WO2020199905A1 - 命令检测方法、装置、计算机设备以及存储介质 - Google Patents

命令检测方法、装置、计算机设备以及存储介质 Download PDF

Info

Publication number
WO2020199905A1
WO2020199905A1 PCT/CN2020/079484 CN2020079484W WO2020199905A1 WO 2020199905 A1 WO2020199905 A1 WO 2020199905A1 CN 2020079484 W CN2020079484 W CN 2020079484W WO 2020199905 A1 WO2020199905 A1 WO 2020199905A1
Authority
WO
WIPO (PCT)
Prior art keywords
command
commands
target
degree information
suspicious degree
Prior art date
Application number
PCT/CN2020/079484
Other languages
English (en)
French (fr)
Inventor
张尧
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2020199905A1 publication Critical patent/WO2020199905A1/zh
Priority to US17/320,015 priority Critical patent/US20210264023A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software

Definitions

  • This application relates to the field of network technology, and in particular to a command detection method, device, computer equipment, and storage medium.
  • the attacker’s intrusion channels are numerous, but no matter what, once the infiltration is completed, the corresponding operation will be performed to achieve the purpose of the intrusion.
  • This type of operation can be achieved by issuing malicious commands.
  • Traditional defense methods often detect the commands reported by the server, for example, match the reported commands with a set of known malicious commands to learn which commands are malicious.
  • the malicious command set is also easy to be known by the attacker, the attacker often uses the grammatical function allowed by default under the operating system to grammatically deform the actual running command, so as to achieve the effect of intuitively unable to read and understand.
  • the above technique is called command confusion here.
  • the use of command confusion will result in the complete failure of traditional defense detection methods. Therefore, there is an urgent need for a command detection method that can improve the detection accuracy.
  • a command detection method, device, computer equipment, and readable storage medium are provided.
  • a command detection method executed by a computer device, the method includes:
  • multiple commands to be detected are detected to determine multiple target commands, and each target command has one or more first features.
  • the target command is determined as a confused command.
  • a command detection device is set in computer equipment, and the device includes:
  • the detection module is used to detect multiple commands to be detected based on multiple first features of known confusion commands and multiple second features of normal business commands, and determine multiple target commands.
  • Each target command has one Or commands with multiple first features but not any second feature;
  • the text format acquisition module is used to acquire the running text of multiple target commands
  • the suspicious degree information acquisition module is used to acquire the suspicious degree information of multiple target commands based on multiple target commands and corresponding running texts, where the suspicious degree information is used to indicate the possibility that the command is a confusing command;
  • the command determining module is used to determine the target command as a confused command when the suspicious degree information of any target command meets the target condition.
  • a computer device including one or more processors and a memory, and at least one computer readable instruction is stored in the memory, and the computer readable instruction is loaded and executed by one or more processors to implement the command detection method as described above .
  • One or more computer-readable storage media, and at least one computer-readable instruction is stored in the computer-readable storage medium, and the computer-readable instruction is loaded and executed by one or more processors to implement the command detection method as described above.
  • FIG. 1 is a schematic diagram of an implementation environment of a command detection method provided by an embodiment of the present application
  • FIG. 2 is a flowchart of a command detection method provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of a command detection method provided by an embodiment of the present application.
  • FIG. 4 is an example diagram of obtaining suspicious degree information provided by an embodiment of the present application.
  • Fig. 5 is an example diagram of obtaining suspicious degree information provided by an embodiment of the present application.
  • FIG. 6 is an example diagram of data flow in a detection process provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a command detection device provided by an embodiment of the present application.
  • Fig. 8 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • FIG. 1 is a schematic diagram of an implementation environment of a command detection method provided by an embodiment of the present application.
  • the implementation environment may include equipment such as at least one server 101, at least one server 102, and an administrator terminal.
  • at least one server 101 can be used to provide business services for users, and the at least one server 101 can report to at least one server 102 based on commands run on the server, and the reported content can include the full amount of running data, and also That is, the running command, the process related to the command, the network connection, and so on.
  • the aforementioned reporting may also be performed by a data collector (such as an agent) configured by the server 101.
  • the at least one server 102 may detect multiple commands to be detected based on the reported commands, by using multiple first features of known obfuscated commands and multiple second features of normal business commands to determine multiple target commands, In order to achieve preliminary screening of commands, some target commands that are suspected to be obfuscated commands are obtained, and then the running text of these target commands is obtained to learn the operations performed by these target commands at runtime, based on the target command and running text , To determine the suspicious degree information of the target command. The suspicious degree information can be used to determine whether the target command is a confusing command. After the confusing command is determined, the determined confusing command can also be alerted, for example, to the administrator’s terminal. The relevant server performs alarms, etc.
  • the server 102 may also send the determined obfuscation command to the administrator terminal for manual detection by a technician to determine whether it is an obfuscation command, and then determine whether to issue a further alarm.
  • database storage may also be involved.
  • the commands reported by the server can be stored in the target database after preliminary screening.
  • the running state text can also be stored in the target database, so that the target database is used as the basis for further command detection, etc. This embodiment of the application does not Make specific restrictions.
  • Fig. 2 is a flowchart of a command detection method provided by an embodiment of the present application.
  • a computer device is now taken as an example of the execution subject of the method, and the embodiment specifically includes the following steps:
  • the above-mentioned multiple first features are features extracted based on known confusion commands, and the second feature is features extracted based on known normal business commands.
  • the purpose of screening is achieved, and the target obtained Commands are some suspected obfuscated commands.
  • the number of subsequent commands that need to be processed can be reduced.
  • the running state text is used to describe the operations performed by the target command during operation, and can reflect what operations a command will perform in actual operation, so that it can be known whether the command is a confusing command based on the operation corresponding to the command.
  • the target command and the corresponding runtime text can indicate the target command itself and the corresponding operation during its real runtime. Therefore, it is possible to know whether the command has been obfuscated based on the comparison of the above information and other methods. For example, it is possible to comprehensively determine whether the command is a confusing command based on the text difference between the command and the running text, the characteristics of the command itself, and whether the command is some preset command.
  • the target device can be alerted based on system settings. For example, if the system is set to alert the source server, the source server of the target command can be determined, and The alarm information is sent to the source server, and the alarm information may include the target command itself or related processes of the target command. Of course, if the system is set to alert the administrator terminal, the alarm information can be sent to the administrator terminal. At this time, the alarm information can include the target command itself, the source server, and of course the related process of the target command, etc. So that the administrator terminal can locate the target command.
  • the embodiment of this application proposes a real-time detection method of obfuscated commands with operability for large-scale server application scenarios, which greatly improves the defense effect and provides a more flexible detection method.
  • the embodiment of the present application combines the analysis of the static and dynamic obfuscation attributes of the command. First, for the reported command, the first feature based on the known obfuscation command and the second feature based on the normal business command will be used. , Perform static feature matching and screening, which significantly reduces the scale of data analysis, thereby making real-time command detection possible, and by obtaining the running text of the command, it achieves a certain degree of de-obfuscation function and avoids semantic analysis.
  • Fig. 3 is a flowchart of a command detection method provided by an embodiment of the present application.
  • a computer device is now taken as an example of the execution subject of the method.
  • the embodiment specifically includes the following steps:
  • the multiple first features can be acquired according to the following process: multiple known obfuscation commands are acquired, and common features of the multiple known obfuscation commands are determined as the first feature, and the first feature can be used to indicate confusion
  • the type can correspond to one or more first characteristics.
  • the multiple known confusion commands can be clustered to obtain multiple command sets. For any command set, determine the known cluster center The confusion command is to analyze the known confusion commands of the cluster center, and extract the confusion type obtained by the analysis as the first feature corresponding to the command set.
  • the common features of different granularities of the multiple known obfuscation commands are extracted.
  • the first feature of each obfuscation method can also be updated to improve accuracy.
  • the above-mentioned known obfuscation commands may be configured by a technician based on the historical operation of the server or collected from the network.
  • the embodiment of the present application does not limit the source of these known obfuscation commands as malicious samples.
  • the server can collect and report commands through a data collector arranged on the server side.
  • You can also upload the execution process of the command, the parent process, etc., process status, event time, business information, and network connection operating data.
  • the computer device may first extract the commands in the running data, and then input each command into the feature filter ring composed of the multiple first features, and each command is matched with each first feature on the feature filter ring , When any command matches any feature successfully, the command will be output as the screening result to the next feature matching process.
  • the above-mentioned feature matching process can be based on the number of first features to copy multiple commands to be detected to obtain multiple copies, and each copy contains the multiple commands to be detected, and each copy contains All commands to be detected are feature-matched with the same first feature to determine the command matching the first feature among the multiple commands to be detected, so as to ensure that all commands to be detected and all first features have been matched. Process, to ensure that no confusion commands will be missed.
  • the above-mentioned feature matching process can determine some static features used to represent the type of confusion based on known confusion commands to represent some common features of known confusion commands, and filter the reported commands based on these static characteristics, and you can eliminate the lack of Obfuscate regular commands for features and output commands that match these static features.
  • the aforementioned multiple first features may include but are not limited to the following features:
  • variable name is confused, that is, there is use Symbol assignment operation, and repeat at least once in the same command.
  • IFS abuse that is, the use of predefined "IFS" character variables to split the original command to achieve the purpose of confusion.
  • IFS predefined "IFS” character variables
  • Displacement control that is, use the displacement selection syntax allowed by the Linux environment to hide the actual executed command characters. Take the original command "cat/etc/passwd" as an example, an example of the confused command:
  • Base64 encoding that is, using base64 encoding to hide the executed commands.
  • Rot13 encryption that is, the use of replacement encryption to hide the executed commands. Take the original command "cat/etc/passwd” as an example, and the example of the obfuscated command: " ⁇ echo png/rgp/cnffjq
  • Reverse order method that is, use the rev function to reverse the original order to achieve confusion and deformation. Take the original command "cat/etc/passwd” as an example, and an example of the confused command: " ⁇ echo dwssap/cte/tac
  • Echo bypass that is, use the echo command to achieve the effect of hiding the original command. Take the original command "cat/etc/passwd" as an example, an example of the confused command:
  • the first feature may be increased or decreased with the detection of the confusion command, which is not limited in the embodiments of the present application.
  • the plurality of second characteristics may be acquired according to the following process: acquiring a plurality of known normal service commands, and determining common characteristics of the plurality of known normal service commands as the second characteristic.
  • the corresponding second feature will be continuously updated and maintained.
  • the second feature corresponding to the first feature can be updated according to the first feature matched by the command.
  • the specific update process is the same as the feature acquisition process. Do not repeat it here.
  • the above determination that any command is a normal business command can be determined in a false alarm scenario, so that the computer device can update the second feature based on the false alarm, that is, the method further includes: False alarm notification of a command, the false alarm notification is used to indicate that the command is alarmed as a confused command but is actually a normal business command, and the first characteristic corresponding to the first characteristic can be updated based on the first characteristic matched by the command.
  • the second feature for example, use the command as one of the normal business commands for obtaining the second feature corresponding to the first feature, and re-acquire the second feature.
  • the false negative notification when a false negative notification of any command is received, the false negative notification is used to indicate that the command is determined to be a normal business command but is actually a confusing command, which can be based on the first characteristic matched by the command,
  • To update the second feature corresponding to the first feature for example, delete the command from the normal service command of the second feature corresponding to the first feature, and re-acquire the second feature.
  • the first command when any command matches the first feature, it does not mean that the first command is indeed an obfuscated command.
  • the first command may also be a normal business command. Therefore, Based on the process of steps 302 and 303, the first command is further judged based on the characteristics of the normal service command, so as to reduce the misjudgment rate and improve the accuracy of detection.
  • the computer device may mark the first command based on the matching result, for example, add a characteristic marker of the matched first characteristic to the first command, so as to be based on the second characteristic.
  • the first command can be matched with the target second feature of the first command according to the feature identifier of each first command to achieve further judgment.
  • each first command perform feature matching on multiple first commands to determine multiple target commands, each of which has one or more first features but not any second Characteristic commands.
  • the step 303 may include: according to the target second feature of each first command, performing feature matching on the multiple first commands to determine the multiple second commands, and the second command is A first command with any target second feature; filtering out the plurality of second commands from the plurality of first commands to obtain the plurality of target commands.
  • the above steps 301 to 303 are the process of detecting multiple commands to be detected and determining multiple target commands based on multiple first features of known confusion commands and multiple second features of normal business commands.
  • the multiple first features are regarded as a gray feature filter ring
  • the multiple second features are regarded as a white feature filter ring.
  • these suspicious target commands can be stored in the target database to avoid loss during data processing.
  • the database fields can include command information required for analysis and prompt information required for sending work orders, including but not limited to: (1) command; (2) command execution process And the parent process, etc., can be used as the data basis for subsequent alarms and business analysis; (3) Event time; (4) Business information, such as the person in charge of the machine, the region to which it belongs, and the corresponding IP, can be used as the data basis for subsequent alarms and business analysis; (5) The feature marker of the first feature that is successfully matched can be used as the basis for subsequent acquisition of suspicious degree information.
  • the item may not be stored in the target database; (6) ) The running text of the command obtained by the sandbox restore.
  • this part can be preset to be empty.
  • the embodiment of the present application uses the target database to store the target command to avoid the loss of the target command, and the storage based on the target database can be more conducive to the parallel processing of the command, and in some embodiments,
  • the target command may not be stored in the form of a database, but may be stored in a form such as a queue.
  • the embodiment of the present application does not limit the specific form of storage.
  • the sandbox debugging program can provide a relatively independent operating environment, so that the commands running in the sandbox debugging program will not affect the operation of the system, and can be regarded as an experimental environment.
  • the computer device can import multiple target commands into the sandbox debugging program one by one, so that the sandbox debugging program executes each target command, and records the running state text during the script debugging execution process one by one.
