WO2016127858A1 - 网页入侵脚本特征的识别方法及设备 - Google Patents

网页入侵脚本特征的识别方法及设备 Download PDF

Info

Publication number
WO2016127858A1
WO2016127858A1 PCT/CN2016/073148 CN2016073148W WO2016127858A1 WO 2016127858 A1 WO2016127858 A1 WO 2016127858A1 CN 2016073148 W CN2016073148 W CN 2016073148W WO 2016127858 A1 WO2016127858 A1 WO 2016127858A1
Authority
WO
WIPO (PCT)
Prior art keywords
webpage
script
tested
feature
vector
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/073148
Other languages
English (en)
French (fr)
Inventor
周燃
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Publication of WO2016127858A1 publication Critical patent/WO2016127858A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements

Definitions

  • the present application relates to the field of communications and computers, and in particular, to a method and a device for identifying a webpage intrusion script feature.
  • Webshell intrusion script refers to a combination of specific string content that is harmful in web scripts, which can lead to serious consequences such as website attacks and data leakage.
  • a webpage intrusion script is a Trojan backdoor of ASP (Active Server Page) or PHP (Hypertext Preprocessor). After a hacker invades a website, they often use these ASPs.
  • the PHP Trojan backdoor file is placed in the web directory of the web server and mixed with the normal web file.
  • the hacker can use the web (web) to control the web server through the ASP or PHP Trojan backdoor, including uploading and downloading files, viewing The database, the execution of arbitrary program commands, etc., and then through the dos command or the implantation of the backdoor Trojan through the server vulnerability to achieve the purpose of lifting rights.
  • web page intrusion script features are those that are harmful. According to the characteristics of the webpage intrusion script, the webpage script can be divided into multiple feature types.
  • the purpose of the application is to provide a webpage intrusion script with low memory usage and fast recognition speed. Identification method of the sign.
  • the present application provides a method for identifying a feature of a webpage intrusion script, wherein the method for identifying includes:
  • mapping the reference webpage script to a reference vector of the multi-dimensional space and mapping the to-be-tested webpage script to the multi-dimensional space to be tested are based on the same mapping rule.
  • mapping the reference webpage script to the reference vector of the multi-dimensional space based on the feature information of each reference webpage script includes:
  • a set of feature values for each of the reference webpage scripts is mapped to a reference vector of the multidimensional space.
  • sampling and quantifying features of the reference webpage script includes:
  • the characters of the intercepted reference webpage script are sampled and quantized to obtain a set of feature values of the reference webpage script.
  • the character values sequentially assigned to the characters intercepted from the reference webpage script include:
  • sampled characters of the reference webpage script are quantized into corresponding feature values according to an ASCII code rule.
  • the identifying method further includes:
  • the webpage intrusion script feature type of the webpage script to be tested is determined by using a reference webpage script remaining after intercepting from each of the reference webpage scripts.
  • the identifying method further includes:
  • the reference web script remaining after intercepting from each of the reference webpage scripts is processed and stored using a regular expression.
  • mapping the to-be-tested webpage script to the multi-dimensional space to be tested based on the feature information of the webpage script to be tested includes:
  • sampling and quantifying features of the webpage script to be tested includes:
  • the character of the intercepted webpage script to be tested is sampled and quantized to obtain a feature value set of the webpage script to be tested.
  • sampling and quantifying the characters of the intercepted webpage script to be tested includes:
  • the sampled characters of the web page to be tested are quantized into corresponding feature values according to an ASCII code rule.
  • dividing the multi-dimensional space comprises:
  • a classification algorithm is used to obtain a distribution model of the assignment in the multidimensional space.
  • the classification algorithm comprises a support vector machine algorithm.
  • the distribution model of the assignment in the multi-dimensional space comprises a plurality of multi-dimensional functional relationship groups.
  • determining, according to the distribution model of the assignment in the multi-dimensional space, that the mapping of the vector to be tested is mapped in the multi-dimensional space comprises:
  • the assignment of the vector to be tested is substituted into the plurality of multi-dimensional function relationship groups, and the assignment corresponding to the vector to be tested is mapped in the multi-dimensional space by using the analytic geometry principle.
  • the webpage intrusion script feature type includes one or any combination of a normal type, an abnormal type, and a pending type.
  • the application further provides an identification device for a webpage intrusion script feature, wherein the identification device comprises:
  • a first device configured to map the reference webpage script to a reference vector of a multi-dimensional space based on feature information of each reference webpage script, where the assignment of the reference vector is determined according to a webpage intrusion script feature type of the corresponding reference webpage script;
  • a second device configured to acquire a distribution model of the assignment in the multi-dimensional space according to the distribution of the reference vector and its assignment;
  • a third device configured to map the to-be-tested webpage script to a to-be-tested vector of a multi-dimensional space based on feature information of the webpage script to be tested;
  • a fourth device configured to determine, according to the distribution model of the assignment in the multi-dimensional space, an assignment corresponding to the vector to be tested mapped in the multi-dimensional space, and determine, according to the assignment, a webpage intrusion script feature corresponding to the webpage script to be tested Types of.
  • the first device maps the reference webpage script to a reference vector of a multi-dimensional space and the third device maps the to-be-tested webpage script to a multi-dimensional space to be tested based on the same mapping rule.
  • the first device includes:
  • a first unit configured to obtain a plurality of the reference webpage scripts
  • a second unit configured to sample and quantize the reference webpage script to obtain a feature value set of the reference webpage script
  • a third unit configured to map a set of feature values of each of the reference webpage scripts to a reference vector of the multidimensional space.
  • the second unit comprises:
  • a second subunit configured to sample and quantize the characters of the intercepted reference webpage script to obtain a feature value set of the reference webpage script.
  • the second subunit comprises:
  • a second sub-unit configured to quantize the sampled characters of the reference webpage script into corresponding feature values according to an ASCII code rule.
  • the identifying device further includes:
  • a fifth device configured to determine a webpage intrusion script feature type of the webpage script to be tested by using a reference webpage script remaining after intercepting from each of the reference webpage scripts.
  • the identifying device further includes:
  • a sixth device configured to process and store the reference webpage script remaining after being intercepted from each of the reference webpage scripts by using a regular expression.
  • the third device comprises:
  • a fourth unit configured to obtain the webpage script to be tested
  • a fifth unit configured to sample and quantize the webpage script to be tested, to obtain a feature value set of the webpage script to be tested
  • a sixth unit configured to map the feature value set of the webpage script to be tested to the to-be-tested vector of the multi-dimensional space.
  • the fifth unit comprises:
  • a third subunit configured to intercept, from the webpage to be tested, a webpage script to be tested having the same text capacity as the reference webpage script intercepted by the reference webpage script;
  • a fourth subunit configured to sample and quantize the intercepted characters of the webpage script to be tested, to obtain a feature value set of the webpage script to be tested.
  • the fourth subunit comprises:
  • the fourth sub-unit is configured to quantize the sampled characters of the webpage script to be tested into corresponding feature values according to an ASCII code rule.
  • the second device comprises:
  • the seventh unit is configured to acquire a distribution model of the assignment in the multidimensional space by using a classification algorithm.
  • the classification algorithm comprises a support vector machine algorithm.
  • the distribution model of the assignment in the multi-dimensional space comprises a plurality of multi-dimensional functional relationship groups.
  • the fourth device comprises:
  • an eighth unit configured to substitute the value of the vector to be tested into the plurality of multi-dimensional function relationship groups, and obtain an assignment corresponding to the vector to be tested mapped in the multi-dimensional space by using an analytic geometry principle.
  • webpage intrusion script feature type includes a normal type, an abnormal type, and a pending One or any combination of the types.
  • the method and device for identifying a webpage intrusion script feature of the present application maps a certain number of reference webpage scripts and their feature information obtained into a reference vector of a multidimensional space and an assignment thereof according to the reference vector. And the distribution of the assignments to obtain the distribution model of the assignment in the multi-dimensional space.
  • the script of the webpage to be tested is obtained and the feature information of the webpage script to be tested is mapped to the multidimensional space.
  • the test vector only needs to input the feature information of the vector to be tested into the distribution model of the multi-dimensional space to obtain the webpage intrusion script feature of the webpage script to be tested, thereby reducing the requirement for the computing hardware and ensuring The recognition accuracy of the webpage intrusion script feature greatly reduces the recognition time.
  • the method and device for identifying the intrusion script feature of the webpage according to the present application further determines the webpage intrusion script feature type of the webpage script to be tested by using the webpage script remaining after intercepting the webpage script of each of the reference webpage scripts. To further improve the accuracy of recognition.
  • FIG. 1 shows a schematic diagram of an identification device for a webpage intrusion script feature according to an aspect of the present application
  • FIG. 2 shows a schematic diagram of a first device according to a preferred embodiment of the present application
  • Figure 3 shows a schematic diagram of a third device according to a preferred embodiment of the present application.
  • FIG. 4 shows a schematic diagram of an identification device for a webpage intrusion script feature according to another aspect of the present application
  • FIG. 5 is a flow chart showing a method for identifying a webpage intrusion script feature according to an aspect of the present application
  • FIG. 6 shows a flowchart showing mapping of a reference webpage script to a reference vector of a multidimensional space based on feature information of each reference webpage script, according to a preferred embodiment of the present application
  • FIG. 7 illustrates a to-be-tested vector that maps the webpage to be tested to a multidimensional space based on feature information of a webpage script to be tested, according to a preferred embodiment of the present application
  • FIG. 8 shows a flow of a method for identifying a webpage intrusion script feature according to another aspect of the present application. Schematic diagram.
  • the terminal, the device of the service network, and the trusted party each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory. (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD) or other optical storage,
  • computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.
