exists in the script file, then delete the preset characteristic character.

A6. According to the method described in A2, if the feature deformation trace includes a preset feature function name, then the cloud-based platform detects whether there is a preset feature deformation trace in the script file, including:

Detecting whether the preset feature function name exists in the script file based on the cloud platform;

If there are traces of the characteristic deformation in the script file, the modified characteristic statement is restored according to the preset restoration rules, including:

If the preset feature function name exists in the script file, the statement corresponding to the feature function is restored according to the inverse function of the feature function.

A7. According to the method described in any one of A1 to A6, before the detection of whether there are preset characteristic deformation traces in the script file, the method further includes:

Obtaining the feature deformation trace, the restoration rule, and the basic feature statement from the cloud platform;

Or, update the locally cached feature deformation traces, the restoring rules, and the basic feature sentences through the cloud platform.

A8, according to the method described in any one in A1 to A6, after described determining described script file is webshell attack file, described method further comprises:

Reporting the script file to the cloud platform.

B9, a cloud-based webshell attack detection device, said device comprising:

An intercepting unit, configured to intercept script files sent to the website server;

The detection unit is used to detect whether there is a preset characteristic deformation trace in the script file intercepted by the intercepting unit based on the cloud platform, and the characteristic deformation trace is generated by modifying the form of the characteristic sentence in the script file trace;

A restoration unit, configured to restore the changed characteristic sentence according to a preset restoration rule when the detection unit detects that there are traces of the characteristic deformation in the script file, and the restoration rule is the inverse of the characteristic deformation rule rule;

The detection unit is also used to detect whether the characteristic sentence restored by the reduction unit is the same as the preset basic characteristic sentence, and the basic characteristic sentence is an attack-sensitive sentence;

A determination unit is configured to determine that the script file is a webshell attack file when the detection unit detects that the restored characteristic statement is identical to the basic characteristic statement.

B10. According to the device described in B9, the characteristic deformation trace detected by the detection unit is one or any combination of the following:

Comment statement, variable assignment character, default characteristic character and default characteristic function name.

B11, according to the device described in B10, the detection unit includes: a first detection module, used to detect whether the annotation exists in the script file based on the cloud platform when the characteristic deformation trace includes an annotation sentence statement;

The reduction unit includes:

The first deletion module is configured to delete the comment statement when the comment statement exists in the script file.

B12. According to the device described in B10, the detection unit includes:

The second detection module is used to detect whether the variable assignment character exists in the script file based on the cloud platform when the characteristic deformation trace includes a variable assignment character;

The reduction unit includes:

The first restoration module is configured to restore the assigned variable when the variable assignment character exists in the script file.

B13, according to the device described in B10, the detection unit includes:

The third detection module is used to detect whether the preset characteristic characters exist in the script file based on the cloud platform when the characteristic deformation traces include preset characteristic characters;

The reduction unit includes:

The second deletion module is configured to delete the preset characteristic characters when the preset characteristic characters exist in the script file.

B14, according to the device described in B10, the detection unit includes:

The fourth detection module is used to detect whether the preset feature function name exists in the script file based on the cloud platform when the feature deformation trace includes a preset feature function name;

The reduction unit includes:

The second restoration module restores the statement corresponding to the characteristic function according to the inverse function of the characteristic function when the preset characteristic function name exists in the script file.

B15. The device according to any one of B9 to B14, further comprising:

An acquisition unit, configured to acquire the feature deformation trace, the restoration rule, and the basic feature statement from the cloud platform before the detection unit detects whether there is a preset feature deformation trace in the script file;

An update unit, configured to update the locally cached traces of deformation of the features, the restoration rules, and the basic features through the cloud platform before the detection unit detects whether there are preset traces of deformation of the features in the script file statement.

B16. The device according to any one of B9 to B14, said device further comprising:

A reporting unit is configured to report the script file to the cloud platform after the determining unit determines that the script file is a webshell attack file.

C17, a kind of webshell attack detection gateway based on cloud, described gateway comprises the device as described in any one in B9 to B16.

In the foregoing embodiments, the descriptions of each embodiment have their own emphases, and for parts not described in detail in a certain embodiment, reference may be made to relevant descriptions of other embodiments.

It can be understood that related features in the above methods and devices can refer to each other. In addition, "first", "second" and so on in the above embodiments are used to distinguish each embodiment, and do not represent the advantages and disadvantages of each embodiment.

