KR20170140049A - Method for detecting webshell, server and computer readable medium - Google Patents

Abstract

The present invention detects whether a webshell pattern exists in a source code of a file transmitted to a web server, and detects a webshell by executing the corresponding file in a suitable virtual browser environment when the webshell pattern is detected. A method for detecting a webshell performed in a webshell detecting server comprises the following steps of: monitoring network traffic of the web server; receiving the file transmitted to the web server among the network traffic; detecting whether the webshell pattern exists in the source code of the received file; executing the file when the webshell pattern is detected; and outputting an execution response code of the file and an execution screen of the file.

Description

METHOD FOR DETECTING WEBSHELL, SERVER AND COMPUTER READABLE MEDIUM,

The present invention relates to a method, server and computer readable medium for detecting a web shell.

Webshell is a web script file, such as an asp, jsp, or php file, created by a hacker to remotely execute commands against a web server. A hacker can use the vulnerability of a web server to upload a web shell to a web server, execute the corresponding web shell, browse the information of the target server, or browse and modify the web page source code.

A conventional web shell detection method includes a server based web shell detection method and a network based web shell detection method. Server-based web shell detection method is to detect WebShell pattern in web shell agent when new file is uploaded or changed in web root / upload directory after installing web shell agent on web server, setting web root / upload directory as detection directory to be. The network-based Web shell detection method uses a DPI (Deep Packet Inspection) function to detect a packet transmitted on the network from a defensive means at the network end such as Intrusion Prevention System (IPS) / Intrusion Detection System (IDS) / Web Application Firewall (WAF) To detect WebShell patterns.

However, since the Webshell pattern is not clearly distinguished from the general source code, the conventional server-based Webshell detection method has a problem that the false rate is extremely high. For example, the source code readdir, which reads directory information used in common development, could be detected in a pattern of Web shell detection.

Accordingly, in the conventional server-based web shell detection method, when an event occurs due to a web shell pattern, an administrator must directly check the source code to analyze whether the web shell is present, there was.

Since the network-based Web shell detection method analyzes and detects the web-shell status in units of network packets, it is difficult to promptly respond to the web-shell in the event of an incident caused by the web-shell.

Korean Patent No. 10-1068931 discloses a method of detecting presence or absence of a code related to a WebShell program in the source code of a Web program executed by a Web server and analyzing the result of the WebShell detection to provide the WebShell detection result information to the administrator .

We detect if a WebShell pattern exists in the source code of a file transmitted to the Web server. If a WebShell pattern is detected, we want to detect the WebShell by executing the file in a suitable virtual browser environment. It also outputs the execution response code of the executed file and the execution screen of the file or transmits it to the manager's device.

It is to be understood, however, that the technical scope of the present invention is not limited to the above-described technical problems, and other technical problems may exist.

According to another aspect of the present invention, there is provided a web shell detection method, including: monitoring network traffic of a web server; Receiving a file transmitted to the web server among the network traffic; Detecting whether a WebShell pattern exists in the source code of the received file; Executing the file if the web shell pattern is detected; And outputting an execution response code of the file and an execution screen of the file. The file may be a hypertext transfer protocol (HTTP) or a hypertext transfer protocol over secure sockets layer (HTTPS) traffic file written in a server side script language. The execution response code of the file may be a hypertext markup language (HTML) response code for the request. The execution screen of the file may be a browser UI screen of the HTML response to the request.

The step of executing the file may be a step of executing the file in a virtual browser environment in which the file can be executed among a plurality of virtual browsers.

The step of executing the file in a virtual browser environment capable of executing the file includes the steps of checking the extension of the file and copying the file to the virtual environment web root directory corresponding to the development language of the file based on the extension Step < / RTI > The step of executing the file in the virtual browser environment capable of executing the file may further include the step of requesting and executing the file copied to the virtual environment web root directory in the virtual browser capable of executing the file.

And transmitting an execution response code of the file and an execution screen of the file to a device of an administrator.