  • the identification device 1 shows a schematic diagram of an identification device for a webpage intrusion script feature according to an aspect of the present application, wherein the identification device 1 includes a first device 11, a second device 12, a third device 13, and a fourth device 14.
  • the webpage intrusion script feature type includes one or any combination of a normal type, an abnormal type, and a pending type.
  • the normal type may also include several different normal types
  • the abnormal type may also include several different abnormal types.
  • the pending type may also include several different pending types.
  • the further division of the webpage intrusion script feature type may be based on The obtained reference intrusion script feature is determined and will not be described again.
  • the identification device 1 includes, but is not limited to, a user equipment, a network device, or a device formed by integrating a user equipment and a network device through a network.
  • the identification device 1 includes but is not limited to Any mobile electronic product, such as a smart phone, a PDA, or the like, that can interact with a user through a touchpad, the mobile electronic product can adopt any operating system, such as an Android operating system, an IOS operating system, or the like.
  • the identification device 1 includes an electronic device capable of automatically performing numerical calculation and information processing according to an instruction set or stored in advance, and the hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), and a programmable Gate array (FPGA), digital processor (DSP), embedded devices, etc.
  • ASIC application specific integrated circuit
  • FPGA programmable Gate array
  • DSP digital processor
  • the identification device 1 includes, but is not limited to, a computer, a network host, a single network server, a plurality of network server sets, or a plurality of servers; here, the cloud is composed of a large number of computers or network servers based on Cloud Computing.
  • Composition in which cloud computing is a type of distributed computing, a virtual supercomputer consisting of a group of loosely coupled computers.
  • the network includes, but is not limited to, the Internet, a wide area network, a metropolitan area network, a local area network, a VPN network, a wireless ad hoc network (Ad Hoc network), and the like.
  • Ad Hoc network wireless ad hoc network
  • the first device 11 is configured to map the reference webpage script to a reference vector of a multi-dimensional space based on feature information of each reference webpage script, wherein the reference vector is assigned according to a webpage intrusion script feature type of the corresponding reference webpage script. Determining; the second device 12 is configured to obtain a distribution model of the assignment in the multi-dimensional space according to the distribution of the reference vector and the assignment thereof; and the third device 13 is configured to map the web script to be tested based on the feature information of the webpage script to be tested a vector to be tested in a multi-dimensional space; and a fourth device 14 configured to determine, according to the distribution model of the assignment in the multi-dimensional space, an assignment corresponding to the vector to be measured mapped in the multi-dimensional space, and determine corresponding according to the assignment The webpage intrusion script feature type of the web script to be tested.
  • the above-mentioned devices are continuously operated.
  • continuous means that the above-mentioned devices perform acquisition in real time or according to the set or real-time adjusted working mode requirements.
  • the distribution model of the area is divided until the webpage intrusion script feature type corresponding to the webpage script to be tested is determined.
  • FIG. 2 shows a schematic diagram of a first device shown in accordance with a preferred embodiment of the present application, wherein the first device 11 includes a first unit 110, a second unit 120, and a third unit 130.
  • the first unit 110 is configured to obtain a plurality of the reference webpage scripts; the second unit 120 is configured to sample and quantize the reference webpage scripts to obtain the feature values of the reference webpage scripts. And the third unit 130 is configured to map a set of feature values of each of the reference webpage scripts to a reference vector of the multidimensional space.
  • the second unit 120 includes a first subunit (not labeled) and a second subunit (not labeled), wherein the first subunit is configured to intercept from each of the reference webpage scripts a reference webpage script of the same text capacity, the second subunit is configured to sample and quantize the characters of the intercepted reference webpage script to obtain a feature value set of the reference webpage script.
  • the second subunit includes a second subunit (not shown) for using the sampled web page script sampled according to ASCII rules The characters are quantized into corresponding feature values.
  • ASCII is a computer coding system based on the Latin alphabet. In the computer, all data is represented by binary numbers during storage and operation. It is the most versatile single-byte encoding system available today and is the most widely used encoding system in computers. Therefore, the feature values of the characters of the webpage script of the reference webpage script can be directly recognized and stored by the computer through the ASCII code rule, without additional computer computing burden, thereby improving the recognition efficiency.
  • the webpage intrusion script feature usually appears before the 256KB byte of the webpage script file (where 256KB bytes are only examples and are not limited).
  • the webpage intrusion script feature recognition method is based on establishing a feature recognition model of the first 256 KB character in the page script, that is, first modeling in a multi-dimensional space of 256*1024 dimensions.
  • the feature information of each reference webpage script is mapped to one reference vector in a multi-dimensional space of 256*1024 dimensions, each vector has a vector coordinate of 256*1024 dimensions, and each reference vector has one according to the corresponding reference webpage.
  • the script's web page intrusion script feature type determines the assignment.
  • the second unit 120 samples the reference webpage script, wherein the reference webpage script is less than 256 KB (bytes). All web scripts for web scripts, for reference web scripts larger than 256 KB, are partial web page scripts that intercept the first 256 KB of the reference web script.
  • the second unit 120 quantizes the characters in the sampled reference webpage script to make the characters form feature values.
  • Each reference webpage script quantized by the second unit 120 can be obtained A set of eigenvalues consisting of 256*1024 number of eigenvalues.
  • each feature value in the feature value set of each web page script to be tested is sequentially used as the vector coordinate of the vector by the third unit 130, thereby mapping each web page to be tested into a vector having a dimension of 256*1024.
  • the current webpage intrusion script feature usually appears before the 256KB bytes of the web script file, so this is taken as an example:
  • a reference webpage script content is as follows:
  • Xxbbxxbb in the reference webpage script represents a Webshell feature.
  • the assignment of the vector of the multidimensional space can be represented by, but not limited to, a decimal value.
  • the type value is marked according to the exception type, for example, by using a decimal two-digit number: 10, indicating the type of the exception and the exception, and assigning the type value to the feature of the reference webpage script. Assignment.
  • the above sampling and quantification method greatly simplifies the storage of reference webpage scripts, and facilitates subsequent feature extraction and calculation.
  • the reference webpage script is continuously obtained by the first device 11, and the reference webpage script is mapped to the reference vector of the multidimensional space based on the acquired feature information of the reference webpage script, thereby forming the assignment of several reference vectors and their corresponding reference vectors.
  • the second device 12 divides the multi-dimensional space according to the assignment distribution, and acquires a distribution model of the divided region, and acquires a distribution model of the assignment in the multi-dimensional space according to the distribution of the reference vector and its assignment.
  • the distribution model of the divided regions includes a distribution model of the assignments in the multi-dimensional space distributed by the plurality of regions, including a plurality of multi-dimensional functional relationship groups.
  • the second device 12 includes a seventh unit (not labeled), and the seventh unit is configured to acquire a distribution model of the assignment in the multi-dimensional space by using a classification algorithm.
  • the classification algorithm comprises using a Support Vector Machine (SVM) algorithm.
  • SVM Support Vector Machine
  • the support vector machine algorithm can compress a huge amount of sample data into a multivariate system of equations.
  • each reference webpage script is processed to obtain a feature vector consisting of a set of feature values, and each feature vector may be equivalent to a coefficient of a multidimensional function relationship (equation).
  • a plurality of multi-dimensional function relationship groups can be obtained, and the multi-dimensional function relationship groups can describe the multi-dimensional space.
  • the vector expression of this multidimensional space can be finally calculated based on several multidimensional function relationship groups.
  • a reference webpage script sampled to three feature characters (1:66, 2:97, 3:99) and the reference webpage script has a type value of 10
  • 10 66x+97y+99z
  • three feature characters (1:66, 2:97, 3:99) are sampled in another reference webpage script
  • the "+" in the multidimensional relational expression is merely an example, and is not limited thereto.
  • Other arithmetic means such as addition, subtraction, multiplication, division, and the like, are applicable to the present application, and may be incorporated in the present application.
  • Support Vector Machine is a pattern recognition method based on statistical learning theory, which is mainly used in the field of pattern recognition.
  • the support vector machine method is based on the VC dimension theory and structural risk minimization principle of statistical learning theory. According to the limited sample information, the complexity of the model (ie the learning precision of specific training samples) and the learning ability (ie no error) Find the best compromise between the ability to identify any sample) to establish a recognition model.
  • the second device 12 calculates the reference vector created by the first device 11 and its corresponding assignment using a multi-classification algorithm of the support vector machine.
  • the time may vary from several minutes to one month. And because of the characteristics of the support vector machine, the middle can not be interrupted. According to the current hardware and software situation and the characteristics of the support vector machine itself, the running time is on the order of several hundred, and the time cost of this calculation is acceptable.
  • the final support vector opportunity calculates a textual presentation, similar to the following:
  • the presentation result of the text mode is substantially related to the correlation equation coefficients of a plurality of the multi-dimensional function relationship groups, and the second device 12 compresses a plurality of even a huge amount of reference webpage script files into a multi-dimensional function relationship group, the function relationship group Only relevant data of functional relationships such as equations and equation coefficients are included, thereby realizing a huge amount of data compression and preservation.
  • the huge sample data is mapped into a multi-dimensional space according to a certain mapping algorithm, and the multi-classification algorithm of the support vector machine is used to find the segmentation plane between multiple classes, and finally the equations for preserving these segmentation surfaces are persisted.
  • Group performance the result of compressing huge sample data into a multivariate function relationship.
  • FIG. 3 shows a schematic diagram of a third device according to a preferred embodiment of the present application, wherein the third device 13 includes: a fourth unit 310, a fifth unit 320, and a sixth unit 330.
  • the fourth unit 310 is configured to acquire the webpage script to be tested, and the fifth unit 320 is configured to sample and quantize the webpage script to be tested to obtain a feature value set of the webpage script to be tested; 330 is configured to map the feature value set of the webpage script to be tested to the to-be-tested vector of the multi-dimensional space.