  • the computer device can execute multiple target commands in parallel based on multiple sandbox debugging programs, and record the running state text of each sandbox debugging program during the script debugging execution process.
  • a processing queue can be set for each sandbox debugger, multiple target commands can be extracted from the target database, and multiple target commands can be listed in the processing queue of each sandbox debugger. Based on the first-in-first-out principle, Each sandbox debugger to execute multiple target commands.
  • the foregoing example is only an example of the command execution mode of the sandbox debugging program, and the embodiment of the present application does not limit the specific implementation.
  • the sandbox debugging program may not be implemented on the computer device, but on other computer devices, to avoid excessive occupation of the processing resources of the current computer device, and to relatively speed up the command detection process .
  • the computer device can be a device with a firewall
  • the other computer devices can also be devices with a firewall, so that the firewall can block and protect some malicious behaviors during operation, and further improve the security of detection .
  • the computer device can use the "sh-x" method to execute the sh script containing the command, and record the running state text during the debugging and execution of the script.
  • the sh_x_sandbox_test.sh script file is a variable substitution type obfuscated command
  • the running text can be obtained by executing "sh-x". Taking the original command "cat/etc/passwd” as an example, the running text obtained can be +cat/etc/passwd (such as the last line of the code).
  • the processing speed of the sandbox debugger can also be accelerated.
  • the target duration of each target command can be set as the maximum execution duration for the sandbox debugger, so that the sandbox debugger can execute any target.
  • the execution time of the command is less than the target duration.
  • the code that calls the sandbox debugger can be changed so that the code does not execute any target command, that is, the bash code that executes the sandbox debugger can be modified, and the code logic of the execution part can be commented out. To achieve the purpose of not executing any target command.
  • the running text of the actually executed command can be restored to achieve the purpose of de-obfuscation, so that the running text obtained by the restoration can be used to obtain subsequent suspicious degree information.
  • the computer device After the computer device obtains the running text of any target command, it can update the target database based on the running text of the target command, so that the data item corresponding to the target command contains the command itself and the result of the de-obfuscation of the command. That is, the running state text.
  • the computer device can obtain the target database from the target database.
  • the computer device can obtain the suspicious degree information of the multiple target commands according to one of the following information or a combination of any two information:
  • the computer device can obtain the suspicious degree information of the first feature matched by the multiple target commands; perform the suspicious degree information of the first feature of the multiple target commands separately Accumulate, obtain the suspicious degree information of the multiple target commands.
  • the suspicious degree information of each first feature can be preset to be used when acquiring.
  • the suspicious degree information corresponding to the suspicious degree information of the first feature can be used as the suspicious degree information of the target command, and when the first characteristic matched by a target command is When there are a plurality of characteristics, the suspicious degree information may be obtained based on the suspicious degree information of the plurality of first characteristics.
  • the first feature itself may be provided with suspicious degree information, so that the suspicious degree information of the target command may be a cumulative value of the suspicious degree information of the first feature.
  • the corresponding obfuscation type may also be obtained based on the number of first features contained in the obfuscation type matched by the target command and the total number of first features matched. Weight to get the suspicious degree information of the target command. For example, when the total number of first features matched by the target command is L, where the first feature number of the first confusion type is M, and the first feature number of the second confusion type is N, then M/L can be used as the first The weight of the confusion type, N/L is used as the weight of the second confusion type.
  • the suspicious degree information is set for the confusion type, for a target command, the confusion type corresponding to the first feature it matches can be determined, and then the suspicious degree information corresponding to the confusion type can be accumulated to obtain the target The suspicious degree information of the command. If IFS abuse and base64 encoding are high-risk features, you can set the suspicious degree information to 1. When the target command matches the two confusion types of IFS abuse and base64 encoding, the suspicious degree information of the target command can be obtained as 2.
  • the computer device can obtain the text difference between the multiple target commands and the corresponding running text;
  • the text difference and the text difference threshold determine the suspicious degree information of the multiple target commands. Since the running text is actually a de-obfuscated command, a text comparison between the command and the de-obfuscated command can determine whether there is a change before and after the command. If a significant change occurs, it may be due to The target command is an obfuscated command.
  • the SimHash algorithm can be used to calculate the simhash value of the target command and the running state format returned by the sandbox debugging program, and calculate the Hamming distance between the two, if the Hamming distance between the two exceeds the preset If the text difference threshold is considered to be significant before and after sandbox debugging, the target value can be obtained as the suspicious degree information.
  • the suspicious degree information can also be obtained based on the significant degree of the text difference, that is, for different texts The degree of difference is set with different suspicious degree information.
  • the suspicious degree information can also be expressed by a numeric value, that is, determine the text difference value between the command and the running text. To determine the suspicious degree value corresponding to the numerical range of, and obtain the suspicious degree information of the target command.
  • the computer device can match the preset command based on the running text of the multiple target commands.
  • the suspicious degree information of the target command is obtained according to the matching situation of the target command.
  • the high-risk command baseline can be set based on these commands, that is, some commands can be set in advance as a reference to measure whether the target command is a confusing command. If one of the running text and the preset command is If one or more combinations are successfully matched, the target value can be obtained as the suspicious degree information. Of course, it can also be accumulated according to the suspicious degree information corresponding to the matched preset command to obtain the suspicious degree information of the target command.
  • the above (1)-(3) describes how to obtain the suspicious degree information of the target command based on any one of these three types of information.
  • at least two of the above three types of information can also be combined to obtain The suspicious degree information of the target command.
  • the computer device may obtain the first suspicious degree information based on the first feature matched by the target command provided in (1), obtain the second suspicious degree information based on the text difference provided in (2), and obtain the second suspicious degree information based on (3)
  • the matching information is provided to obtain the third suspicious degree information, and the cumulative value of the first suspicious degree information, the second suspicious degree information, and the third suspicious degree information are used as the suspicious degree information of the target command to combine static and dynamic characteristics To determine whether the target command is a confusing command, the possibility of misjudgment is greatly reduced, and the detection accuracy is improved.
  • the computer device determines the target command as a confusion command.
  • the target condition may be that the suspicious degree information is greater than the suspicious degree threshold.
  • the suspicious degree information may also be expressed by the suspicious degree, and the target condition may also be that the suspicious degree information is greater than the suspicious degree threshold. Not limited.
  • any target command in the process of obtaining the suspicious degree information in step 307, there can be a process as shown in Figure 4, that is, whenever a part of the suspicious degree information is obtained, the obtained suspicious degree information is performed Monitoring, when the obtained suspicious degree information meets the target conditions, the target command is determined to be a confusion command without waiting for all the acquisition processes to be completed, that is, when the information based on (1)-(3) in step 307 above
  • the target command is directly determined as a confusion command, and no other acquisition process is required to reduce the calculation pressure of the computer equipment. If the obtained suspicious degree information does not meet the target condition, continue to obtain the suspicious degree information based on the next method.
  • the above-mentioned process of obtaining suspicious degree information can also be performed in multiple ways in parallel, and the suspicious degree information obtained in multiple ways is accumulated to obtain the suspicious degree information of the command.
  • each command is used based on the target command.
  • the above methods (1), (2) and (3) are used to obtain the corresponding suspicious degree information, and then obtain the cumulative value of the suspicious degree information obtained by the three methods, as the suspicious degree information of the target command, and then based on whether it meets The target condition determines whether it is an obfuscated command.
  • any target command is determined to be an obfuscated command or a non-obfuscated command
  • the target command is deleted from the target database to save storage space.
  • the computer device can alert the source server of the target command based on the business information of the target command determined as the obfuscated command.
  • the target command For the target command, the target command’s business information is stored in the target database, and the business information can be The IP information of the server is stored. Therefore, for computer equipment, an alarm can be realized based on this information.
  • the alarm can be an alarm to the source server or an alarm to the system administrator, which is not done in the embodiment of this application. limited. When an alarm is issued, it can be returned to the system administrator or the user to which the server belongs through the form of mobile terminal or web page warning information.
  • an emergency response process can be carried out to ensure operational safety. And if any alarm is determined to be a false alarm, the corresponding target command can be added to the normal service command to update the second feature involved in step 302 to improve the accuracy of subsequent detection.
  • the above process can also refer to the data flow diagram shown in FIG. 6.
  • the data flow diagram intuitively embodies the processing flow from steps 301 to 309.
  • the data reported by the agent can be filtered based on the first feature, which is the gray feature, and then the second feature is the white feature.
  • the second level of filtering is to store the filtered commands in the database, and then perform sandbox debugging based on the commands stored in the database to obtain the running text of each command, and make comprehensive judgments based on the command and the running text, and then output Judgment results, and based on the judgment results, targeted and timely warnings can be achieved.
  • the embodiment of this application proposes a real-time detection method of obfuscated commands with operability for large-scale server application scenarios, which greatly improves the defense effect and provides a more flexible detection method.
  • the embodiment of the present application combines the analysis of the static and dynamic obfuscation attributes of the command. First, for the reported command, the first feature based on the known obfuscation command and the second feature based on the normal business command will be used. , Perform static feature matching and screening, which significantly reduces the scale of data analysis, thereby making real-time command detection possible, and by obtaining the running text of the command, it achieves a certain degree of de-obfuscation function and avoids semantic analysis.
  • the embodiment of the present application also comprehensively considers the static confusion characteristics of the reported data itself, the degree of difference in the format of the command text before and after the sandbox analysis, and whether the command is abnormal after de-obfuscation, etc., and finally determines whether it is Confusion exists, which can greatly improve the accuracy of detection.
  • Fig. 7 is a schematic structural diagram of a command detection device provided by an embodiment of the present application.
  • the device may be a computer device or set on a computer device.
  • the device includes various modules or units, and each module or unit can be implemented in whole or in part by software, hardware or a combination thereof. Referring to Figure 7, the device includes:
  • the detection module 701 is used to detect multiple commands to be detected based on multiple first features of known obfuscated commands and multiple second features of normal business commands, and determine multiple target commands, each of which has Commands for one or more first characteristics but not any second characteristics.
  • the text format obtaining module 702 is used to obtain the running text of multiple target commands.
  • the suspicious degree information acquisition module 703 is configured to acquire suspicious degree information of multiple target commands based on multiple target commands and corresponding running texts, where the suspicious degree information is used to indicate the possibility that the command is a confusing command.
  • the command determination module 704 is configured to determine the target command as a confused command when the suspicious degree information of any target command meets the target condition.
  • the detection module 701 includes:
  • the first feature matching unit 7011 is configured to perform feature matching on multiple commands to be detected based on multiple first features, and determine a first command that is successfully matched with any one of the multiple first features.
  • the second feature determining unit 7012 is configured to determine the target second feature of each first command according to the first feature matched by each first command, where the target second feature refers to at least one second feature corresponding to the first feature .
  • the target command determining unit 7013 is configured to perform feature matching on multiple first commands according to the target second feature of each first command to determine multiple target commands.
  • the target command determining unit 7013 is configured to perform feature matching on multiple first commands according to the target second feature of each first command, and determine multiple second commands.
  • the text format obtaining module 702 is used to import multiple target commands into the sandbox debugging program, execute multiple target commands through the sandbox debugging program, and record the running state text during the script debugging execution process.
  • the device further includes:
  • the storage module 705 is configured to store multiple target commands in a target database, and the target database is used to store the target commands and the corresponding running state text.
  • the storage module 705 is further configured to store the running text in the storage location of the first target command in the target database when the running text of the first target command is obtained.
  • the execution time for the sandbox debugger to execute any target command is less than the target duration; or, the code that calls the sandbox debugger is changed so that the code does not execute any target command.
  • the device further includes: a deletion module 706, configured to delete the second target command from the target database when the second target command is determined to be an obfuscated command or a non-obfuscated command.
  • the suspicious degree information obtaining module 703 is configured to obtain the suspicious degree information of multiple target commands according to the following information or a combination of any two information:
  • the suspicious degree information acquisition module 703 includes a first acquisition unit 7021 configured to acquire the suspicious degree information of the first feature matched by a plurality of target commands; for any target command, The suspicious degree information of the first feature of any target command is accumulated to obtain the suspicious degree information of any target command.
  • the suspicious degree information acquisition module 703 includes a second acquisition unit 7022, which is used to acquire text differences between multiple target commands and corresponding running texts; The text difference and the text difference threshold determine the suspicious degree information of multiple target commands.
  • the suspicious degree information acquisition module 703 includes a third acquisition unit 7023, which is configured to match a preset command based on the running text of a plurality of target commands.
  • the third target command is executed
  • the suspicious degree information of the third target command is obtained according to the matching situation of the third target command.
  • the device further includes: an alarm module 707, configured to alarm the source server of the target command.
  • Fig. 8 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
  • the computer device may be the server 102 in the implementation environment shown in FIG. 1.
  • the computer device 800 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 801 and one or more memories 802, wherein the memory 802 stores At least one computer-readable instruction is loaded and executed by the one or more processors 801 to implement the command detection method provided in each method embodiment described above.
  • the computer device may also have components such as a wired or wireless network interface, a keyboard, and an input/output interface for input and output, and the computer device may also include other components for implementing device functions.
  • one or more computer-readable storage media are also provided, such as a memory including computer-readable instructions, which can be executed by one or more processors in a computer device to implement the foregoing implementations.
  • the command detection method in the example can be a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a CD-ROM (Compact Disc Read-Only Memory, CD-ROM), Tapes, floppy disks and optical data storage devices, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • User Interface Of Digital Computer (AREA)
  • Debugging And Monitoring (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