A web shell detection server according to a second aspect of the present invention includes: a network traffic analyzing unit for monitoring network traffic of a web server; A storage unit for storing a file transmitted to the web server among the network traffic; A WebShell pattern analyzer for detecting whether a WebShell pattern exists in a source code of the received file; An action-based analysis unit for executing the file when the WebShell pattern is detected; And an output unit for outputting an execution response code of the file and an execution screen of the file. The file may be a file written in the server side script language among HTTP or HTTPS traffic. The execution response code of the file may be an HTML response code for the request. The executable file of the file may be a browser UI screen of the HTML response to the request

The behavior-based analysis unit may include a plurality of virtual browsers, and may execute the file in a virtual browser capable of executing the file among the plurality of virtual browsers. The behavior-based analysis unit may further include an extension detection unit for checking an extension of the file. The behavior-based analysis unit may copy the file to a virtual environment web root directory corresponding to a development language of the file based on the extension. The behavior-based analysis unit may request and execute a file copied to the virtual environment web root directory with a virtual browser capable of executing the file.

And an execution response code of the file and an execution screen of the file to a device of an administrator.

When executed by the computing device according to the third aspect of the present invention, the computing device receives a file transmitted to the web server among the network traffic, detects whether a WebShell pattern exists in the source code of the received file, And when the WebShell pattern is detected, executing the file, and outputting an execution response code of the file and an execution screen of the file.

The above-described task solution is merely exemplary and should not be construed as limiting the present invention. In addition to the exemplary embodiments described above, there may be additional embodiments described in the drawings and the detailed description of the invention.

According to any one of the above-mentioned tasks, it is possible to provide various virtual browser environments suitable for execution of a file in which a WebShell pattern is detected. In addition, since the file in which the WebShell pattern is detected is executed in the virtual browser environment, the execution response code of the file and the execution screen of the file are provided to the device of the manager in response to the execution result. Therefore, And can save labor costs because there is no need for a separate management staff to detect Web shells.

1 is a configuration diagram of a web shell detection system according to an embodiment of the present invention.
2 is a block diagram of the WebShell detection server shown in FIG. 1, in accordance with an embodiment of the present invention.
3 is a view for explaining a method of executing a file in which a web shell pattern is detected according to an embodiment of the present invention.
4 is a diagram for explaining an execution response code of a file and an execution screen of a file according to an embodiment of the present invention.
5 is a flowchart illustrating a method of detecting a web shell by a web shell detection server according to an exemplary embodiment of the present invention.
6 is an operation flowchart illustrating a method of executing a file in which a WebShell pattern is detected according to an embodiment of the present invention.
7 is an operational flow diagram illustrating a method for detecting a WebShell executed by a computing device, in accordance with an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

In this specification, the term " part " includes a unit realized by hardware, a unit realized by software, and a unit realized by using both. Further, one unit may be implemented using two or more hardware, or two or more units may be implemented by one hardware.

In this specification, some of the operations or functions described as being performed by the terminal or the device may be performed in the server connected to the terminal or the device instead. Similarly, some of the operations or functions described as being performed by the server may also be performed on a terminal or device connected to the server.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings.

1 is a configuration diagram of a web shell detection system according to an embodiment of the present invention.

1, a web shell detection system may include any device 100, a web server 110, a web shell detection server 120, and a manager's device 130. However, since the web shell detection system of FIG. 1 is only an embodiment of the present invention, the present invention is not limited to FIG. 1 and may be configured differently from FIG. 1 according to various embodiments of the present invention.

Generally, the components of the web shell detection system of FIG. 1 are connected through a network (not shown). A network refers to a connection structure in which information can be exchanged between nodes such as terminals and servers. An example of such a network is Wi-Fi, Bluetooth, Internet, LAN Network, wireless LAN, WAN, PAN, 3G, 4G, 5G, LTE, and the like.

The web shell detection server 120 can perform web shell detection on a plurality of files transmitted to the web server 110. [ The web shell detection server 120 monitors in real time whether there is a file transmitted from the arbitrary device 100 to the web server 110 through the network traffic of the web server 110, , It is possible to detect whether there is a WebShell pattern in the file.

When the web shell pattern is detected in the file, the web shell detection server 120 executes the file in the virtual browser environment suitable for the extension of the file, outputs the execution response code of the file and the execution screen of the file, The execution response code of the file and the execution screen of the file.

Hereinafter, the operation of each component of the web shell detection system of FIG. 1 will be described in more detail.

FIG. 2 is a block diagram of the WebShell detection server 120 shown in FIG. 1, according to one embodiment of the present invention.