  • the first device 11 maps the reference webpage script to a reference vector of a multi-dimensional space and the third device 13 maps the to-be-tested webpage script to a multi-dimensional space to be tested based on the same mapping. rule.
  • the same mapping rule includes sampling and quantifying the reference webpage script and the webpage script to be tested based on the same rule, so that the reference webpage script and the webpage script to be tested can be mapped in the same multidimensional space.
  • the fifth unit 320 includes a third subunit (not labeled) and a fourth subunit (not labeled).
  • the third subunit is configured to intercept, from the webpage to be tested, a webpage script to be tested having the same text capacity as the reference webpage script intercepted by the reference webpage script; and the fourth subunit is configured to wait for the interception
  • the characters of the webpage script are sampled and quantized to obtain a set of feature values of the webpage script to be tested.
  • the fourth subunit includes a fourth subunit (not labeled), and the fourth subunit is configured to quantize the sampled character of the webpage to be tested according to an ASCII code rule. Become the corresponding feature value.
  • the webpage intrusion script feature recognition method to establish a feature recognition model of the first 256 KB character in the page script, that is, to model in a multi-dimensional space of 256*1024 dimensions, for example, to be tested
  • the feature information of the webpage script is mapped to the vector to be tested in a multi-dimensional space of 256*1024 dimensions, and the vector to be tested has vector coordinates of 256*1024 dimensions.
  • the fifth unit 320 samples the webpage script to be tested, where the script to be tested is less than 256 KB (bytes). Obtain all the webpage scripts of the webpage script to be tested, and intercept the partial webpage script of the first 256 KB bytes of the webpage script to be tested for the webpage script to be tested that is larger than 256 KB. Then, the fifth unit 320 quantizes each character in the sampled webpage script to form a feature value. For a webpage script of less than 256 KB, the number of feature values formed is less than 256*1024, and the number is insufficient.
  • the feature value can be indicated by a special feature value, for example, the feature value is indicated by "0".
  • each webpage script to be tested quantized by the fifth unit 320 can obtain a number of 256*1024
  • collecting, by the third unit 130, each feature value in each of the feature value sets of the webpage script to be tested is used as a vector coordinate of the vector, thereby mapping each webpage to be tested into one A vector with 256*1024 dimensions. Therefore, the assignment information of the vector to be tested can be obtained in the following according to the distribution rule of the assignment of the reference vector.
  • the fourth device 14 determines, according to the distribution model of the assignment in the multi-dimensional space, the assignment corresponding to the vector to be tested mapped in the multi-dimensional space, and determines a webpage intrusion script corresponding to the webpage script to be tested according to the assignment. Feature type.
  • the fourth device 14 further includes an eighth unit (not shown) for substituting the assignment of the vector to be tested into the plurality of multi-dimensional functional relationship groups, by using parsing The geometric principle acquires an assignment corresponding to the vector to be measured mapped in the multidimensional space.
  • the feature of the webpage script to be tested can be obtained through the multi-classification identification interface of the support vector machine, and the classification value can be obtained, thereby obtaining the webpage of the webpage script to be tested.
  • Intrusion script feature type By using the classification algorithm to perform feature extraction and spatial mapping on the reference webpage script, the characteristics of the reference webpage script and its webpage intrusion script feature type are mapped into the vector of the multidimensional space and its assignment, and the regional distribution of the multidimensional space according to the assignment is only The value of the webpage intrusion script feature of the webpage script to be tested can be obtained by obtaining the assignment of the area mapped by the webpage script to be tested.
  • the identification device 1 of the webpage intrusion script feature of the present application includes a first device 11', The second device 12', the third device 13', the fourth device 14', and the fifth device 15'.
  • the first device 11', the second device 12', the third device 13', and the fourth device 14' of the identification device 1 are the first device 11, the second device 12, the third device 13, and the first device in FIG.
  • the contents of the four devices 14 are the same or substantially the same, and are not described again for the sake of brevity, and are only included herein by reference.
  • the fifth device 15' determines the webpage intrusion script feature type of the webpage script to be tested by using a reference webpage script remaining after intercepting from each of the reference webpage scripts.
  • the remaining webpage scripts obtained by the fifth device 15' may be used to further determine a webpage intrusion script feature type of the webpage script to be tested, for example, when the webpage intrusion script feature type obtained by the fourth device 14' is a type to be determined.
  • the fifth device 15' can be further compared with the remaining webpage scripts obtained from the reference webpage script by the fifth device 15' to further detect the webpage intrusion script feature type.
  • the fifth device 15 Continuing to use the webpage intrusion script feature recognition method based on establishing a feature recognition model of the first 256 KB character in the page script, that is, modeling in a multi-dimensional space of 256*1024 dimensions, the fifth device 15'
  • the file of the reference webpage script larger than 256 KB stores the characters after the 256th KB in the webpage script according to the regular expression, so as to further match the content of the reference webpage script stored by the regular expression in the database for the webpage script to be tested.
  • the webpage intrusion script feature types obtained by the classification algorithm are further matched to improve the accuracy of the recognition.
  • the method 1 includes a first device step S11, a second device step S12, a third device step S13, and a Four device steps S14.
  • the webpage intrusion script feature type includes one or any combination of a normal type, an abnormal type, and a pending type.
  • the normal type may also include several different normal types
  • the abnormal type may also include several different abnormal types
  • the pending type may also include several different pending types, where further division of the feature types may be based on the obtained reference. The characteristics of the intrusion script are determined and will not be described again.
  • step S11 the reference webpage script is mapped to the reference vector of the multi-dimensional space based on the feature information of each reference webpage script, wherein the assignment of the reference vector is determined according to the webpage intrusion script feature type of the corresponding reference webpage script.
  • step S12 the distribution model of the assignment in the multi-dimensional space is obtained according to the distribution of the reference vector and its assignment; in step S13, the webpage script to be tested is mapped to the multi-dimensional space based on the feature information of the webpage script to be tested.
  • step S14 determining, according to the distribution model of the assignment in the multi-dimensional space, an assignment corresponding to the vector to be measured mapped in the multi-dimensional space, and determining a script corresponding to the webpage to be tested according to the assignment
  • the webpage intrusion script feature type
  • step S11 includes step S110, step S120 and step S130.
  • the step S110 is used to obtain a plurality of the reference webpage scripts; in step S120, the reference webpage script is sampled and quantized to obtain the feature value set of the reference webpage script; and in the step In S130, a feature value set for each of the reference webpage scripts is mapped to a reference vector of the multidimensional space.
  • step S120 further includes the following steps:
  • the reference web page script that intercepts the same text capacity from each of the reference web page scripts further includes:
  • sampled characters of the reference webpage script are quantized into corresponding feature values according to an ASCII code rule.
  • ASCII is a computer coding system based on the Latin alphabet. In the computer, all data is represented by binary numbers during storage and operation. It is the most versatile single-byte encoding system available today and is the most widely used encoding system in computers. Therefore, the feature values of the characters of the webpage script of the reference webpage script can be directly recognized and stored by the computer through the ASCII code rule without additional computer computing burden.
  • the webpage intrusion script feature usually appears before the 256KB byte of the webpage script file (where 256KB bytes are only examples and are not limited).
  • the webpage intrusion script feature recognition method is based on establishing a feature recognition model of the first 256 KB character in the page script, that is, first modeling in a multi-dimensional space of 256*1024 dimensions.
  • the feature information of each reference webpage script is mapped to one reference vector in a multi-dimensional space of 256*1024 dimensions, each vector has a vector coordinate of 256*1024 dimensions, and each reference vector has one according to the corresponding reference webpage.
  • the script's web page intrusion script feature type determines the assignment.
  • step S120 refers to the Referring to the webpage script for sampling, wherein for a reference webpage script of less than 256 KB (bytes), all webpage scripts of the reference webpage script are obtained, and for a reference webpage script larger than 256 KB, the first 256 KB bytes of the reference webpage script are intercepted. Web script.
  • step S120 quantizes each character in the sampled reference webpage script to make each character form a feature value.
  • Each reference webpage script quantized by the second unit 120 can obtain a set of feature values having a 256*1024 number of feature values.
  • each feature value in each feature value set of the webpage to be tested is sequentially used as vector coordinates of the vector, thereby mapping each webpage to be tested into a vector having a dimension of 256*1024. .
  • the current Webshell feature usually appears before the 256KB bytes of the web script file, so this is taken as an example:
  • a reference webpage script content is as follows:
  • Xxbbxxbb in the reference webpage script represents a Webshell feature.
  • the assignment of the vector of the multidimensional space can be represented by, but not limited to, a decimal value.
  • the type value is marked according to the exception type, for example, by using a decimal two-digit number: 10, indicating the type of the exception and the exception, and assigning the type value to the feature of the reference webpage script. Assignment.
  • the above sampling and quantification method greatly simplifies the storage of reference webpage scripts, and facilitates subsequent feature extraction and calculation.
  • the reference webpage script is continuously obtained through step S11, and the reference webpage script is mapped to the reference vector of the multidimensional space based on the acquired feature information of the reference webpage script, thereby forming the assignment of several reference vectors and their corresponding reference vectors.
  • step S12 acquires a distribution model of the assignment in the multidimensional space according to the distribution of the reference vector and its assignment.
  • the distribution model of the assignment in the multidimensional space comprises a plurality of multidimensional functional relationship groups.
  • the step S12 includes: acquiring a distribution model of the assignment in the multi-dimensional space by using a classification algorithm.
  • the classification algorithm uses a support vector machine algorithm.
  • the support vector machine algorithm can compress a huge amount of sample data into a multivariate system of equations.