一种命令检测方法，包括：基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令；获取多个目标命令的运行态文本；基于多个目标命令以及对应的运行态文本，获取多个目标命令的可疑程度信息，其中，可疑程度信息用于表示命令为混淆命令的可能性；当任一个目标命令的可疑程度信息符合目标条件，将目标命令确定为混淆命令。

Description

命令检测方法、装置、计算机设备以及存储介质
本申请要求于2019年03月29日提交中国专利局，申请号为2019102493608，申请名称为“命令检测方法、装置、计算机设备以及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络技术领域，特别涉及一种命令检测方法、装置、计算机设备以及存储介质。
背景技术
互联网应用与人们的生活正变得密不可分，而支撑每一款网络应用的背后，是数以万计的服务器。用户的个人数据、业务的商业数据也存储于这些服务器中。如何保障服务器的运行安全，对于每一家互联网公司来说，都变得尤为重要。
攻击者的入侵渠道不胜枚举，但不管如何，一旦完成渗透，则一定会执行相应操作，从而达到入侵的目的。这类操作可以通过下发恶意命令来实现。传统的防御手段，往往会对服务器所上报的命令进行检测，例如，将上报的命令与已知的恶意命令集合进行匹配，以获知哪些命令是恶意命令。但是，由于恶意命令集合也很容易被攻击者获知，攻击者往往会利用操作系统下默认允许的语法功能，对实际运行的命令进行语法变形，从而达到直观无法阅读和理解的效果。上述技术，这里称之为命令混淆。命令混淆的使用，会导致传统的防御检测手段彻底失效。为此，亟需一种能够提高检测准确率的命令检测方法。
发明内容
根据本申请提供的各种实施例，提供了一种命令检测方法、装置、计算机设备以及可读存储介质。
一种命令检测方法，由计算机设备执行，方法包括：
基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令；
获取多个目标命令的运行态文本；
基于多个目标命令以及对应的运行态文本，获取多个目标命令的可疑程度信息，其中，可疑程度信息用于表示命令为混淆命令的可能性；
当任一个目标命令的可疑程度信息符合目标条件，将目标命令确定为混淆命令。
一种命令检测装置，设置于计算机设备，装置包括：
检测模块，用于基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令；
文本格式获取模块，用于获取多个目标命令的运行态文本；
可疑程度信息获取模块，用于基于多个目标命令以及对应的运行态文本，获取多个目标命令的可疑程度信息，其中，可疑程度信息用于表示命令为混淆命令的可能性；
命令确定模块，用于当任一个目标命令的可疑程度信息符合目标条件，将目标命令确定为混淆命令。
一种计算机设备，计算机设备包括一个或多个处理器和存储器，存储器中存储有至少一条计算机可读指令，计算机可读指令由一个或多个处理器加载并执行以实现如上述的命令检测方法。
一个或多个计算机可读存储介质，计算机可读存储介质中存储有至少一条计算机可读指令，计算机可读指令由一个或多个处理器加载并执行以实现如上述的命令检测方法。
本申请的一个或多个实施例的细节在下面的附图和描述中提出。基于本申请的说明书、附图以及权利要求书，本申请的其它特征、目的和优点将变得更加明显。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本申请实施例提供的命令检测方法的实施环境示意图；
图2是本申请实施例提供的一种命令检测方法的流程图；
图3是本申请实施例提供的一种命令检测方法的流程图；
图4是本申请实施例提供的一种获取可疑程度信息的示例图；
图5是本申请实施例提供的一种获取可疑程度信息的示例图；
图6是本申请实施例提供的一种检测过程中的数据流向的示例图；
图7是本申请实施例提供的一种命令检测装置的结构示意图；
图8是本申请实施例提供的一种计算机设备的结构示意图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。应当理解，此处所描述的具体实施方式仅仅用以解释本申请，并不用于限定本申请。
图1是本申请实施例提供的命令检测方法的实施环境示意图。该实施环境中可以包括至少一个服务器101、至少一个服务器102以及管理员终端等设备。其中，至少一个服务器101可以用于为用户提供业务服务，并且，该至少一个服务器101可以基于服务器上所运行的命令向至少一个服务器102进行上报，其上报的内容可以包括运行的全量数据，也即是，运行的命令、命令相关的进程以及网络连接情况等等。上述上报也可以是由服务器101所配置的数据采集器(如agent)来进行。该至少一个服务器102可以基于上报的命令，通过基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，以实现对命令的初步筛选，从而得到一些疑似是混淆命令的目标命令，再获取这些目标命令的运行态文本，以获知这些目标命令在运行时所进行的操作，从而基于目标命令和运行态文本，来确定目标命令的可疑程度信息，通过可疑程度信息可以判断目标命令是否为混淆命令，当确定混淆命令后，还可以将所确定的混淆命令进行告警，例如，向管理员终端进行报警以及向相关服务器进行告警等，当然，该服务器102还可以将所确定的混淆命令发送至管理员终端，由技术人员进行人工检测，从而确定是否为混淆命令，再确定是否进行进一步告警。当然，在上述至少一个服务器102的处理过程中，还可以涉及到数据库存储，例如，以图1中所示的目标数据库来说，在服务器上报的命令被初步筛选后，可以存储于目标数据库，而当对于目标数据库中所存储的命令获取到运行态文本后，还可以将运行态文本存储至目标数据库，以便再次以目标数据库为 基础，来进一步进行命令检测等，本申请实施例对此不做具体限定。
图2是本申请实施例提供的一种命令检测方法的流程图。该图2所示的实施例中，现以计算机设备作为该方法的执行主体进行举例说明，该实施例具体包括以下步骤：
201、基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令。
上述多个第一特征是基于已知混淆命令所提取的特征，第二特征是基于已知正常业务命令所提取的特征，通过这两类特征的检测，以实现筛选的目的，所得到的目标命令是一些疑似的混淆命令，通过该检测过程，可以减小后续需要处理的命令数量。
202、获取该多个目标命令的运行态文本。
该运行态文本用于描述该目标命令在运行中所执行的操作，能够体现一个命令在实际运行中到底都会进行哪些操作，从而可以基于命令所对应的操作，来获知命令是否为混淆命令。
203、基于该多个目标命令以及对应的运行态文本，获取该多个目标命令的可疑程度信息，其中，该可疑程度信息用于表示命令为混淆命令的可能性。
在本申请实施例中，目标命令以及对应的运行态文本，可以表示目标命令本身以及其真实运行时对应的操作，由此，可以基于上述信息的对比等方式，来获知命令是否经过了混淆，例如，可以通过命令与运行态文本之间的文本差异、命令本身所匹配的特征以及命令是否是一些预设命令等情况，来综合判断命令是否为混淆命令。
204、当任一个目标命令的可疑程度信息符合目标条件，将该目标命令确定为混淆命令。
当基于上述的可疑程度信息确定目标命令为混淆命令时，可以基于系统的设定，来对目标设备进行告警，例如，系统设定是向来源服务器告警，则可确定目标命令的来源服务器，将告警信息发送至来源服务器，该告警信息可以包括目标命令本身或者目标命令的相关进程等。当然，如果系统设定是向管理员终端进行告警，则可以向管理员终端发送告警信息，此时，告警信息可以包括目标命令本身、来源服务器，当然也可以包括目标命令的相关进 程等等，以便于管理员终端对目标命令进行定位。
本申请实施例针对大规模服务器应用场景，提出了一种具备可运营性的混淆命令的实时检测方法，大大提升了防御效果，提供了更具弹性的检测方法。具体地，本申请实施例结合了命令的静态与动态混淆属性的分析，首先，对于上报的命令来说，会通过基于已知混淆命令所得到的第一特征和基于正常业务命令的第二特征，进行静态的特征匹配和筛选，从而显著降低了数据分析的规模，从而使得实时的命令检测成为可能，并通过获取命令的运行态文本，实现了一定程度的去混淆功能，避免了由于语义分析而造成的计算困难和耗时，再通过采用命令和运行态文本来确定可疑程度信息的方式，来作为最终确定命令是否为混淆命令的参考，大大提高了检测准确性。当然，伴随着准确性的提升，也就大大降低了误报的可能性，实现了精准地识别可疑的混淆变形命令，提升对于高级威胁入侵手段的有效感知能力，还能够显著增强服务器的安全防护效果。
图3是本申请实施例提供的一种命令检测方法的流程图。该图3所示的实施例中，现以计算机设备作为该方法的执行主体进行举例说明，该实施例具体包括以下步骤：
301、基于已知混淆命令的多个第一特征，对多个待检测的命令进行特征匹配，确定与该多个第一特征中任一个特征匹配成功的第一命令。