2, the web shell detection server 120 includes a network traffic analysis unit 200, a storage unit 210, a webshell pattern analysis unit 220, an behavior based analysis unit 230, an extension detection unit 240, A transmitter 250, a transmitter 260, and a DB 270. However, the web shell detection server 120 shown in FIG. 2 is only one embodiment of the present invention, and various modifications are possible based on the components shown in FIG.

The network traffic analyzing unit 200 may monitor the network traffic of the web server 110. For example, the network traffic analyzing unit 200 may periodically monitor whether a file such as a web application file, a web contents file, and the like processed by the web server 110 is transmitted to the web server 110.

The storage unit 210 may store a file transmitted to the web server 110 among the network traffic. Here, the file may be a file written in a server-side scripting language among hypertext transfer protocol (HTTP) or hypertext transfer protocol over secure sockets layer (HTTPS) traffic. The file may be a document written in various programming languages such as, for example, JavaScript, PHP, ASP, and the like.

The WebShell pattern analyzer 220 can detect whether a WebShell pattern exists in the source code of the received file. For example, the WebShell pattern analyzer 220 may detect a WebShell pattern in a source code of a file using a WebShell pattern list including a plurality of predetermined WebShell patterns.

The behavior-based analysis unit 230 can execute the corresponding file when the WebShell pattern is detected in the file. Specifically, the behavior-based analysis unit 230 may include a plurality of virtual browsers. The behavior-based analysis unit 230 can select a virtual browser capable of executing a file in which a WebShell pattern is detected among a plurality of virtual browsers. Here, the plurality of virtual browsers may be one-to-one correspondence to each of the plurality of web script files as a browser configured to be able to execute each of a plurality of web script files (for example, asp, jsp, php file, etc.). The behavior based analysis unit 230 may execute the file in the selected virtual browser environment.

A method of executing a file on a virtual browser will be described with reference to FIG. 3 for a while. 3 is a view for explaining a method of executing a file in which a web shell pattern is detected according to an embodiment of the present invention.

3, the behavior-based analysis unit 230 can select a virtual browser environment in which a corresponding file 300 can be executed from among a plurality of virtual browsers 320 for analysis of a file 300 in which a WebShell pattern is detected .

The behavior-based analysis unit 230 can check the extension of the file 300 in which the WebShell pattern is detected and select a virtual browser corresponding to the extension.

For example, if the extension of the file 300 in which the WebShell pattern is detected is asp, the behavior-based analysis unit 230 selects the ASP virtual browser to execute the file 300 in which the WebShell pattern is detected in the ASP virtual browser environment .

In another example, when the extension of the file 300 in which the WebShell pattern is detected is php, the behavior-based analysis unit 230 may execute the file 300 in which the WebShell pattern is detected in the PHP virtual browser environment.

Referring again to FIG. 2, the behavior-based analysis unit 230 may include an extension detection unit 240 for detecting an extension of a file in which a WebShell pattern is detected.

The behavior-based analysis unit 230 may copy or move the file to the virtual environment web root directory corresponding to the development language of the file based on the extension of the file in which the WebShell pattern is detected.

For example, if the extension of the file in which the WebShell pattern is detected is jsp, the behavior-based analysis unit 230 may copy or move the file to the virtual environment web root directory corresponding to jsp.

The behavior-based analysis unit 230 may execute a file copied to the virtual environment web root directory as a selected virtual browser. For example, the behavior-based analysis unit 230 can execute a file copied to a virtual environment web root directory corresponding to jsp in a JSP virtual browser environment.

The output unit 250 can output an execution response code of the file and an execution screen of the file. Here, the execution response code of the file and the execution screen of the file will be described with reference to FIG.

4 is a diagram for explaining an execution response code of a file and an execution screen of a file according to an embodiment of the present invention.

4, the output unit 250 may output the web shell detection screen 401, the file execution response code 403, and the execution screen 405 of the file output on the virtual browser as the execution result of the file . The web shell detection screen 401 includes Web shell detection details, and the execution response code 403 of the file includes information on a file request copied to the virtual environment web root directory to a virtual browser capable of executing a file among a plurality of virtual browsers (Hypertext markup language) response code, and the execution screen 405 of the file may be a browser UI screen of an HTML response to the request.

Referring again to FIG. 2, the transmitting unit 260 can transmit an execution response code of a file and an execution screen of a file to the manager's device 130. FIG. The sender 260 may further send the web shell detection details including the source code for the detected web shell to the device 130 of the administrator.