  • each reference webpage script is processed to obtain a feature vector consisting of a set of feature values, and each feature vector may be equivalent to a coefficient of a multidimensional function relationship (equation).
  • a plurality of multi-dimensional function relationship groups can be obtained, and the multi-dimensional function relationship groups can describe the multi-dimensional space.
  • the vector expression of this multidimensional space can be finally calculated based on several multidimensional function relationship groups.
  • a reference webpage script sampled to three feature characters (1:66, 2:97, 3:99) and the reference webpage script has a type value of 10
  • 10 66x+97y+99z
  • three feature characters (1:66, 2:97, 3:99) are sampled in another reference webpage script
  • the "+" in the multidimensional relational expression is merely an example, and is not limited thereto.
  • Other arithmetic means such as addition, subtraction, multiplication, division, and the like, are applicable to the present application, and may be incorporated in the present application.
  • Support Vector Machine is a statistical learning theory.
  • the pattern recognition method is mainly applied in the field of pattern recognition.
  • the support vector machine method is based on the VC dimension theory and structural risk minimization principle of statistical learning theory. According to the limited sample information, the complexity of the model (ie the learning precision of specific training samples) and the learning ability (ie no error) Find the best compromise between the ability to identify any sample) to establish a recognition model.
  • step S12 calculates the reference vector created in step S11 and its corresponding assignment using a multi-classification algorithm of the support vector machine.
  • the time consuming may vary from several minutes to one month.
  • the running time is on the order of several hundred, which is an affordable calculation time cost.
  • the final support vector opportunity calculates a textual presentation, similar to the following:
  • the presentation result of the text mode is substantially related to the correlation equation coefficients of a plurality of the multi-dimensional function relationship groups, and the step S12 compresses a plurality of even a huge amount of reference webpage script files into a multi-dimensional function relationship group, the function relationship group only includes The correlation data of the equations, equation coefficients and other functional relationships, thus achieving a huge amount of data compression and preservation.
  • the huge sample data is mapped into a multi-dimensional space according to a certain mapping algorithm, and the multi-classification algorithm of the support vector machine is used to find the segmentation plane between multiple classes, and finally the equations for preserving these segmentation surfaces are persisted.
  • Group performance to achieve the compression of huge sample data into a multivariate function The result of the system.
  • FIG. 7 shows a test vector for mapping the web page to be tested to a multi-dimensional space based on the feature information of the web page to be tested, according to a preferred embodiment of the present application, wherein the step S13 includes steps S310 and S320. And step S330.
  • step S310 the webpage script to be tested is acquired; in step S320, the webpage script to be tested is sampled and quantized to obtain the feature value set of the webpage script to be tested; in step S330, Mapping the feature value set of the webpage script to be tested to the vector to be tested of the multidimensional space.
  • the step S11 maps the reference webpage script to the reference vector of the multi-dimensional space and the step S13 maps the to-be-tested webpage script to the vector to be tested of the multidimensional space based on the same mapping rule.
  • the same mapping rule includes sampling and quantifying the reference webpage script and the webpage script to be tested based on the same rule, so that the reference webpage script and the webpage script to be tested can be mapped in the same multidimensional space.
  • the step S320 includes:
  • the character of the intercepted webpage script to be tested is sampled and quantized to obtain a feature value set of the webpage script to be tested.
  • the script to be tested having the same text capacity as the reference webpage script intercepted by the reference webpage script is intercepted from the webpage to be tested, including: the sampled to be tested according to an ASCII code rule.
  • the characters of the web script are quantized into corresponding feature values.
  • the webpage intrusion script feature recognition method to establish a feature recognition model of the first 256 KB character in the page script, that is, to model in a multi-dimensional space of 256*1024 dimensions, for example, to be tested
  • the feature information of the webpage script is mapped to the vector to be tested in a multi-dimensional space of 256*1024 dimensions, and the vector to be tested has vector coordinates of 256*1024 dimensions.
  • the step S320 samples the webpage script to be tested, where all the webpages of the webpage to be tested are obtained for the webpage script to be tested that is less than 256 KB (bytes).
  • the script for a webpage script to be tested larger than 256 KB, intercepts a partial webpage script of the first 256 KB bytes of the webpage script to be tested.
  • step S320 is again Sampling obtains each character in the webpage script to be quantized to form a feature value. For a webpage script of less than 256 KB, the number of feature values formed is less than 256*1024, and an insufficient number of feature values may use a special feature value.
  • each of the webpages to be tested quantized by the step S320 obtains a feature value set having a feature value of 256*1024, and each feature in the feature value set of each of the webpages to be tested is determined by step S130.
  • the values are sequentially used as the vector coordinates of the vector, thereby mapping each of the webpages to be tested into a vector having a dimension of 256*1024. Therefore, the assignment information of the vector to be tested can be obtained in the following according to the distribution rule of the assignment of the reference vector.
  • step S14 determining, according to the distribution model of the assignment in the multi-dimensional space, the assignment corresponding to the vector to be tested mapped in the multi-dimensional space, and determining the webpage intrusion corresponding to the webpage script to be tested according to the assignment Script feature type.
  • the step S14 further includes: substituting the value of the vector to be tested into the plurality of multi-dimensional function relationship groups, and acquiring, by using an analytic geometry principle, the mapping of the vector to be tested in the multi-dimensional space. Assignment.
  • the feature of the webpage script to be tested can be obtained through the multi-classification identification interface of the support vector machine, and the classification value can be obtained, thereby obtaining the webpage of the webpage script to be tested.
  • Intrusion script feature type By using the classification algorithm to perform feature extraction and spatial mapping on the reference webpage script, the characteristics of the reference webpage script and its webpage intrusion script feature type are mapped into the vector of the multidimensional space and its assignment, and the regional distribution of the multidimensional space according to the assignment is only The value of the webpage intrusion script feature of the webpage script to be tested can be obtained by obtaining the assignment of the area mapped by the webpage script to be tested.
  • FIG. 8 is a schematic flowchart diagram of a method for identifying a webpage intrusion script feature according to another aspect of the present application.
  • the method for identifying a webpage intrusion script feature of the present application includes step S11' and steps. S12', step S13', step S14', and step S15'.
  • the steps S11', S12', S13', and S14' in the identification method are the same as or substantially the same as the contents of the steps S11, S12, S13, and S14 in FIG. 1. For the sake of brevity, no further details are provided. , only included here by reference.
  • the step S15' determines the webpage intrusion script feature type of the webpage script to be tested by using the reference webpage script remaining after intercepting from each of the reference webpage scripts.
  • the remaining webpage scripts obtained by the fifth device 15' may be further used to further determine a webpage intrusion script feature type of the webpage script to be tested, for example, when the webpage intrusion script feature type obtained in step S14' is a type to be determined, Then, the step S15' may further compare the webpage script to be tested with the remaining webpage scripts obtained from the reference webpage script, and further detect the webpage intrusion script feature type.
  • step S15' is greater than 256 KB.
  • the reference webpage script file stores the characters after the 256th byte in the webpage script according to the regular expression, so as to further use the content of the reference webpage script stored by the regular expression in the database to further match the webpage script to be tested, and classify The webpage intrusion script feature type obtained by the algorithm is further matched to improve the accuracy of the recognition.
  • the method and device for identifying a webpage intrusion script feature of the present application maps a certain number of reference webpage scripts and their feature information obtained into a reference vector of a multidimensional space and an assignment thereof according to the reference vector. And the distribution of the assignments to obtain the distribution model of the assignment in the multi-dimensional space.
  • the script of the webpage to be tested is obtained and the feature information of the webpage script to be tested is mapped to the multidimensional space.
  • the test vector only needs to input the feature information of the vector to be tested into the distribution model of the multi-dimensional space to obtain the webpage intrusion script feature of the webpage script to be tested, thereby reducing the requirement for the computing hardware and ensuring The recognition accuracy of the webpage intrusion script feature greatly reduces the recognition time.
  • the method and device for identifying the intrusion script feature of the webpage according to the present application further determines the webpage intrusion script feature type of the webpage script to be tested by using the webpage script remaining after intercepting the webpage script of each of the reference webpage scripts. To further improve the accuracy of recognition.
  • the present application can be implemented in software and/or a combination of software and hardware, for example, using an application specific integrated circuit (ASIC), a general purpose computer, or any other similar hardware device.
  • the software program of the present application can be executed by a processor to implement the steps or functions described above.
  • the software programs (including related data structures) of the present application can be stored in a computer readable recording medium such as a RAM memory, a magnetic or optical drive or a floppy disk and the like.
  • some of the steps or functions of the present application may be implemented in hardware, for example, as a circuit that cooperates with a processor to perform various steps or functions.
  • a portion of the present application can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide a method and/or technical solution in accordance with the present application.
  • the program instructions for invoking the method of the present application may be stored in a fixed or removable recording medium, and/or transmitted by a data stream in a broadcast or other signal bearing medium, and/or stored in a The working memory of the computer device in which the program instructions are run.
  • an embodiment in accordance with the present application includes a device including a memory for storing computer program instructions and a processor for executing program instructions, wherein when the computer program instructions are executed by the processor, triggering
  • the apparatus operates based on the aforementioned methods and/or technical solutions in accordance with various embodiments of the present application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种网页入侵脚本特征的识别方法及设备，通过将获取的一定数量的参考网页脚本及其特征信息映射为多维空间的参考向量及其赋值，根据所述参考向量及其赋值的分布获取多维空间中赋值的分布模型，当需要进行网页入侵特征脚本特征识别时，获取待测网页脚本并将待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量，只需将待测向量的特征信息输入至所述多维空间中赋值的分布模型即可获得待测网页脚本的网页入侵脚本特征，因此降低了对计算硬件的要求，并在保证对网页入侵脚本特征的识别准确性的同时大大缩小了识别时间。