其中，该多个第一特征可以根据下述过程获取：获取多个已知混淆命令，确定该多个已知混淆命令的共性特征，来作为第一特征，该第一特征可以用来表示混淆类型，当然，对于一个混淆类型来说，可以对应于一个或多个第一特征。例如，在确定该多个已知混淆命令的共性特征时，可以对多个已知混淆命令进行聚类，获取多个命令集，对于任一命令集来说，确定其聚类中心的已知混淆命令，对该聚类中心的已知混淆命令进行分析，将分析得到的混淆类型提取为该命令集对应的第一特征。
在一个实施例中，基于不同的泛化程度，提取该多个已知混淆命令的不同粒度的共性特征，泛化程度越大，共性特征数量越少，反之，泛化程度越小，共性特征数量越多。当然，随着恶意样本也即是已知混淆命令的不断扩充，还可以对各个混淆方式的第一特征进行更新，以便提高准确性。
需要说明的是，上述已知混淆命令可以是由技术人员基于服务器的历史 运行配置或是从网络上收集，本申请实施例对这些作为恶意样本的已知混淆命令的来源不做限定。而对于该多个待检测的命令来说，可以通过服务器上报得到，具体地，服务器可以通过布设于服务器侧的数据采集器进行命令收集并上报，当然，在上报服务器上所运行的命令时，还可以上传命令的执行进程、父进程等、进程状态、事件时间、业务信息、网络连接的运行数据。
在执行该步骤301时，计算机设备可以先提取运行数据中的命令，再将各个命令输入由该多个第一特征构成的特征过滤环，各个命令与特征过滤环上的各个第一特征进行匹配，当任一命令与任一特征匹配成功，则将该命令作为筛选结果输出至下一个特征匹配流程。需要说明的是，上述特征匹配过程可以是基于第一特征的数量，对多个待检测的命令进行复制，得到多个副本，每个副本中均包含该多个待检测命令，每个副本里的所有待检测命令均与同一个第一特征进行特征匹配，以确定该多个待检测命令中与该第一特征匹配的命令，从而保证所有待检测命令和所有第一特征均进行过匹配的过程，能够保证不会遗漏混淆命令。
上述的特征匹配过程能够基于已知混淆命令，来确定一些用于代表混淆类型的静态特征来代表已知混淆命令的一些共性，而对上报的命令基于这些静态特征进行筛选，则可以除去不具备混淆特征的常规命令，并输出与这些静态特征匹配的命令。
在一些实施例中，上述多个第一特征可以包括但不限于如下特征：
a)变量名混淆，即存在利用
Figure PCTCN2020079484-appb-000001
符号赋值的操作，且在同一命令中重复至少1次。以原命令“cat/etc/passwd”为例，混淆后的命令示例：
Figure PCTCN2020079484-appb-000002
b)IFS滥用，即使用预定义的“IFS”字符变量，对原始命令进行拆分，从而达到混淆的目的。以原命令“cat/etc/passwd”为例，混淆后的命令示例：
Figure PCTCN2020079484-appb-000003
c)位移控制，即使用Linux环境允许的位移量选择语法，隐藏实际执行的命令字符。以原命令“cat/etc/passwd”为例，混淆后的命令示例：
Figure PCTCN2020079484-appb-000004
d)base64编码，即使用base64编码隐藏执行的命令。混淆后的命令示例：“`echo Y2F0IC9ldGMvcGFzc3dkCg＝＝|base64-d`”。
e)其他进制编码，即使用二进制以外的进制对原命令进行编码，如使用十六进制编码原命令。
以原命令“cat/etc/passwd”为例，混淆后的命令示例：
Figure PCTCN2020079484-appb-000005
Figure PCTCN2020079484-appb-000006
f)rot13加密，即使用替换加密的方式隐藏所执行的命令。以原命令“cat/etc/passwd”为例，混淆后的命令示例：“`echo png/rgp/cnffjq|tr a-mn-z n-za-m`”。
g)倒序手法，即使用rev函数，将原始命令进行倒序从而实现混淆变形。以原命令“cat/etc/passwd”为例，混淆后的命令示例：“`echo dwssap/cte/tac|rev`”。
h)回显绕过，即使用echo命令达到隐藏原始命令的效果。以原命令“cat/etc/passwd”为例，混淆后的命令示例：
Figure PCTCN2020079484-appb-000007
Figure PCTCN2020079484-appb-000008
i)通配符混淆，即使用系统可识别的“*”、“？”作为通配符，将原始命令进行混淆变形，已逃逸高危基线的监控。以原命令“cat/etc/passwd”为例，混淆后的命令示例：“cat/et？/p*assw？”。
上述特征的举例仅是本申请实施例提供的一些实施例，可以理解的是，随着对混淆命令的检测，该第一特征还可以有所增减，本申请实施例对此不做限定。
302、根据每个第一命令所匹配的第一特征，确定每个第一命令的目标第二特征，该目标第二特征是指第一特征对应的至少一个第二特征，第二特征为正常业务命令的特征。
其中，该多个第二特征可以根据下述过程获取：获取多个已知正常业务命令，确定该多个已知正常业务命令的共性特征，来作为第二特征。当然，还可以基于第一特征，来获取与第一特征匹配的至少一个正常业务命令，提取该与第一特征匹配的至少一个正常业务命令的共性特征，得到第一特征对应的至少一个第二特征，从而提高过滤的针对性。
需要说明的是，针对每一个第一特征，也即是，针对每一类混淆类型，会不断更新维护相应的第二特征。例如，当确定任一命令为正常业务命令时，可以根据该命令所匹配的第一特征，来更新该第一特征所对应的第二特征， 其具体更新过程与特征的获取过程同理，在此不做赘述。
例如，上述确定任一命令为正常业务命令，可以在误报的场景下确定的，从而计算机设备可以基于误报的情况来更新第二特征，也即是，该方法还包括：当接收到任一命令的误报通知，该误报通知用于表示该命令被告警为混淆命令但是实际为正常业务命令，则可以基于该命令所匹配的第一特征，来更新该第一特征所对应的第二特征，例如，将该命令作为用于获取该第一特征对应的第二特征的正常业务命令之一，重新进行第二特征的获取。在一个实施例中，当接收到任一命令的漏报通知，该漏报通知用于表示该命令被确定为正常业务命令但是实际为混淆命令，则可以基于该命令所匹配的第一特征，来更新该第一特征所对应的第二特征，例如，将该命令从该第一特征对应的第二特征的正常业务命令中删除，重新进行第二特征的获取。通过上述基于误报或漏报情况的更新，能够实现对误报或漏报的收敛与调控。
对于任一个第一特征来说，当任一命令与第一特征匹配，并不能够说明该第一命令确实是混淆命令，此时，该第一命令也可能是正常业务命令，因此，还可以基于该步骤302和303的过程，通过正常业务命令所具有的特征，对该第一命令进行进一步判断，以降低误判率，提高检测的准确性。
需要说明的是，在步骤301的匹配过程中，计算机设备可以基于匹配结果为第一命令进行标记，例如，为第一命令添加所匹配的第一特征的特征标记符，以便在基于第二特征进行特征匹配时，可以根据各个第一命令的特征标记符，将第一命令与第一命令的目标第二特征进行匹配，以实现来进一步判断。
303、根据每个第一命令的目标第二特征，对多个第一命令进行特征匹配，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令。
需要说明的是，上述基于第二特征的特征匹配可以基于已知的业务正常命令本身或命令的正则表达式进行。在一些实施例中，该步骤303中可以包括：根据该每个第一命令的目标第二特征，对该多个第一命令进行特征匹配，确定该多个第二命令，该第二命令为具有任一目标第二特征的第一命令；从该多个第一命令中过滤掉该多个第二命令，得到该多个目标命令。
上述步骤301至步骤303，是基于已知混淆命令的多个第一特征和正常业 务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令的过程，可以将该多个第一特征看作是灰特征过滤环，而将该多个第二特征看作是白特征过滤环，通过该灰白两个层次过滤环的筛选，可以大大降低待检测命令的数据量，实现了对数据量的压制，从而使得快速、及时的检测成为可能，对于各个服务器来说，也就可以采用较短的周期来进行命令的上报，大大提高了检测的实时性，也能够实现后续告警的及时性。
304、将该多个目标命令存储至目标数据库，该目标数据库用于存储该目标命令以及对应的运行态文本。
通过上述两层的筛选，可以将这些可疑的目标命令存储至目标数据库，以避免数据处理过程中发生丢失等情况。在进行数据库存储时，可以按照目标格式进行存储，数据库字段可以包括分析所需的命令信息和发送工单所需的提示信息，包括但不限于：(1)命令；(2)命令的执行进程以及父进程等，可以作为后续告警和业务分析的数据基础；(3)事件时间；(4)业务信息，如机器负责人、所属区域、对应IP，可以作为后续告警和业务分析的数据基础；(5)匹配成功的第一特征的特征标记符，可以作为后续获取可疑程度信息的基础，如果无需采用第一特征来获取可疑程度信息，则该项也可以不存储在目标数据库中；(6)沙箱还原得到的该命令的运行态文本，在将目标命令存储至目标数据库时，该部分可以预设为空。
需要说明的是，本申请实施例通过目标数据库来对目标命令进行存储，以避免目标命令的丢失，且基于目标数据库的存储可以更有利于对命令的并行处理，而在一些实施例中，也可以不采用数据库形式对目标命令进行存储，而是采用队列等形式来存储，本申请实施例对具体采用哪种形式进行存储不进行限定。