The DB 270 stores data input and output between the components of the web shell detection server 120 and outputs the input and output data to and from components outside the web shell detection server 120 and the web shell detection server 120 And stores the data. One example of such a DB 270 includes a hard disk drive, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash memory, a memory card, and the like, which are located inside or outside the Web Shell detection server 120.

Those skilled in the art will appreciate that the network traffic analysis unit 200, the storage unit 210, the WebShell pattern analysis unit 220, the behavior based analysis unit 230, the extension detection unit 240, the output unit 250, 260 and DB 270 may be separately implemented, or at least one of them may be implemented as an integrated system.

5 is an operational flow diagram illustrating a method for detecting a web shell by a web shell detection server 120, in accordance with an embodiment of the present invention.

The web shell detection method according to the embodiment shown in FIG. 5 includes steps that are processed in a time-series manner in the web shell detection server 120 according to the embodiment shown in FIG. 1 to FIG. Therefore, even if omitted below, the contents of the shell detection server 120 of FIGS. 1 to 4 can be applied to the web shell detection method according to the embodiment shown in FIG.

Referring to FIG. 5, in step S501, the web shell detection server 120 may monitor network traffic of the web server 110. FIG.

In step S503, the WebShell detection server 120 may receive a file transmitted to the web server 110 among the network traffic. Here, the file may be a file written in a server-side scripting language of HTTP or HTTPS traffic.

In step S505, the WebShell detection server 120 may detect whether a WebShell pattern exists in the source code of the received file.

In step S507, the WebShell detection server 120 can execute the file when the WebShell pattern is detected.

In step S509, the WebShell detection server 120 may output an execution response code of the file and an execution screen of the file as a result of execution of the file.

Although not shown in FIG. 5, in step S507, the WebShell detection server 120 may execute a file in a virtual browser environment capable of executing a file among a plurality of virtual browsers.

Although not shown in FIG. 5, after step S509, the WebShell detection server 120 may transmit an execution response code of a file and an execution screen of a file to the manager's device 130. FIG.

In the above description, steps S501 to S509 may be further divided into additional steps or combined into fewer steps, according to an embodiment of the present invention. Also, some of the steps may be omitted as necessary, and the order between the steps may be changed.

6 is an operation flowchart illustrating a method of executing a file in which a WebShell pattern is detected according to an embodiment of the present invention.

The file execution method according to the embodiment shown in FIG. 6 includes steps that are performed in a time-series manner in the WebShell detection server 120 according to the embodiment shown in FIGS. 1 to 5. Therefore, even if omitted below, the contents described with respect to the WebShell detection server 120 of FIGS. 1 to 5 can also be applied to the file execution method according to the embodiment shown in FIG.

Referring to FIG. 6, in step S601, the WebShell detection server 120 can confirm the extension of the file in which the WebShell pattern is detected.

In step S603, the web shell detection server 120 may copy or move the file to the virtual environment web root directory corresponding to the development language of the file, based on the file extension.

In step S605, the web shell detection server 120 can request and execute a file copied to the virtual environment web root directory in a virtual browser capable of executing a file.

In step S607, the web shell detection server 120 can output the execution response code of the file and the execution screen of the file as the execution result of the file. Here, the execution response code of the file is the HTML response code for the request (the file request copied to the virtual environment web root directory to the virtual browser), and the execution screen of the file may be the browser UI screen of the HTML response to the request.

In the above description, steps S601 to S607 may be further divided into additional steps, or combined into fewer steps, according to an embodiment of the present invention. Also, some of the steps may be omitted as necessary, and the order between the steps may be changed.

7 is an operational flow diagram illustrating a method for detecting a WebShell executed by a computing device, in accordance with an embodiment of the present invention.

The web shell detection method according to the embodiment shown in FIG. 7 includes the steps of time series processing in the web shell detection server 120 according to the embodiment shown in FIGS. 1 to 6. Therefore, even if omitted below, the contents described with respect to the WebShell detection server 120 of FIGS. 1 to 6 may be applied to the WebShell detection method according to the embodiment shown in FIG.

Referring to FIG. 7, in step S701, the computing device may execute an instruction to receive and store a file transmitted to the web server 110 among network traffic.

In step S703, when the file transmitted to the web server 110 is received, the computing device may execute an instruction to detect whether a WebShell pattern exists in the source code of the received file.