Description

网页入侵脚本特征的识别方法及设备 技术领域
本申请涉及通信及计算机领域，尤其涉及一种网页入侵脚本特征的识别方法及设备。
背景技术
网页入侵脚本(Webshell)是指网页脚本里面具有一定危害性的特定字符串内容的组合，会导致网站被攻击、数据泄露等严重后果。简单的说来，网页入侵脚本就是一个ASP(动态服务器页面，Active Server Page)或PHP(超文本预处理器，Hypertext Preprocessor)的木马后门，黑客在入侵了一个网站后，常常在将这些ASP或PHP木马后门文件放置在网站服务器的web目录中，与正常的网页文件混在一起，然后，黑客就可以用web(网页)的方式，通过ASP或PHP木马后门控制网站服务器，包括上传下载文件、查看数据库、执行任意程序命令等，再通过dos命令或者植入后门木马通过服务器漏洞等达到提权的目的。
对于网页入侵脚本来说，网页入侵脚本特征就是那些具有危害性的代码字符串。根据网页入侵脚本特征为分类依据，可以将网页脚本划分为多个特征类型。
目前对网页入侵脚本特征的处理，普遍采取大量采集样本数据放入数据库，然后以正则表达式方式进行特征字符串的查找识别。然而，随着参考网页脚本数量不断增加，参考网页脚本占用磁盘和内存空间高，可以从几兆字节到几百兆字节，因此存在库体积的瓶颈；并且，当体积到一定程度后，整个库在网页入侵脚本特征识别过程中，CPU(内存)占用率越来越高，甚至可达100％占用率，无法满足生产场景中对CPU使用率的限制要求；此外，识别速度慢，平均单个网页脚本文件识别时间大概在500毫秒至1秒，进而失去使用价值。
发明内容
本申请的目的是提供一种内存占用率低、识别速度快的网页入侵脚本特 征的识别方法。
有鉴于此，本申请提供一种网页入侵脚本特征的识别方法，其中，所述识别方法包括：
基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；
根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；
基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及
根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
优选的，将所述参考网页脚本映射至多维空间的参考向量以及将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。
进一步的，基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量包括：
获取若干所述参考网页脚本；
对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值集合；以及
将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
优选的，对所述参考网页脚本的特征进行采样和量化包括：
从每个所述参考网页脚本中截取相同文本容量的参考网页脚本；以及
对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
优选的，对从所述参考网页脚本截取的字符依次赋予特征值包括：
根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征值。
优选的，所述识别方法还包括：
利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。
优选的，所述识别方法还包括：
采用正则表达式对从每个所述参考网页脚本中截取之后剩余的参考网页脚本进行处理和存储。
进一步的，基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量包括：
获取所述待测网页脚本；
对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；以及
将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
优选的，对所述待测网页脚本的特征进行采样和量化包括：
从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；以及
对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
优选的，对所述截取的待测网页脚本的字符进行采样和量化包括：
根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
优选的，将所述多维空间进行划分包括：
利用分类算法获取所述多维空间中赋值的分布模型。
优选的，所述分类算法包括支持向量机算法。
优选的，所述多维空间中赋值的分布模型包括若干多维函数关系组。
优选的，根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值包括：
将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
进一步的，所述网页入侵脚本特征类型包括正常类型、异常类型及待定类型中的一种或任意组合。
本申请还提供一种网页入侵脚本特征的识别设备，其中，所述识别设备包括：
第一装置，用于基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；
第二装置，用于根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；
第三装置，用于基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及
第四装置，用于根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
优选的，所述第一装置将所述参考网页脚本映射至多维空间的参考向量以及第三装置将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。
进一步的，所述第一装置包括：
第一单元，用于获取若干所述参考网页脚本；
第二单元，用于对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值集合；以及
第三单元，用于将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
优选的，所述第二单元包括：
第一子单元，用于从每个所述参考网页脚本中截取相同文本容量的参考网页脚本；以及
第二子单元，用于对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
优选的，所述第二子单元包括：
第二一子单元，用于根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征值。
优选的，所述识别设备还包括：
第五装置，用于利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。
优选的，所述识别设备还包括：
第六装置，用于采用正则表达式对从每个所述参考网页脚本中截取之后剩余的参考网页脚本进行处理和存储。
优选的，所述第三装置包括：
第四单元，用于获取所述待测网页脚本；
第五单元，用于对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；以及
第六单元，用于将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
优选的，所述第五单元包括：
第三子单元，用于从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；以及
第四子单元，用于对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
优选的，所述第四子单元包括：
第四一子单元，用于根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
优选的，所述第二装置包括：
第七单元，用于利用分类算法获取所述多维空间中赋值的分布模型。
优选的，所述分类算法包括支持向量机算法。
优选的，所述多维空间中赋值的分布模型包括若干多维函数关系组。
优选的，所述第四装置包括：
第八单元，用于将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
进一步的，所述网页入侵脚本特征类型包括正常类型、异常类型及待定 类型中的一种或任意组合。
与现有技术相比，本申请所述网页入侵脚本特征的识别方法及设备通过将获取的一定数量的参考网页脚本及其特征信息映射为多维空间的参考向量及其赋值，根据所述参考向量及其赋值的分布获取多维空间中赋值的分布模型，当需要进行网页入侵特征脚本特征识别时，获取待测网页脚本并将待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量，只需将待测向量的特征信息输入至所述多维空间中赋值的分布模型即可获得待测网页脚本的网页入侵脚本特征，因此降低了对计算硬件的要求，并在保证对网页入侵脚本特征的识别准确性的同时大大缩小了识别时间。
进一步的，本申请所述网页入侵脚本特征的识别方法及设备还用从每个所述参考网页脚本的网页脚本中截取之后剩余的网页脚本进一步确定所述待测网页脚本的网页入侵脚本特征类型，进一步提高识别的准确性。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1示出根据本申请一方面示出的网页入侵脚本特征的识别设备示意图；
图2示出根据本申请一优选的实施例示出的第一装置示意图；
图3示出根据本申请一优选的实施例示出的第三装置示意图；
图4示出根据本申请另一方面示出的网页入侵脚本特征的识别设备示意图；
图5示出根据本申请一方面示出的网页入侵脚本特征的识别方法的流程图；
图6示出根据本申请一优选的实施例示出的基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量的流程图；
图7示出根据本申请一优选的实施例示出的基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；
图8示出根据本申请另一方面示出的网页入侵脚本特征的识别方法的流 程示意图。
附图中相同或相似的附图标记代表相同或相似的部件。
具体实施方式
在本申请一个典型的配置中，终端、服务网络的设备和可信方均包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器(SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
图1示出根据本申请一方面示出的网页入侵脚本特征的识别设备示意图，其中，所述识别设备1包括：第一装置11、第二装置12、第三装置13及第四装置14。
在较佳的实施例中，所述网页入侵脚本特征类型包括正常类型、异常类型及待定类型中的一种或任意组合。进一步的，正常类型也可包括若干不同的正常类型，异常类型也可包括若干不同的异常类型，待定类型也可包括若干不同的待定类型，在此，对网页入侵脚本特征类型的进一步划分可根据获得的参考入侵脚本特征确定，不再赘述。
在此，所述识别设备1包括但不限于用户设备、网络设备、或用户设备与网络设备通过网络相集成所构成的设备。所述识别设备1其包括但不限于 任何一种可与用户通过触摸板进行人机交互的移动电子产品，例如智能手机、PDA等，所述移动电子产品可以采用任意操作系统，如Android操作系统、IOS操作系统等。其中，所述识别设备1包括一种能够按照事先设定或存储的指令，自动进行数值计算和信息处理的电子设备，其硬件包括但不限于微处理器、专用集成电路(ASIC)、可编程门阵列(FPGA)、数字处理器(DSP)、嵌入式设备等。所述识别设备1其包括但不限于计算机、网络主机、单个网络服务器、多个网络服务器集或多个服务器构成的云；在此，云由基于云计算(Cloud Computing)的大量计算机或网络服务器构成，其中，云计算是分布式计算的一种，由一群松散耦合的计算机集组成的一个虚拟超级计算机。所述网络包括但不限于互联网、广域网、城域网、局域网、VPN网络、无线自组织网络(Ad Hoc网络)等。本领域技术人员应能理解，其他的触摸控制设备同样适用于本发明，也应包含在本发明保护范围以内，并在此以引用方式包含于此。
其中，第一装置11用于基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；第二装置12用于根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；第三装置13用于基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及第四装置14用于根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
在此，上述各装置之间是持续不断工作的，在此，本领域技术人员应理解“持续”是指上述各装置分别实时地或者按照设定的或实时调整的工作模式要求，进行获取所划分区域的分布模型等，直至确定对应待测网页脚本的网页入侵脚本特征类型。
图2示出根据本申请一优选的实施例示出的第一装置示意图，其中，第一装置11包括第一单元110、第二单元120以及第三单元130。
其中，第一单元110用于获取若干所述参考网页脚本；第二单元120用于对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值 集合；以及第三单元130用于将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
在优选的实施例中，所述第二单元120包括第一子单元(未标示)和第二子单元(未标示)，其中，第一子单元用于从每个所述参考网页脚本中截取相同文本容量的参考网页脚本，第二子单元用于对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
在优选的实施例中，第二子单元(未示出)包括第二一子单元(未示出)，所述第二一子单元用于根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征值。
在此，ASCII是基于拉丁字母的一套电脑编码系统，在计算机中将所有的数据在存储和运算时都使用二进制数表示。它是现今最通用的单字节编码系统，是一种在计算机中最为通过用的编码系统。因此，通过ASCII码规则依次对所述参考网页脚本的网页脚本的字符赋予特征值能够通过计算机直接识别和存储，无需额外增加计算机计算负担，进而提高识别效率。