305、将该多个目标命令导入沙箱调试程序，通过该沙箱调试程序执行该多个目标命令，记录脚本调试执行过程中的运行态文本。
其中，沙箱调试程序可以提供一个相对独立的运行环境，使得在沙箱调试程序中运行的命令不会影响到系统的运行，可以看作是一个实验环境。
该计算机设备可以通过将多个目标命令逐个导入沙箱调试程序，从而由沙箱调试程序执行各个目标命令，逐个记录脚本调试执行过程中的运行态文本。当然，计算机设备可以基于多个沙箱调试程序并行执行多个目标命令， 记录各个沙箱调试程序在脚本调试执行过程中的运行态文本。其中，可以为各个沙箱调试程序设置处理队列，从目标数据库中提取出多个目标命令，将多个目标命令入列至各个沙箱调试程序的处理队列中，基于先进先出的原则，由各个沙箱调试程序来执行多个目标命令。上述示例仅为对沙箱调试程序的命令执行方式的举例，本申请实施例对具体采取哪种来实现不做限定。
需要说明的是，该沙箱调试程序可以不在该计算机设备上实现，而是在其他计算机设备上实现，以避免对当前计算机设备的处理资源的过多占用，也可以相对加快对命令的检测流程。当然，该计算机设备可以是设置有防火墙的设备，该其他计算机设备也可以是设置有防火墙的设备，以使得在运行时可以由防火墙来对一些恶意行为进行阻止和保护，进一步提高检测的安全性。
在一种示例中，计算机设备可以使用“sh-x”方式执行包含该命令的sh脚本，记录脚本调试执行过程中的运行态文本。例如，如下述代码所示，sh_x_sandbox_test.sh脚本文件中为变量替换类型的混淆命令
Figure PCTCN2020079484-appb-000009
可以通过“sh-x”执行得到其运行态文本，以原始命令“cat/etc/passwd”为例，其所得到的运行态文本可以为+cat/etc/passwd(如代码最后一行)。
[root@VM_0_3_centos～]#sh–x sh_x_sandbox_test.sh
+a＝ca
+b＝t
+c＝pas
+d＝swd
+cat/etc/passwd
在一些实施例中，还可以对沙箱调试程序的处理速度进行加速，例如，可以为沙箱调试程序设置每个目标命令的目标时长作为最大执行时长，使得该沙箱调试程序执行任一个目标命令的执行时间小于目标时长，例如，可以选用“timeout”函数限制脚本执行时间，如限制脚本运行不超过0.01秒。又例如，可以对调用该沙箱调试程序的代码进行更改，使得该代码不执行任一个目标命令，也即是，对执行沙箱调试程序的bash本身代码进行修改，注释执行部分的代码逻辑，实现不执行任一个目标命令的目的。
通过上述导入和执行命令的过程，可以还原得到被实际执行命令的运行态文本，达到去混淆的目的，从而可以利用还原所得到的运行态文本来进行后续的可疑程度信息的获取。
306、当获取到任一目标命令的运行态文本时，将该运行态文本存储至该目标命令在该目标数据库中的存储位置。
当计算机设备获取到任一个目标命令的运行态文本后，可以基于该目标命令的运行态文本来更新目标数据库，使得在目标命令对应的数据项里包含命令本身和该命令去混淆后的结果，也即是该运行态文本。
307、基于该多个目标命令以及对应的运行态文本，获取该多个目标命令的可疑程度信息。
计算机设备可以从目标数据库中获取在本申请实施例中，计算机设备可以根据下述一项信息或任意两项信息的组合，获取该多个目标命令的可疑程度信息：
(1)该多个目标命令所匹配的第一特征。
基于该所匹配的第一特征获取可疑程度信息时，计算机设备可以获取该多个目标命令所匹配的第一特征的可疑程度信息；对该多个目标命令的第一特征的可疑程度信息分别进行累计，得到该多个目标命令的可疑程度信息。各个第一特征的可疑程度信息可以预先设置，以在获取时使用。
当然，当一个目标命令所匹配的第一特征为一个时，则可以将该第一特征的可疑程度信息对应的可疑程度信息作为该目标命令的可疑程度信息，而当一个目标命令所匹配的第一特征为多个时，可以基于该多个第一特征的可疑程度信息来获取可疑程度信息。其中，第一特征本身可以设置有可疑程度信息，从而该目标命令的可疑程度信息可以为第一特征的可疑程度信息的累计值。
在一些实施例中，对于不同混淆类型的第一特征，还可以基于该目标命令所匹配的混淆类型所包含的第一特征数量和所匹配上的第一特征总数，来为混淆类型获取对应的权重，以得到该目标命令的可疑程度信息。例如，当目标命令匹配上的第一特征总数为L，其中，第一混淆类型的第一特征数量为M，第二混淆类型的第一特征数量为N，则可以将M/L作为第一混淆类型的权重，将N/L作为第二混淆类型的权重，在计算目标命令的可疑程度信息 时，则可以采用(第一混淆类型的第一特征的可疑程度信息的累计值)*M/L+(第二混淆类型的第一特征的可疑程度信息的累计值)*N/L，以得到目标命令的可疑程度信息。
而如果可疑程度信息是为混淆类型设置的，则对于一个目标命令来说，可以确定其所匹配的第一特征对应的混淆类型，再基于混淆类型对应的可疑程度信息进行累计，以得到该目标命令的可疑程度信息。如IFS滥用、base64编码等为高危特征，可以设置其可疑程度信息为1，则当目标命令与IFS滥用、base64编码这两个混淆类型均匹配时，可以获取到该目标命令的可疑程度信息为2。
(2)该多个目标命令以及对应的运行态文本之间的文本差异。
在基于目标命令以及对应的运行态文本之间的文本差异来获取可疑程度信息时，计算机设备可以获取该多个目标命令与对应的运行态文本之间的文本差异；根据该多个目标命令的文本差异和文本差异阈值，确定该多个目标命令的可疑程度信息。由于运行态文本实际上是去混淆后的命令，因此，对命令以及去混淆后的命令之间进行文本比较，可以确定命令前后是否有发生改变，如果发生了显著的改变，则可能是由于确实目标命令是混淆命令。对于上述文本差异的获取，可以采用SimHash算法，计算目标命令和沙箱调试程序所返回的运行态格式的simhash值，并计算二者之间的海明距离，如果两者的海明距离超过预设的文本差异阈值，则认为沙箱调试前后文本差异显著，则可以获取目标值作为可疑程度信息，当然，还可以基于文本差异的显著程度，来获取可疑程度信息，也即是，对于不同的文本差异程度设置有不同的可疑程度信息，当文本差异程度通过数值区间来表示，相应地，可疑程度信息也可以用数值来表示，也即是，确定命令和运行态文本之间的文本差异数值所属的数值区间，确定该数值区间所对应的可疑程度值，从而得到目标命令的可疑程度信息。
仍以命令“cat/etc/passwd”为例，假设文本差异阈值为3。当沙箱调试程序执行该命令时，由于没有混淆变形，则沙箱调试程序返回结果依然为“cat/etc/passwd”。即目标命令与对应的运行态文本均为“cat/etc/passwd”，此时有海明距离为0。当采用上述所示代码段中的变量替换类型来混淆，即目标命令为
Figure PCTCN2020079484-appb-000010
其运行态文本为“cat /etc/passwd”时，同理可计算得到海明距离为8，超过文本差异阈值3，此时可疑程度信息可以获取为1。
(3)该多个目标命令的运行态文本和预设命令之间的匹配信息。
在基于多个目标命令的运行态文本和预设命令之间的匹配信息来获取可疑程度信息时，计算机设备可以基于该多个目标命令的运行态文本与该预设命令进行匹配，当任一目标命令的运行态文本与该预设命令中的一个或多个的组合匹配成功时，根据该目标命令的匹配情况，获取该目标命令的可疑程度信息。
对于一些危险程度较高的命令，可以基于这些命令设置高危命令基线，也即是，可以事先设置一些命令来作为衡量目标命令是否为混淆命令的参照，如果运行态文本与预设命令中的一个或多个的组合匹配成功，则可以获取目标值作为可疑程度信息。当然，还可以根据所匹配的预设命令对应的可疑程度信息来进行累计，以得到目标命令的可疑程度信息。
上述(1)-(3)介绍了如何基于这三种信息中任一个信息获取目标命令的可疑程度信息，在一些实施例中，还可以综合上述三种信息中的至少两种信息，来获取目标命令的可疑程度信息。例如，计算机设备可以基于(1)所提供的目标命令所匹配的第一特征来获取第一可疑程度信息，基于(2)所提供的文本差异来获取第二可疑程度信息，基于(3)所提供的匹配信息来获取第三可疑程度信息，将上述第一可疑程度信息、第二可疑程度信息以及第三可疑程度信息的累计值作为该目标命令的可疑程度信息，以结合静态特征和动态特征来确定目标命令是否为混淆命令，大大降低了误判的可能性，提高了检测准确性。
308、该当任一个目标命令的可疑程度信息符合目标条件，该计算机设备将该目标命令确定为混淆命令。
其中，该目标条件可以为可疑程度信息大于可疑程度阈值，当然，该可疑程度信息也可以采用可疑级别表示，则该目标条件也可以为可疑程度信息大于可疑程度级别阈值，本申请实施例对此不做限定。
对于任一个目标命令来说，在步骤307的获取可疑程度信息的过程中，可以有如图4的过程，也即是，每当获取到一部分可疑程度信息时，对已获取到的可疑程度信息进行监测，当已获取到的可疑程度信息符合目标条件，则 确定该目标命令为混淆命令，无需等待所有获取过程均完成，也即是，当基于上述步骤307中的(1)-(3)的信息获取可疑程度信息时，如果已获取到的第一可疑程度信息符合目标条件，则直接将该目标命令确定为混淆命令，无需再进行其他获取过程，以减轻计算机设备的计算压力，而当已获取的可疑程度信息不符合目标条件，则继续基于下一种方式来继续获取可疑程度信息。