In step S705, if the WebShell pattern is detected, the computing device may execute an instruction to cause the file to be executed in a virtual browser environment capable of executing the file.

In step S707, the computing device may execute a command to output, as the execution result of the file, the execution response code of the file and the execution screen of the file.

In step S709, the computing device may execute a command to transfer the execution response code of the file and the executable image of the file to the manager's device 130. [

In the above description, steps S701 to S709 may be further divided into further steps or combined into fewer steps, according to an embodiment of the present invention. Also, some of the steps may be omitted as necessary, and the order between the steps may be changed.

One embodiment of the present invention may also be embodied in the form of a recording medium including instructions executable by a computer, such as program modules, being executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is intended that the present invention covers the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. .

100: any device
110: Web server
120: Web Shell detection server
130: Manager's device
140: File
200: network traffic analysis unit
210:
220: web shell pattern analysis unit
230: Behavior Based Analysis Unit
240: extension detector
250: Output section
260:

Claims (18)

A web shell detection method performed by a web shell detection server,
Monitoring network traffic of the web server;
Receiving a file transmitted to the web server among the network traffic;
Detecting whether a WebShell pattern exists in the source code of the received file;
Executing the file if the web shell pattern is detected; And
Outputting an execution response code of the file and an execution screen of the file
The web shell detection method comprising:
The method according to claim 1,
Wherein the file is a file written in a server-side scripting language of hypertext transfer protocol (HTTP) or hypertext transfer protocol over secure sockets layer (HTTPS) traffic.
The method according to claim 1,
Wherein the step of executing the file comprises:
And executing the file in a virtual browser environment capable of executing the file among a plurality of virtual browsers.
The method of claim 3,
The step of executing the file in a virtual browser environment capable of executing the file
Confirming an extension of the file; And
Copying the file to a virtual environment web root directory corresponding to a development language of the file based on the extension
The web shell detection method comprising:
5. The method of claim 4,
The step of executing the file in a virtual browser environment capable of executing the file
Requesting and executing a file copied to the virtual environment web root directory in a virtual browser capable of executing the file
The web shell detection method further comprising:
6. The method of claim 5,
Wherein the execution response code of the file is a hypertext markup language (HTML) response code for the request.
6. The method of claim 5,
Wherein the executable file of the file is a browser UI screen of an HTML response to the request.
The method according to claim 1,
Transmitting an execution response code of the file and an execution screen of the file to a device of an administrator
The web shell detection method further comprising:
In a web shell detection server,
A network traffic analyzing unit for monitoring network traffic of the web server;
A storage unit for storing a file transmitted to the web server among the network traffic;
A WebShell pattern analyzer for detecting whether a WebShell pattern exists in a source code of the received file;
An action-based analysis unit for executing the file when the WebShell pattern is detected; And
An output response unit for outputting an execution response code of the file and an execution screen of the file,
The web shell detection server comprising:
10. The method of claim 9,
Wherein the file is a file written in a server side script language of HTTP (hypertext transfer protocol) or HTTPS (hypertext transfer protocol over secure sockets layer) traffic.
10. The method of claim 9,
The behavior-based analysis unit
A plurality of virtual browsers,
Wherein the server executes the file in a virtual browser capable of executing the file among the plurality of virtual browsers.
12. The method of claim 11,
The behavior-based analysis unit
An extension detecting unit for checking an extension of the file,
Further comprising: a Web Shell detection server.
13. The method of claim 12,
The behavior-based analysis unit
And copying the file to a virtual environment web root directory corresponding to a development language of the file based on the extension.
14. The method of claim 13,
The behavior-based analysis unit
And requests and executes a file copied to the virtual environment web root directory in a virtual browser capable of executing the file.
15. The method of claim 14,
Wherein the execution response code of the file is a hypertext markup language (HTML) response code for the request.
15. The method of claim 14,
Wherein the executable file of the file is a browser UI screen of an HTML response to the request.
10. The method of claim 9,
An execution response code of the file and an execution screen of the file to the device of the administrator
Further comprising: a Web Shell detection server.
A computer readable medium comprising a sequence of instructions for detecting a web shell,
When executed by a computing device,
The computing device comprising:
Receiving a file transmitted to the web server among the network traffic,
Detecting whether a WebShell pattern exists in a source code of the received file,
Executing the file when the WebShell pattern is detected,
The execution response code of the file, and the execution image of the file.

Images