在实际应用场景中，网页入侵脚本特征通常会出现在在网页脚本文件的256KB字节之前(其中，256KB字节仅为举例并不被限制)。
基于上述，在本实施例中，所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即首先在一个以256*1024维的多维度空间进行建模，将每一参考网页脚本的特征信息都会映射为以256*1024维的多维度空间中的一个参考向量，每一向量具有256*1024维度的向量坐标，且每个参考向量具有一个根据对应参考网页脚本的网页入侵脚本特征类型确定的赋值。
具体地，第一装置11的第一单元110获取若干所述参考网页脚本之后，第二单元120对所述参考网页脚本进行采样，其中对于小于256KB(字节)的参考网页脚本则获取该参考网页脚本的全部网页脚本，对于大于256KB的的参考网页脚本即截取该参考网页脚本的前256KB字节的部分参考网页脚本。
然后，第二单元120再对采样获得参考网页脚本中的字符进行量化，以使各字符形成特征值。经第二单元120量化后的每一参考网页脚本可获得具 有256*1024数量的特征值组成的特征值集合。然后，由第三单元130将每一待测网页脚本的特征值集合中的每一特征值依次作为向量的向量坐标，从而将每一待测网页脚映射为一个具有256*1024维度的向量。
在具体的应用场景中，目前网页入侵脚本特征通常会出现在在网页脚本文件的256KB字节之前，故以此为例：
更具体地，例如某参考网页脚本内容如下：
？PHP namespace
...
Xxbbxxbb
....
其中，参考网页脚本中“Xxbbxxbb”代表一个Webshell特征。
将上述参考网页脚本的每个字符依据计算机ASCII码转换为16进制数值，则量化后形成的向量如下：
(0x50,0x68,0x70,0x6e,0x61,0x6d,0x65,0x73,0x70,0x61,0x63,0x65,.....,0x58,0x78,0x62,0x62,0x78,0xx78,0x62,0x62.....)。
则上述参考网页脚本就形成了一个多维空间的向量。
接着，多维空间的向量的赋值可以采用但不限于十进制数值表示。
例如一参考网页脚本特征类型为异常类型，则根据异常类型标记类型值，例如用十进制的两位数标示：10，表示异常及异常的类型，将该类型值赋予其参考网页脚本的特征所映射的赋值。
从而，将参考网页脚本的特征形成为如下内容：
10：(0x50,0x68,0x70,0x6e,0x61,0x6d,0x65,0x73,0x70,0x61,0x63,0x65,
.....,0x58,0x78,0x62,0x62,0x78,0xx78,0x62,0x62.....)
上述采样和量化的方法大大简化的参考网页脚本的存储数量，且便于后续进行特征提取和计算。
当然，本领域技术人员应当能够理解，所述的对多维空间向量的赋值方式以及对所述参考网页脚本的网页脚本的字符赋予特征值仅为举例，其他获得的赋值和特征值的方式，如可适用于本申请，也应包含在本申请保护范围以内，并在此以引用方式包含于此。
从而，通过第一装置11持续获得参考网页脚本，并基于获取的参考网页脚本的特征信息将参考网页脚本映射至多维空间的参考向量，从而形成若干参考向量及其对应的参考向量的赋值。
接着，第二装置12根据所述赋值分布，将所述多维空间进行划分，并获取所划分区域的分布模型根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型。在优选的实施例中，所划分的区域的分布模型包括若干所述区域所分布的所述多维空间中赋值的分布模型包括若干多维函数关系组。
进一步的，所述第二装置12包括第七单元(未标示)，所述第七单元用于利用分类算法获取所述多维空间中赋值的分布模型。较佳的，所述分类算法包括采用支持向量机(SVM，Support Vector Machine)算法。支持向量机算法能够将巨量的样本数据压缩成一个多元方程组。
在具体的实施例中，每个参考网页脚本经过处理后得到的是一个特征值集合组成的特征向量，每个特征向量可以等价为一个多维函数关系式(方程式)的系数。多个参考向量经过处理后就可以得到若干多维函数关系组，若干多维函数关系组即可描述所述多维空间。使用支持向量机算法能够根据若干多维函数关系组最终计算得出这个多维空间的向量表达法。具体地，例如在一参考网页脚本的采样到三个特征字符(1:66,2:97,3:99)，参考网页脚本的类型值为10，则可等价为多维函数关系式：10＝66x+97y+99z，例如在另一参考网页脚本采样到三个特征字符(1:66,2:97,3:99)，且该参考网页脚本的类型值为20，20＝74x+101y+104z+80q。
在此，多维关系式中”+”里仅仅是举例，并不限于此，其他运算方式，例如加减乘除等运算符号适用于本申请的，亦可以引用的方式包含在本申请之中。
在此，支持向量机(Support Vector Machine，SVM)是一种基于统计学习理论的模式识别方法，主要应用于模式识别领域。支持向量机方法是建立在统计学习理论的VC维理论和结构风险最小原理基础上的，根据有限的样本信息在模型的复杂性(即对特定训练样本的学习精度)和学习能力(即无错误地识别任意样本的能力)之间寻求最佳折中，以建立识别模型。
具体地，第二装置12将第一装置11创建好的参考向量及其对应赋值使用支持向量机的多分类算法予以运算，根据支持向量机的特性，耗时可能从几分钟到一个月不等，且因为支持向量机的特性原因，中途不可中断。根据目前软硬件情况以及支持向量机本身的特性，运行时间在几百的数量级，该这个计算所花时间成本是可以接受的。
在一具体实施例中，最终支持向量机会算出一个文本方式的展现结果，类似如下：
0#kernel type
3#kernel parameter-d
1#kernel parameter-g
1#kernel parameter-s
1#kernel parameter-r
empty#kernel parameter-u
50#highest feature index
500#number of training documents
101#number of support vectors plus 1
9.9308382#threshold b,each following line is a SV(starting with alpha*y)
-3.2864346412986876e-007 1:0 2:247 3:211 4:204 5:202 6:223 7:206 8:241 9:208 10:222
该文本方式的展现结果实质是关于若干所述多维函数关系组的相关方程系数，所述第二装置12将若干甚至是巨量的参考网页脚本文件压缩为一个多维函数关系组，该函数关系组仅包括方程、方程系数等函数关系的相关数据，从而实现了巨量的数据压缩和保存。
因此，将巨量样本数据根据一定的映射算法，映射到一个多维空间里，并且利用支持向量机的多分类算法，找出多个类之间的分割面，最后持久化保存这些分割面的方程组表现，达到将巨量样本数据压缩成一个多元函数关系的结果。
图3示出根据本申请一优选的实施例示出的第三装置示意图，其中，第三装置13包括：第四单元310、第五单元320以及第六单元330。
其中，第四单元310用于获取所述待测网页脚本；第五单元320用于对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；第六单元330用于将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
在优选的实施例中，所述第一装置11将所述参考网页脚本映射至多维空间的参考向量以及第三装置13将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。其中，相同的映射规则包括基于相同的规则对参考网页脚本和待测网页脚本进行采样和量化，以使参考网页脚本和待测网页脚本能够映射在同一多维空间。
在优选的实施例中，所述第五单元320包括第三子单元(未标示)和第四子单元(未标示)。其中，第三子单元用于从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；第四子单元用于对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
在优选的实施例中，所述第四子单元包括第四一子单元(未标示)，所述第四一子单元用于根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
具体地，继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，将待测网页脚本的特征信息都映射为以256*1024维的多维度空间中的待测向量，待测向量具有256*1024维度的向量坐标。
具体地，第三装置13的第四单元310获取若干所述待测网页脚本之后，第五单元320对所述待测网页脚本进行采样，其中对于小于256KB(字节)的待测网页脚本即获取该待测网页脚本的全部网页脚本，对于大于256KB的的待测网页脚本即截取该待测网页脚本的前256KB字节的部分网页脚本。然后，第五单元320再对采样获得网页脚本中的各字符进行量化，以形成特征值，对于小于256KB的待测网页脚本，其形成的特征值的数量小于256*1024个，则不足数量的特征值可以用特殊的特征值标示，例如特征值为“0”标示。则经第五单元320量化后的每一待测网页脚本可获得具有256*1024数量的特 征值组成的特征值集合，由第三单元130将每一所述待测网页脚本的特征值集合中的每一特征值依次作为向量的向量坐标，从而将每一待测网页脚映射为一个具有256*1024维度的向量。因而在后续可以根据参考向量的赋值的分布规律获取待测向量的赋值信息。
进一步的，第四装置14根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
在优选的实施例中，所述第四装置14进一步包括第八单元(未示出)，所述第八单元用于将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，将待测向量的256*1024维度的向量坐标代入前述的所述第二装置12获得的多维函数关系组中，则能够获得待测脚本所映射的待测向量所在区域，进而通过该区域的赋值，确定所述待测脚本的类型值。
因此，采用支持向量机获得关于多维空间中赋值的多维函数关系组，将待测网页脚本的特征通过支持向量机的多分类识别接口，即可得出分类值，从而获得待测网页脚本的网页入侵脚本特征类型。通过使用分类算法对参考网页脚本进行特征提取和空间映射，将参考网页脚本的特征及其网页入侵脚本特征类型映射为多维空间的向量及其赋值，并根据赋值对多维空间进行区域分布，则只需获得待测网页脚本所映射的区域的赋值即可获得待测网页脚本的网页入侵脚本特征类型。
图4示出根据本申请另一方面示出的网页入侵脚本特征的识别设备示意图，在另一优选的实施例中，本申请所述网页入侵脚本特征的识别设备1包括第一装置11’、第二装置12’、第三装置13’、第四装置14’以及第五装置15’。
在此，识别设备1的第一装置11’、第二装置12’、第三装置13’以及第四装置14’与图1中第一装置11、第二装置12、第三装置13以及第四装置14的内容对应相同或基本相同，为简明起见，不再赘述，仅以引用的方式包含在此。
其中，第五装置15’利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。所述第五装置15’获得的剩余的网页脚本可以用于进一步确定所述待测网页脚本的网页入侵脚本特征类型，例如，当第四装置14’获得的网页入侵脚本特征类型为待确定类型时，则可以利用所述第五装置15’将待测网页脚本与从参考网页脚本中获得的剩余的网页脚本进行进一步比对，进一步检测其网页入侵脚本特征类型。
继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，第五装置15’对于大于256KB的参考网页脚本的文件，将网页脚本中第256KB以后的字符按照正则表达式进行存储，以便于后续利用数据库中的正则表达式存储的参考网页脚本的内容对待测网页脚本进行进一步匹配，对分类算法获得的网页入侵脚本特征类型进行进一步匹配，以提高识别的准确性。
图5示出根据本申请一方面示出的网页入侵脚本特征的识别方法的流程图，所述识别设备方法1包括：第一装置步骤S11、第二装置步骤S12、第三装置步骤S13及第四装置步骤S14。
在较佳的实施例中，所述网页入侵脚本特征类型包括正常类型、异常类型及待定类型中的一种或任意组合。进一步的，正常类型也可包括若干不同的正常类型，异常类型也可包括若干不同的异常类型，待定类型也可包括若干不同的待定类型，在此，对特征类型的进一步划分可根据获得的参考入侵脚本特征确定，不再赘述。
其中，在步骤S11中，基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；在步骤S12中，根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；在步骤S13中，基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及在步骤S14中，根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
图6示出根据本申请的一个优选的实施例示出的基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量的流程图，其中，步骤S11包括步骤S110、步骤S120以及步骤S130。
其中，在步骤S110用于中，获取若干所述参考网页脚本；在步骤S120中，用于对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值集合；以及在步骤S130中，用于将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
在优选的实施例中，所述步骤S120进一步包括以下步骤：
从每个所述参考网页脚本中截取相同文本容量的参考网页脚本；以及对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
在优选的实施例中，从每个所述参考网页脚本中截取相同文本容量的参考网页脚本进一步包括：
根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征值。
在此，ASCII是基于拉丁字母的一套电脑编码系统，在计算机中将所有的数据在存储和运算时都使用二进制数表示。它是现今最通用的单字节编码系统，是一种在计算机中最为通过用的编码系统。因此，通过ASCII码规则依次对所述参考网页脚本的网页脚本的字符赋予特征值能够通过计算机直接识别和存储，无需额外增加计算机计算负担。