上述过程可以有如下示例，以可疑程度信息为S，可疑程度阈值为3为例，当基于匹配的第一特征的可疑程度信息累计值为2时，则此时S＝2，将S的当前取值与可疑程度阈值3相比，确定当前取值小于可疑程度阈值，则继续基于命令和运行态文本之间的文本差异来确定S的取值，例如，文本差异大于文本差异阈值，则对S进行以2为单位的增量处理，则此时S＝2+2＝4，此时确定S的取值大于可疑程度阈值，则可以不继续进行后续的处理，将该目标命令确定为混淆命令。
当然，上述获取可疑程度信息的过程还可以是多种方式并行，并基于多种方式所获取的可疑程度信息进行累计，以得到命令的可疑程度信息，例如图5所示，基于目标命令分别采用上述(1)、(2)和(3)的方式以得到对应的可疑程度信息，再获取三种方式多得到的可疑程度信息的累计值，来作为目标命令的可疑程度信息，再基于是否符合目标条件来确定是否为混淆命令。
在一些实施例中，当任一目标命令被确定为混淆命令或非混淆命令时，从该目标数据库中删除该目标命令，以节约存储空间。
309、对该目标命令的来源服务器进行告警。
计算机设备可以基于被确定为混淆命令的目标命令的业务信息，对该目标命令的来源服务器进行告警，对于目标命令来说，在目标数据库中会存储有目标命令的业务信息，该业务信息中可以存储有服务器的IP信息，因此，对于计算机设备来说，可以基于这些信息实现告警，当然，该告警可以是对来源服务器进行告警，也可以是对系统管理员进行告警，本申请实施例不做限定。在进行告警时，可以通过移动端、网页端告警信息等形式，返回给系统管理员或服务器所归属的用户。
当任一告警被确定为入侵，则可以进行应急响应流程，从而保障运行安全。而如果任一告警被确定为误报，则可以将相应的目标命令增添至正常业 务命令中，用于对步骤302中所涉及的第二特征进行更新，以提升后续检测的准确率。
上述过程也可以参照图6所示的数据流向图。该数据流向图直观的体现了步骤301至309的处理流程，对于agent所上报的数据可以经过基于第一特征也即是灰特征的第一层筛选，再经过基于第二特征也即是白特征的第二层筛选，进而将筛选所得到的命令进行数据库存储，再基于数据库存储的命令来进行沙箱调试，以得到各个命令的运行态文本，基于命令和运行态文本进行综合判断，再输出判断结果，并基于判断结果可以实现有针对性和及时的告警。
本申请实施例针对大规模服务器应用场景，提出了一种具备可运营性的混淆命令的实时检测方法，大大提升了防御效果，提供了更具弹性的检测方法。具体地，本申请实施例结合了命令的静态与动态混淆属性的分析，首先，对于上报的命令来说，会通过基于已知混淆命令所得到的第一特征和基于正常业务命令的第二特征，进行静态的特征匹配和筛选，从而显著降低了数据分析的规模，从而使得实时的命令检测成为可能，并通过获取命令的运行态文本，实现了一定程度的去混淆功能，避免了由于语义分析而造成的计算困难和耗时，再通过采用命令和运行态文本来确定可疑程度信息的方式，来作为最终确定命令是否为混淆命令的参考，大大提高了检测准确性。当然，伴随着准确性的提升，也就大大降低了误报的可能性，实现了精准地识别可疑的混淆变形命令，提升对于高级威胁入侵手段的有效感知能力，还能够显著增强服务器的安全防护效果。
进一步地，本申请实施例还通过综合考虑上报数据本身的静态混淆特征、沙箱分析前后命令文本格式的差异性程度以及去混淆后命令是否异常等三个维度，并最终结合判定条件来确定是否存在混淆，能够大大提高检测的准确性。
应该理解的是，虽然上述各实施例的流程图中的各个步骤按照箭头的指示依次显示，但是这些步骤并不是必然按照箭头指示的顺序依次执行。除非本文中有明确的说明，这些步骤的执行并没有严格的顺序限制，这些步骤可以以其它的顺序执行。而且，上述各实施例中的至少一部分步骤可以包括多个子步骤或者多个阶段，这些子步骤或者阶段并不必然是在同一时刻执行完 成，而是可以在不同的时刻执行，这些子步骤或者阶段的执行顺序也不必然是依次进行，而是可以与其它步骤或者其它步骤的子步骤或者阶段的至少一部分轮流或者交替地执行。
图7是本申请实施例提供的一种命令检测装置的结构示意图，该装置可以是计算机设备或设置于计算机设备上。该装置中包括各个模块或单元，每个模块或单元可全部或部分通过软件、硬件或其组合来实现。参见图7，该装置包括：
检测模块701，用于基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令。
文本格式获取模块702，用于获取多个目标命令的运行态文本。
可疑程度信息获取模块703，用于基于多个目标命令以及对应的运行态文本，获取多个目标命令的可疑程度信息，其中，可疑程度信息用于表示命令为混淆命令的可能性。
命令确定模块704，用于当任一个目标命令的可疑程度信息符合目标条件，将目标命令确定为混淆命令。
在一个实施例中，检测模块701包括：
第一特征匹配单元7011，用于基于多个第一特征，对多个待检测的命令进行特征匹配，确定与多个第一特征中任一个特征匹配成功的第一命令。
第二特征确定单元7012，用于根据每个第一命令所匹配的第一特征，确定每个第一命令的目标第二特征，目标第二特征是指第一特征对应的至少一个第二特征。
目标命令确定单元7013，用于根据每个第一命令的目标第二特征，对多个第一命令进行特征匹配，确定多个目标命令。
在一个实施例中，该目标命令确定单元7013，用于根据每个第一命令的目标第二特征，对多个第一命令进行特征匹配，确定多个第二命令，第二命令为具有任一目标第二特征的第一命令；从多个第一命令中过滤掉多个第二命令，得到多个目标命令。
在一个实施例中，文本格式获取模块702，用于将多个目标命令导入沙箱调试程序，通过沙箱调试程序执行多个目标命令，记录脚本调试执行过程中 的运行态文本。
在一个实施例中，装置还包括：
存储模块705，用于将多个目标命令存储至目标数据库，目标数据库用于存储目标命令以及对应的运行态文本。
该存储模块705还用于当获取到第一目标命令的运行态文本时，将运行态文本存储至第一目标命令在目标数据库中的存储位置。
在一个实施例中，沙箱调试程序执行任一个目标命令的执行时间小于目标时长；或，对调用沙箱调试程序的代码进行更改，使得代码不执行任一个目标命令。
在一个实施例中，装置还包括：删除模块706，用于当第二目标命令被确定为混淆命令或非混淆命令时，从目标数据库中删除第二目标命令。
在一个实施例中，可疑程度信息获取模块703用于根据下述一项信息或任意两项信息的组合，获取多个目标命令的可疑程度信息：
多个目标命令所匹配的第一特征；
多个目标命令以及对应的运行态文本之间的文本差异；
多个目标命令的运行态文本和预设命令之间的匹配信息。
在一个实施例中，可疑程度信息获取模块703包括第一获取单元7021，该第一获取单元7021用于获取多个目标命令所匹配的第一特征的可疑程度信息；对于任一个目标命令，对任一目标命令的第一特征的可疑程度信息进行累计，得到任一个目标命令的可疑程度信息。
在一个实施例中，可疑程度信息获取模块703包括第二获取单元7022，该第二获取单元7022用于获取多个目标命令与对应的运行态文本之间的文本差异；根据多个目标命令的文本差异和文本差异阈值，确定多个目标命令的可疑程度信息。
在一个实施例中，可疑程度信息获取模块703包括第三获取单元7023，该第三获取单元7023用于基于多个目标命令的运行态文本与预设命令进行匹配，当第三目标命令的运行态文本与预设命令中的一个或多个的组合匹配成功时，根据第三目标命令的匹配情况，获取第三目标命令的可疑程度信息。
在一个实施例中，装置还包括：告警模块707，用于对目标命令的来源服务器进行告警。
图8是本申请实施例提供的一种计算机设备的结构示意图。该计算机设备可以是图1所示实施环境中的服务器102。该计算机设备800可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上处理器(central processing units，CPU)801和一个或一个以上的存储器802，其中，该存储器802中存储有至少一条计算机可读指令，该至少一条计算机可读指令由该一个或多个处理器801加载并执行以实现上述各个方法实施例提供的命令检测方法。当然，该计算机设备还可以具有有线或无线网络接口、键盘以及输入输出接口等部件，以便进行输入输出，该计算机设备还可以包括其他用于实现设备功能的部件。
在示例性实施例中，还提供了一个或多个计算机可读存储介质，例如包括计算机可读指令的存储器，上述计算机可读指令可由计算机设备中的一个或多个处理器执行以实现上述实施例中的命令检测方法。例如，该计算机可读存储介质可以是只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory，RAM)、只读光盘(Compact Disc Read-Only Memory，CD-ROM)、磁带、软盘和光数据存储设备等。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来计算机可读指令相关的硬件完成，该程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
上述仅为本申请的较佳实施例，并不用以限制本申请，凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (17)