Those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described system, device and unit can refer to the corresponding process in the foregoing method embodiment, which will not be repeated here.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other device. Various generic systems can also be used with the teachings based on this. The structure required to construct such a system is apparent from the above description. Furthermore, the present invention is not specific to any particular programming language. It should be understood that various programming languages can be used to implement the content of the present invention described herein, and the above description of specific languages is for disclosing the best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, in order to streamline this disclosure and to facilitate an understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together in a single embodiment, figure, or its description. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and arranged in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including accompanying claims, abstract and drawings) and any method or method so disclosed may be used in any combination, except that at least some of such features and/or processes or units are mutually exclusive. All processes or units of equipment are combined. Each feature disclosed in this specification (including accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) can be used in practice to implement the state detection method, device, server, and system device of a portable electronic anti-lost device according to an embodiment of the present invention. Some or all of the functions of some or all of the components. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Claims (10)

1. A cloud-based webshell attack detection method is characterized by comprising the following steps:

intercepting a script file sent to a website server;

detecting whether a preset characteristic deformation trace exists in the script file or not based on a cloud platform, wherein the characteristic deformation trace is a trace generated by changing the form of a characteristic statement in the script file;

if the feature deformation trace exists in the script file, reducing the changed feature statement according to a preset reduction rule, wherein the reduction rule is an inverse rule of the feature deformation rule;

detecting whether the restored characteristic statement is the same as a preset basic characteristic statement or not, wherein the basic characteristic statement is an attack sensitive statement;

and if the restored characteristic statement is the same as the basic characteristic statement, determining that the script file is a webshell attack file.

2. The method of claim 1, wherein the characteristic deformation trace is a combination of one or any plurality of:

comment statements, variable assignment characters, preset feature characters, and preset feature function names.

3. The method according to claim 2, wherein if the feature deformation trace comprises an annotation statement, the cloud-based platform detecting whether a preset feature deformation trace exists in the script file comprises:

detecting whether the annotation statement exists in the script file based on the cloud platform;

if the feature deformation trace exists in the script file, restoring the changed feature statement according to a preset restoring rule, including:

and if the comment statement exists in the script file, deleting the comment statement.

4. The method according to claim 2, wherein if the feature deformation trace includes a variable assignment character, the detecting whether a preset feature deformation trace exists in the script file based on the cloud platform includes:

detecting whether the variable assignment characters exist in the script file or not based on the cloud platform;

if the feature deformation trace exists in the script file, restoring the changed feature statement according to a preset restoring rule, including:

if the variable assignment character exists in the script file, the assigned variable is restored.

5. The method according to claim 2, wherein if the feature deformation trace includes a preset feature character, the detecting whether a preset feature deformation trace exists in the script file based on the cloud platform includes:

detecting whether the preset characteristic characters exist in the script file or not based on the cloud platform;

if the feature deformation trace exists in the script file, restoring the changed feature statement according to a preset restoring rule, including:

and if the preset characteristic character exists in the script file, deleting the preset characteristic character.

6. The method according to claim 2, wherein if the feature transformation trace includes a preset feature function name, the detecting whether a preset feature transformation trace exists in the script file based on the cloud platform includes:

detecting whether the preset feature function name exists in the script file or not based on the cloud platform;

if the feature deformation trace exists in the script file, restoring the changed feature statement according to a preset restoring rule, including:

if the preset feature function name exists in the script file, restoring the statement corresponding to the feature function according to the inverse function of the feature function.

7. The method according to any one of claims 1 to 6, wherein before said detecting whether there is a preset feature deformation trace in the script file, the method further comprises:

obtaining the feature deformation trace, the reduction rule and the basic feature statement from the cloud platform;

or updating the locally cached feature deformation trace, the reduction rule and the basic feature statement through the cloud platform.

8. The method of any of claims 1-6, wherein after the determining that the script file is a webshell attack file, the method further comprises:

and reporting the script file to the cloud platform.

9. A cloud-based webshell attack detection apparatus, the apparatus comprising:

the intercepting unit is used for intercepting script files sent to the website server;

the detection unit is used for detecting whether preset characteristic deformation traces exist in the script file intercepted by the interception unit based on a cloud platform, wherein the characteristic deformation traces are traces generated by changing the form of characteristic sentences in the script file;

the restoring unit is used for restoring the changed feature statement according to a preset restoring rule when the detecting unit detects that the feature deformation trace exists in the script file, wherein the restoring rule is an inverse rule of the feature deformation rule;

the detection unit is further configured to detect whether the feature statement restored by the restoration unit is the same as a preset basic feature statement, where the basic feature statement is an attack-sensitive statement;

and the determining unit is used for determining that the script file is a webshell attack file when the detecting unit detects that the restored characteristic statement is the same as the basic characteristic statement.

10. A cloud-based webshell attack detection gateway, comprising the apparatus of claim 9.