在实际应用场景中，网页入侵脚本特征通常会出现在在网页脚本文件的256KB字节之前(其中，256KB字节仅为举例并不被限制)。
基于上述，在本实施例中，所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即首先在一个以256*1024维的多维度空间进行建模，将每一参考网页脚本的特征信息都会映射为以256*1024维的多维度空间中的一个参考向量，每一向量具有256*1024维度的向量坐标，且每个参考向量具有一个根据对应参考网页脚本的网页入侵脚本特征类型确定的赋值。
具体地，步骤S110获取若干所述参考网页脚本之后，步骤S120对所述 参考网页脚本进行采样，其中对于小于256KB(字节)的参考网页脚本则获取该参考网页脚本的全部网页脚本，对于大于256KB的的参考网页脚本即截取该参考网页脚本的前256KB字节的部分网页脚本。
然后，步骤S120再对采样获得参考网页脚本中的各字符进行量化，以使各字符形成特征值。经第二单元120量化后的每一参考网页脚本可获得具有256*1024数量的特征值组成的特征值集合。
然后，在步骤S130中将每一所述待测网页脚本的特征值集合中的每一特征值依次作为向量的向量坐标，从而将每一待测网页脚映射为一个具有256*1024维度的向量。
在具体的应用场景中，目前Webshell特征通常会出现在在网页脚本文件的256KB字节之前，故以此为例：
更具体地，例如某参考网页脚本内容如下：
？PHP namespace
...
Xxbbxxbb
....
其中，参考网页脚本中“Xxbbxxbb”代表一Webshell特征。
将上述参考网页脚本的每个字符依据计算机ASCII码转换为16进制数值，则量化后形成的向量如下：
(0x50,0x68,0x70,0x6e,0x61,0x6d,0x65,0x73,0x70,0x61,0x63,0x65,.....,0x58,0x78,0x62,0x62,0x78,0xx78,0x62,0x62.....)。
则上述参考网页脚本就形成了一个多维空间的向量。
接着，多维空间的向量的赋值可以采用但不限于十进制数值表示。
例如一参考网页脚本特征类型为异常类型，则根据异常类型标记类型值，例如用十进制的两位数标示：10，表示异常及异常的类型，将该类型值赋予其参考网页脚本的特征所映射的赋值。
从而，将参考网页脚本的特征形成为如下内容：
10：(0x50,0x68,0x70,0x6e,0x61,0x6d,0x65,0x73,0x70,0x61,0x63,0x65,
.....,0x58,0x78,0x62,0x62,0x78,0xx78,0x62,0x62.....)
上述采样和量化的方法大大简化的参考网页脚本的存储数量，且便于后续进行特征提取和计算。
当然，本领域技术人员应当能够理解，所述的对多维空间向量的赋值方式以及对所述参考网页脚本的网页脚本的字符赋予特征值仅为举例，其他获得的赋值和特征值的方式，如可适用于本申请，也应包含在本申请保护范围以内，并在此以引用方式包含于此。
从而，通过步骤S11持续获得参考网页脚本，并基于获取的参考网页脚本的特征信息将参考网页脚本映射至多维空间的参考向量，从而形成若干参考向量及其对应的参考向量的赋值。
接着，步骤S12根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型。在优选的实施例中，所述多维空间中赋值的分布模型包括若干多维函数关系组。
进一步的，所述步骤S12包括：利用分类算法获取所述多维空间中赋值的分布模型。
较佳的，所述分类算法采用支持向量机算法。支持向量机算法能够将巨量的样本数据压缩成一个多元方程组。
在具体的实施例中，每个参考网页脚本经过处理后得到的是一个特征值集合组成的特征向量，每个特征向量可以等价为一个多维函数关系式(方程式)的系数。多个参考向量经过处理后就可以得到若干多维函数关系组，若干多维函数关系组即可描述所述多维空间。使用支持向量机算法能够根据若干多维函数关系组最终计算得出这个多维空间的向量表达法。具体地，例如在一参考网页脚本的采样到三个特征字符(1:66,2:97,3:99)，参考网页脚本的类型值为10，则可等价为多维函数关系式：10＝66x+97y+99z，例如在另一参考网页脚本采样到三个特征字符(1:66,2:97,3:99)，且该参考网页脚本的类型值为20，20＝74x+101y+104z+80q。
在此，多维关系式中”+”里仅仅是举例，并不限于此，其他运算方式，例如加减乘除等运算符号适用于本申请的，亦可以引用的方式包含在本申请之中。
在此，支持向量机(Support Vector Machine，SVM)是一种基于统计学习理 论的模式识别方法，主要应用于模式识别领域。支持向量机方法是建立在统计学习理论的VC维理论和结构风险最小原理基础上的，根据有限的样本信息在模型的复杂性(即对特定训练样本的学习精度)和学习能力(即无错误地识别任意样本的能力)之间寻求最佳折中，以建立识别模型。
具体地，步骤S12将步骤S11创建好的参考向量及其对应赋值使用支持向量机的多分类算法予以运算，根据支持向量机的特性，耗时时间可能从几分钟到一个月不等。根据目前软硬件情况以及支持向量机本身的特性，运行时间在几百的数量级，为可承受的计算时间成本。
在一具体实施例中，最终支持向量机会算出一个文本方式的展现结果，类似如下：
0#kernel type
3#kernel parameter-d
1#kernel parameter-g
1#kernel parameter-s
1#kernel parameter-r
empty#kernel parameter-u
50#highest feature index
500#number of training documents
101#number of support vectors plus 1
9.9308382#threshold b,each following line is a SV(starting with alpha*y)
-3.2864346412986876e-007 1:0 2:247 3:211 4:204 5:202 6:223 7:206 8:241 9:208 10:222
该文本方式的展现结果实质是关于若干所述多维函数关系组的相关方程系数，所述步骤S12将若干甚至是巨量的参考网页脚本文件压缩为一个多维函数关系组，该函数关系组仅包括方程、方程系数等函数关系的相关数据，从而实现了巨量的数据压缩和保存。
因此，将巨量样本数据根据一定的映射算法，映射到一个多维空间里，并且利用支持向量机的多分类算法，找出多个类之间的分割面，最后持久化保存这些分割面的方程组表现，达到将巨量样本数据压缩成一个多元函数关 系的结果。
图7示出根据本申请一优选的实施例示出的基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量，其中，所述步骤S13包括步骤S310、步骤S320以及步骤S330。
其中，在步骤S310中，获取所述待测网页脚本；在步骤S320中，对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；在步骤S330中，将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
在优选的实施例中，所述步骤S11将所述参考网页脚本映射至多维空间的参考向量以及步骤S13将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。其中，相同的映射规则包括基于相同的规则对参考网页脚本和待测网页脚本进行采样和量化，以使参考网页脚本和待测网页脚本能够映射在同一多维空间。
在优选的实施例中，所述步骤S320包括：
从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；以及
对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
在优选的实施例中，从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本包括：根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
具体地，继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，将待测网页脚本的特征信息都映射为以256*1024维的多维度空间中的待测向量，待测向量具有256*1024维度的向量坐标。
具体地，步骤S310获取若干所述待测网页脚本之后，步骤S320对所述待测网页脚本进行采样，其中对于小于256KB(字节)的待测网页脚本即获取该待测网页脚本的全部网页脚本，对于大于256KB的的待测网页脚本即截取该待测网页脚本的前256KB字节的部分网页脚本。然后，步骤S320再对 采样获得网页脚本中的各字符进行量化，以形成特征值，对于小于256KB的待测网页脚本，其形成的特征值的数量小于256*1024个，则不足数量的特征值可以用特殊的特征值标示，例如特征值为“0”标示。则经步骤S320量化后的每一待测网页脚本可获得具有256*1024数量的特征值组成的特征值集合，由步骤S130将每一所述待测网页脚本的特征值集合中的每一特征值依次作为向量的向量坐标，从而将每一待测网页脚映射为一个具有256*1024维度的向量。因而在后续可以根据参考向量的赋值的分布规律获取待测向量的赋值信息。
进一步的，在步骤S14中，根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
在优选的实施例中，步骤S14进一步包括：将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，将待测向量的256*1024维度的向量坐标代入前述的所述第二装置12获得的多维函数关系组中，则能够获得待测脚本所映射的待测向量所在区域，进而通过该区域的赋值，确定所述待测脚本的类型值。
因此，采用支持向量机获得关于多维空间中赋值的多维函数关系组，将待测网页脚本的特征通过支持向量机的多分类识别接口，即可得出分类值，从而获得待测网页脚本的网页入侵脚本特征类型。通过使用分类算法对参考网页脚本进行特征提取和空间映射，将参考网页脚本的特征及其网页入侵脚本特征类型映射为多维空间的向量及其赋值，并根据赋值对多维空间进行区域分布，则只需获得待测网页脚本所映射的区域的赋值即可获得待测网页脚本的网页入侵脚本特征类型。
图8示出根据本申请另一方面示出的网页入侵脚本特征的识别方法的流程示意图，在另一优选的实施例中，本申请所述网页入侵脚本特征的识别方法包括步骤S11’、步骤S12’、步骤S13’、步骤S14’以及步骤S15’。
其中，识别方法中步骤S11’、步骤S12’、步骤S13’以及步骤S14’与图1中步骤S11、步骤S12、步骤S13以及步骤S14的内容对应相同或基本相同，为简明起见，不再赘述，仅以引用的方式包含在此。
其中，步骤S15’利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。所述第五装置15’获得的剩余的网页脚本可以用于进一步确定所述待测网页脚本的网页入侵脚本特征类型，例如，当步骤S14’获得的网页入侵脚本特征类型为待确定类型时，则可以利用所述步骤S15’将待测网页脚本与从参考网页脚本中获得的剩余的网页脚本进行进一步比对，进一步检测其网页入侵脚本特征类型。
继续以所述网页入侵脚本特征识别方法基于建立对页脚本中前256KB字节字符的特征识别模型，即在一个以256*1024维的多维度空间进行建模为例，步骤S15’对于大于256KB的参考网页脚本的文件，将网页脚本中第256KB以后的字符按照正则表达式进行存储，以便于后续利用数据库中的正则表达式存储的参考网页脚本的内容对待测网页脚本进行进一步匹配，对分类算法获得的网页入侵脚本特征类型进行进一步匹配，以提高识别的准确性。
与现有技术相比，本申请所述网页入侵脚本特征的识别方法及设备通过将获取的一定数量的参考网页脚本及其特征信息映射为多维空间的参考向量及其赋值，根据所述参考向量及其赋值的分布获取多维空间中赋值的分布模型，当需要进行网页入侵特征脚本特征识别时，获取待测网页脚本并将待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量，只需将待测向量的特征信息输入至所述多维空间中赋值的分布模型即可获得待测网页脚本的网页入侵脚本特征，因此降低了对计算硬件的要求，并在保证对网页入侵脚本特征的识别准确性的同时大大缩小了识别时间。
进一步的，本申请所述网页入侵脚本特征的识别方法及设备还用从每个所述参考网页脚本的网页脚本中截取之后剩余的网页脚本进一步确定所述待测网页脚本的网页入侵脚本特征类型，进一步提高识别的准确性。
显然，本领域的技术人员可以对本申请进行各种改动和变型而不脱离本申请的精神和范围。这样，倘若本申请的这些修改和变型属于本申请权利要求及其等同技术的范围之内，则本申请也意图包含这些改动和变型在内。
需要注意的是，本申请可在软件和/或软件与硬件的组合体中被实施，例如，可采用专用集成电路(ASIC)、通用目的计算机或任何其他类似硬件设备来实现。在一个实施例中，本申请的软件程序可以通过处理器执行以实现上文所述步骤或功能。同样地，本申请的软件程序(包括相关的数据结构)可以被存储到计算机可读记录介质中，例如，RAM存储器，磁或光驱动器或软磁盘及类似设备。另外，本申请的一些步骤或功能可采用硬件来实现，例如，作为与处理器配合从而执行各个步骤或功能的电路。
另外，本申请的一部分可被应用为计算机程序产品，例如计算机程序指令，当其被计算机执行时，通过该计算机的操作，可以调用或提供根据本申请的方法和/或技术方案。而调用本申请的方法的程序指令，可能被存储在固定的或可移动的记录介质中，和/或通过广播或其他信号承载媒体中的数据流而被传输，和/或被存储在根据所述程序指令运行的计算机设备的工作存储器中。在此，根据本申请的一个实施例包括一个装置，该装置包括用于存储计算机程序指令的存储器和用于执行程序指令的处理器，其中，当该计算机程序指令被该处理器执行时，触发该装置运行基于前述根据本申请的多个实施例的方法和/或技术方案。
对于本领域技术人员而言，显然本申请不限于上述示范性实施例的细节，而且在不背离本申请的精神或基本特征的情况下，能够以其他的具体形式实现本申请。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本申请的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本申请内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。装置权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。