  1. 一种命令检测方法，由计算机设备执行，其特征在于，所述方法包括：
    基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个所述第一特征但不具有任一所述第二特征的命令；
    获取所述多个目标命令的运行态文本；
    基于所述多个目标命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息，其中，所述可疑程度信息用于表示命令为混淆命令的可能性；
    当任一个所述目标命令的可疑程度信息符合目标条件，将所述目标命令确定为混淆命令。
  2. 根据权利要求1所述的方法，其特征在于，所述基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令包括：
    基于所述多个第一特征，对所述多个待检测的命令进行特征匹配，确定与所述多个第一特征中任一个第一特征匹配成功的第一命令；
    根据每个第一命令所匹配的第一特征，确定所述每个第一命令的目标第二特征，所述目标第二特征是指所述第一特征对应的至少一个第二特征；
    根据所述每个第一命令的目标第二特征，对所述多个第一命令进行特征匹配，确定所述多个目标命令。
  3. 根据权利要求2所述的方法，其特征在于，所述根据所述每个第一命令的目标第二特征，对所述多个第一命令进行特征匹配，确定所述多个目标命令包括：
    根据所述每个第一命令的目标第二特征，对所述多个第一命令进行特征匹配，确定多个第二命令，所述第二命令为具有任一所述目标第二特征的第一命令；
    从所述多个第一命令中过滤掉所述多个第二命令，得到所述多个目标命令。
  4. 根据权利要求1所述的方法，其特征在于，所述获取所述多个目标命令的运行态文本包括：
    将所述多个目标命令导入沙箱调试程序，通过所述沙箱调试程序执行所述多个目标命令，记录脚本调试执行过程中的运行态文本。
  5. 根据权利要求4所述的方法，其特征在于，所述将所述多个目标命令导入沙箱调试程序之前，所述方法还包括：
    将所述多个目标命令存储至目标数据库，所述目标数据库用于存储所述目标命令以及对应的运行态文本。
  6. 根据权利要求5所述的方法，其特征在于，所述记录脚本调试执行过程中的运行态文本之后，所述方法还包括：
    当获取到任一目标命令的运行态文本时，将所述运行态文本存储至所述目标命令在所述目标数据库中的存储位置。
  7. 根据权利要求4所述的方法，其特征在于，所述沙箱调试程序执行任一个目标命令的执行时间小于或等于目标时长。
  8. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    对调用所述沙箱调试程序的代码进行更改，使得所述代码不执行任一个目标命令。
  9. 根据权利要求4所述的方法，其特征在于，所述方法还包括：
    当任一所述目标命令被确定为混淆命令或非混淆命令时，从所述目标数据库中删除所述目标命令。
  10. 根据权利要求4所述的方法，其特征在于，所述基于所述多个目标命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息包括：
    根据下述至少一项信息，获取所述多个目标命令的可疑程度信息：
    所述多个目标命令所匹配的第一特征；
    所述多个目标命令以及对应的运行态文本之间的文本差异；
    所述多个目标命令的运行态文本和预设命令之间的匹配信息。
  11. 根据权利要求10所述的方法，其特征在于，所述基于所述多个目标命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息包括：
    获取所述多个目标命令所匹配的第一特征的可疑程度信息；
    对于任一个目标命令，对所述任一目标命令的第一特征的可疑程度信息进行累计，得到所述任一个目标命令的可疑程度信息。
  12. 根据权利要求10所述的方法，其特征在于，所述基于所述多个目标 命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息包括：
    获取所述多个目标命令与对应的运行态文本之间的文本差异；
    根据所述多个目标命令的文本差异和文本差异阈值，确定所述多个目标命令的可疑程度信息。
  13. 根据权利要求10所述的方法，其特征在于，所述基于所述多个目标命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息包括：
    基于所述多个目标命令的运行态文本与预设命令进行匹配，当第三目标命令的运行态文本与所述预设命令中的一个或多个的组合匹配成功时，根据所述第三目标命令的匹配情况，获取所述第三目标命令的可疑程度信息。
  14. 根据权利要求1所述的方法，其特征在于，所述方法还包括下述至少一项：
    对所述目标命令的来源服务器进行告警；
    基于所述目标命令，向管理员终端进行告警。
  15. 一种命令检测装置，设置于计算机设备，其特征在于，所述装置包括：
    检测模块，用于基于已知混淆命令的多个第一特征和正常业务命令的多个第二特征，对多个待检测的命令进行检测，确定多个目标命令，每个目标命令均具有一个或多个第一特征但不具有任一第二特征的命令；
    文本格式获取模块，用于获取所述多个目标命令的运行态文本；
    可疑程度信息获取模块，用于基于所述多个目标命令以及对应的运行态文本，获取所述多个目标命令的可疑程度信息，其中，所述可疑程度信息用于表示命令为混淆命令的可能性；
    命令确定模块，用于当任一个目标命令的可疑程度信息符合目标条件，将所述目标命令确定为混淆命令。
  16. 一种计算机设备，其特征在于，所述计算机设备包括一个或多个处理器和存储器，所述存储器中存储有至少一条计算机可读指令，所述计算机可读指令由所述一个或多个处理器加载并执行以实现如权利要求1至权利要求14任一项所述的命令检测方法。
  17. 一个或多个计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有至少一条计算机可读指令，所述计算机可读指令由一个或多 个处理器加载并执行以实现如权利要求1至权利要求14任一项所述的命令检测方法。
PCT/CN2020/079484 2019-03-29 2020-03-16 命令检测方法、装置、计算机设备以及存储介质 WO2020199905A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US17/320,015 US20210264023A1 (en) 2019-03-29 2021-05-13 Command inspection method and apparatus, computer device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910249360.8A CN110012000B (zh) 2019-03-29 2019-03-29 命令检测方法、装置、计算机设备以及存储介质
CN201910249360.8 2019-03-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/320,015 Continuation US20210264023A1 (en) 2019-03-29 2021-05-13 Command inspection method and apparatus, computer device, and storage medium