Claims (30)

  1. 一种网页入侵脚本特征的识别方法，其中，所述识别方法包括：
    基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；
    根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；
    基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及
    根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
  2. 根据权利要求1所述的识别方法，其中，将所述参考网页脚本映射至多维空间的参考向量以及将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。
  3. 根据权利要求1或2所述的识别方法，其中，基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量包括：
    获取若干所述参考网页脚本；
    对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值集合；以及
    将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
  4. 根据权利要求3所述的识别方法，其中，对所述参考网页脚本的特征进行采样和量化包括：
    从每个所述参考网页脚本中截取相同文本容量的参考网页脚本；以及
    对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
  5. 根据权利要求4所述的识别方法，其中，对从所述参考网页脚本截取的字符依次赋予特征值包括：
    根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征 值。
  6. 根据权利要求4或5所述的特征识别方法，其中，所述识别方法还包括：
    利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。
  7. 根据权利要求6所述的识别方法，其中，所述识别方法还包括：
    采用正则表达式对从每个所述参考网页脚本中截取之后剩余的参考网页脚本进行处理和存储。
  8. 根据权利要求1或7中任一项所述的识别方法，其中，基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量包括：
    获取所述待测网页脚本；
    对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；以及
    将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
  9. 根据权利要求8所述的识别方法，其中，对所述待测网页脚本的特征进行采样和量化包括：
    从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；以及
    对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
  10. 根据权利要求9所述的识别方法，其中，对所述截取的待测网页脚本的字符进行量化包括：
    根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
  11. 根据权利要求1至10中任一项所述的识别方法，其中，将所述多维空间进行划分包括：
    利用分类算法获取所述多维空间中赋值的分布模型。
  12. 根据权利要求11所述的识别方法，其中，所述分类算法包括支持向量机算法。
  13. 根据权利要求1至12中任一项所述的识别方法，其中，所述多维空间 中赋值的分布模型包括若干多维函数关系组。
  14. 根据权利要求13所述的识别方法，其中，根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值包括：
    将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
  15. 根据权利要求1至14中任一项所述的识别方法，其中，所述网页入侵脚本特征类型包括正常类型、异常类型及待定类型中的一种或任意组合。
  16. 一种网页入侵脚本特征的识别设备，其中，所述识别设备包括：
    第一装置，用于基于每个参考网页脚本的特征信息将所述参考网页脚本映射至多维空间的参考向量，其中，所述参考向量的赋值根据对应参考网页脚本的网页入侵脚本特征类型确定；
    第二装置，用于根据所述参考向量及其赋值的分布，获取多维空间中赋值的分布模型；
    第三装置，用于基于待测网页脚本的特征信息将所述待测网页脚本映射至多维空间的待测向量；以及
    第四装置，用于根据所述多维空间中赋值的分布模型确定所述待测向量所映射在所述多维空间中所对应的赋值，并根据该赋值确定对应待测网页脚本的网页入侵脚本特征类型。
  17. 根据权利要求16所述的识别设备，其中，所述第一装置将所述参考网页脚本映射至多维空间的参考向量以及第三装置将所述待测网页脚本映射至多维空间的待测向量基于相同的映射规则。
  18. 根据权利要求16或17所述的识别设备，其中，所述第一装置包括：
    第一单元，用于获取若干所述参考网页脚本；
    第二单元，用于对所述参考网页脚本进行采样和量化，以获取所述参考网页脚本的特征值集合；以及
    第三单元，用于将每一所述参考网页脚本的特征值集合映射至所述多维空间的参考向量。
  19. 根据权利要求18所述的识别设备，其中，所述第二单元包括：
    第一子单元，用于从每个所述参考网页脚本中截取相同文本容量的参考网 页脚本；以及
    第二子单元，用于对所述截取的参考网页脚本的字符进行采样和量化，以获取所述参考网页脚本的特征值集合。
  20. 根据权利要求19所述的识别设备，其中，所述第二子单元包括：
    第二一子单元，用于根据ASCII码规则将所采样的所述参考网页脚本的字符量化成相应特征值。
  21. 根据权利要求19或20所述的识别设备，其中，所述识别设备还包括：
    第五装置，用于利用从每个所述参考网页脚本中截取之后剩余的参考网页脚本确定所述待测网页脚本的网页入侵脚本特征类型。
  22. 根据权利要求21所述的识别设备，其中，所述识别设备还包括：
    第六装置，用于采用正则表达式对从每个所述参考网页脚本中截取之后剩余的参考网页脚本进行处理和存储。
  23. 根据权利要求16至22中任一项所述的识别设备，其中，所述第三装置包括：
    第四单元，用于获取所述待测网页脚本；
    第五单元，用于对所述待测网页脚本进行采样和量化，以获取所述待测网页脚本的特征值集合；以及
    第六单元，用于将所述待测网页脚本的特征值集合映射至所述多维空间的待测向量。
  24. 根据权利要求23所述的识别设备，其中，所述第五单元包括：
    第三子单元，用于从所述待测网页脚本中截取与所述参考网页脚本所截取的参考网页脚本相同文本容量的待测网页脚本；以及
    第四子单元，用于对所述截取的待测网页脚本的字符进行采样和量化，以获取所述待测网页脚本的特征值集合。
  25. 根据权利要求24所述的识别设备，其中，所述第四子单元包括：
    第四一子单元，用于根据ASCII码规则将所采样的所述待测网页脚本的字符量化成相应特征值。
  26. 根据权利要求16至25中任一项所述的识别设备，其中，所述第二装置包括：
    第七单元，用于利用分类算法获取所述多维空间中赋值的分布模型。
  27. 根据权利要求26所述的识别设备，其中，所述分类算法包括支持向量机算法。
  28. 根据权利要求16至27中任一项所述的识别设备，其中，所述多维空间中赋值的分布模型包括若干多维函数关系组。
  29. 根据权利要求28所述的识别设备，其中，所述第四装置包括：
    第八单元，用于将所述待测向量的赋值代入所述若干多维函数关系组，利用解析几何原理获取所述待测向量所映射在所述多维空间中所对应的赋值。
  30. 根据权利要求15至29中任一项所述的识别设备，其中，所述网页入侵脚本特征类型包括正常类型、异常类型及待定类型中的一种或任意组合。
PCT/CN2016/073148 2015-02-10 2016-02-02 网页入侵脚本特征的识别方法及设备 Ceased WO2016127858A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510069899.7A CN105989284B (zh) 2015-02-10 2015-02-10 网页入侵脚本特征的识别方法及设备
CN201510069899.7 2015-02-10

Publications (1)

Publication Number Publication Date
WO2016127858A1 true WO2016127858A1 (zh) 2016-08-18

Family

ID=56614997

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/073148 Ceased WO2016127858A1 (zh) 2015-02-10 2016-02-02 网页入侵脚本特征的识别方法及设备

Country Status (2)

Country Link
CN (1) CN105989284B (zh)
WO (1) WO2016127858A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107346388A (zh) * 2017-07-03 2017-11-14 四川无声信息技术有限公司 Web攻击检测方法及装置
CN114244779A (zh) * 2021-12-14 2022-03-25 湖北天融信网络安全技术有限公司 一种流量的识别方法及装置、存储介质

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112364229A (zh) * 2020-11-30 2021-02-12 上海二三四五网络科技有限公司 一种在业务开发中基于特征脚本化的算法实现的控制方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20130077184A (ko) * 2011-12-29 2013-07-09 주식회사 시큐아이 악성코드에 감염된 홈페이지 탐지 장치 및 방법
CN103294952A (zh) * 2012-11-29 2013-09-11 北京安天电子设备有限公司 一种基于页面关系检测webshell的方法及系统
KR20140042478A (ko) * 2012-09-28 2014-04-07 주식회사 이지시큐어 스크립트 난독화 처리 기능을 이용한 웹쉘 탐지 장치 및 그 방법
CN103973664A (zh) * 2013-01-28 2014-08-06 信息安全有限公司 网络木马后门探测/应对系统
CN104331663A (zh) * 2014-10-31 2015-02-04 北京奇虎科技有限公司 web shell的检测方法以及web服务器

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102024179A (zh) * 2010-12-07 2011-04-20 南京邮电大学 一种基于半监督学习的ga-som聚类方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20130077184A (ko) * 2011-12-29 2013-07-09 주식회사 시큐아이 악성코드에 감염된 홈페이지 탐지 장치 및 방법
KR20140042478A (ko) * 2012-09-28 2014-04-07 주식회사 이지시큐어 스크립트 난독화 처리 기능을 이용한 웹쉘 탐지 장치 및 그 방법
CN103294952A (zh) * 2012-11-29 2013-09-11 北京安天电子设备有限公司 一种基于页面关系检测webshell的方法及系统
CN103973664A (zh) * 2013-01-28 2014-08-06 信息安全有限公司 网络木马后门探测/应对系统
CN104331663A (zh) * 2014-10-31 2015-02-04 北京奇虎科技有限公司 web shell的检测方法以及web服务器

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107346388A (zh) * 2017-07-03 2017-11-14 四川无声信息技术有限公司 Web攻击检测方法及装置
CN107346388B (zh) * 2017-07-03 2020-06-02 四川无声信息技术有限公司 Web攻击检测方法及装置
CN114244779A (zh) * 2021-12-14 2022-03-25 湖北天融信网络安全技术有限公司 一种流量的识别方法及装置、存储介质

Also Published As

Publication number Publication date
CN105989284A (zh) 2016-10-05
CN105989284B (zh) 2019-01-11

Similar Documents

Publication Publication Date Title
RU2722692C1 (ru) Способ и система выявления вредоносных файлов в неизолированной среде
CN106055574B (zh) 一种识别非法统一资源标识符url的方法与装置
US9697423B1 (en) Identifying the lines of a table
CN112148305B (zh) 一种应用检测方法、装置、计算机设备和可读存储介质
WO2021147559A1 (zh) 业务数据质量检测方法、装置、计算机设备及存储介质
CN107659570A (zh) 基于机器学习与动静态分析的Webshell检测方法及系统
CN105183912A (zh) 异常日志确定方法和装置
CN113312361B (zh) 轨迹查询方法、装置、设备、存储介质及计算机程序产品
CN106295333A (zh) 用于检测恶意代码的方法和系统
CN111460447B (zh) 恶意文件检测方法、装置、电子设备与存储介质
CN115827257A (zh) 用于处理器体系的cpu容量预测方法及其系统
WO2016127858A1 (zh) 网页入侵脚本特征的识别方法及设备
US9646157B1 (en) Systems and methods for identifying repackaged files
JP7031438B2 (ja) 情報処理装置、制御方法、及びプログラム
CN115080955A (zh) 目标数据过滤方法、装置、电子设备及存储介质
CN116192462B (zh) 一种基于pe文件格式的恶意软件分析方法及装置
CN113868660B (zh) 恶意软件检测模型的训练方法、装置以及设备
CN108875374B (zh) 基于文档节点类型的恶意pdf检测方法及装置
CN114124913B (zh) 一种网络资产变化监控的方法、装置及电子设备
CN116405250A (zh) 网站识别方法、装置及电子设备
CN116150750A (zh) 一种恶意软件检测方法、装置、电子设备及存储介质
CN105229668B (zh) 使用手势对线图案表示的搜索
CN115934571A (zh) 基于贝叶斯分类算法的接口测试用例生成方法及装置
CN108009233B (zh) 一种图像还原方法、装置、计算机设备及存储介质
CN107608947B (zh) Html文件处理方法及装置、电子设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16748659

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16748659

Country of ref document: EP

Kind code of ref document: A1