Publications (1)

Publication Number Publication Date
WO2020199905A1 true WO2020199905A1 (zh) 2020-10-08

Family

ID=67168872

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/079484 WO2020199905A1 (zh) 2019-03-29 2020-03-16 命令检测方法、装置、计算机设备以及存储介质

Country Status (3)

Country Link
US (1) US20210264023A1 (zh)
CN (1) CN110012000B (zh)
WO (1) WO2020199905A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110012000B (zh) * 2019-03-29 2021-07-06 深圳市腾讯计算机系统有限公司 命令检测方法、装置、计算机设备以及存储介质
CN111477048A (zh) * 2020-05-16 2020-07-31 安徽商贸职业技术学院 一种在线实验教学平台及教学方法
US20230289449A1 (en) * 2022-03-11 2023-09-14 Bank Of America Corporation Apparatus and methods for leveraging machine learning to programmatically identify and detect obfuscation

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254120A (zh) * 2011-08-09 2011-11-23 成都市华为赛门铁克科技有限公司 恶意代码的检测方法、系统及相关装置
CN103761481A (zh) * 2014-01-23 2014-04-30 北京奇虎科技有限公司 一种恶意代码样本自动处理的方法及装置
CN105260662A (zh) * 2014-07-17 2016-01-20 南京曼安信息科技有限公司 一种未知应用漏洞威胁检测装置及方法
US20170262633A1 (en) * 2012-09-26 2017-09-14 Bluvector, Inc. System and method for automated machine-learning, zero-day malware detection
US20180255093A1 (en) * 2017-03-06 2018-09-06 Radware, Ltd. DETECTION AND MITIGATION OF SLOW APPLICATION LAYER DDoS ATTACKS
CN109033835A (zh) * 2018-07-23 2018-12-18 成都立鑫新技术科技有限公司 一种异构双引擎检测移动终端恶意代码的方法
CN109388623A (zh) * 2018-11-02 2019-02-26 郑州云海信息技术有限公司 一种设备故障检测的方法、系统及相关组件
CN110012000A (zh) * 2019-03-29 2019-07-12 深圳市腾讯计算机系统有限公司 命令检测方法、装置、计算机设备以及存储介质

Family Cites Families (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7941856B2 (en) * 2004-12-06 2011-05-10 Wisconsin Alumni Research Foundation Systems and methods for testing and evaluating an intrusion detection system
KR20080045545A (ko) * 2006-11-20 2008-05-23 삼성전자주식회사 조건부 영역을 전처리하는 방법
US8291496B2 (en) * 2008-05-12 2012-10-16 Enpulz, L.L.C. Server based malware screening
US8756693B2 (en) * 2011-04-05 2014-06-17 The United States Of America As Represented By The Secretary Of The Air Force Malware target recognition
US9292688B2 (en) * 2012-09-26 2016-03-22 Northrop Grumman Systems Corporation System and method for automated machine-learning, zero-day malware detection
US9635039B1 (en) * 2013-05-13 2017-04-25 Fireeye, Inc. Classifying sets of malicious indicators for detecting command and control communications associated with malware
WO2016186975A1 (en) * 2015-05-15 2016-11-24 Virsec Systems, Inc. Detection of sql injection attacks
US9516055B1 (en) * 2015-05-29 2016-12-06 Trend Micro Incorporated Automatic malware signature extraction from runtime information
CN105022960B (zh) * 2015-08-10 2017-11-21 济南大学 基于网络流量的多特征移动终端恶意软件检测方法及系统
WO2017074402A1 (en) * 2015-10-29 2017-05-04 Cloudcoffer Llc Methods for preventing computer attacks in two-phase filtering and apparatuses using the same
US9992217B2 (en) * 2015-12-31 2018-06-05 The University Of North Carolina At Chapel Hill Methods, systems, and computer readable media for detecting malicious network traffic
US10296444B1 (en) * 2016-06-03 2019-05-21 Georgia Tech Research Corporation Methods and systems for testing mobile applications for android mobile devices
US20180060569A1 (en) * 2016-08-26 2018-03-01 Qualcomm Incorporated Detection and Prevention of Malicious Shell Exploits
US10198309B2 (en) * 2016-11-04 2019-02-05 Paypal, Inc. Unexpected event detection during execution of an application
US10534909B2 (en) * 2017-03-02 2020-01-14 Fortinet, Inc. Multi-tiered sandbox based network threat detection
US10635811B2 (en) * 2017-03-21 2020-04-28 Secureworks Corp. System and method for automation of malware unpacking and analysis
US10558809B1 (en) * 2017-04-12 2020-02-11 Architecture Technology Corporation Software assurance system for runtime environments
US10873589B2 (en) * 2017-08-08 2020-12-22 Sonicwall Inc. Real-time prevention of malicious content via dynamic analysis
CN107657175A (zh) * 2017-09-15 2018-02-02 北京理工大学 一种基于图像特征描述子的恶意样本同源检测方法
CN108460277A (zh) * 2018-02-10 2018-08-28 北京工业大学 一种自动化恶意代码变种检测方法
EP3814961B1 (en) * 2018-06-28 2023-08-09 CrowdStrike, Inc. Analysis of malware

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102254120A (zh) * 2011-08-09 2011-11-23 成都市华为赛门铁克科技有限公司 恶意代码的检测方法、系统及相关装置
US20170262633A1 (en) * 2012-09-26 2017-09-14 Bluvector, Inc. System and method for automated machine-learning, zero-day malware detection
CN103761481A (zh) * 2014-01-23 2014-04-30 北京奇虎科技有限公司 一种恶意代码样本自动处理的方法及装置
CN105260662A (zh) * 2014-07-17 2016-01-20 南京曼安信息科技有限公司 一种未知应用漏洞威胁检测装置及方法
US20180255093A1 (en) * 2017-03-06 2018-09-06 Radware, Ltd. DETECTION AND MITIGATION OF SLOW APPLICATION LAYER DDoS ATTACKS
CN109033835A (zh) * 2018-07-23 2018-12-18 成都立鑫新技术科技有限公司 一种异构双引擎检测移动终端恶意代码的方法
CN109388623A (zh) * 2018-11-02 2019-02-26 郑州云海信息技术有限公司 一种设备故障检测的方法、系统及相关组件
CN110012000A (zh) * 2019-03-29 2019-07-12 深圳市腾讯计算机系统有限公司 命令检测方法、装置、计算机设备以及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
ZHANG DONG, ZHANG YAO, LIU GANG, SONG GUI-XIANG: "Research on Host Malcode Detection Using Machine Learning", CHINESE JOURNAL OF NETWORK AND INFORMATION SECURITY, vol. 3, no. 7, 31 July 2017 (2017-07-31), pages 25 - 32, XP055740336, ISSN: 2096-109X, DOI: 10.11959/j.issn.2096-109x.2017.00179 *

Also Published As

Publication number Publication date
US20210264023A1 (en) 2021-08-26
CN110012000B (zh) 2021-07-06
CN110012000A (zh) 2019-07-12

Similar Documents

Publication Publication Date Title
WO2020199905A1 (zh) 命令检测方法、装置、计算机设备以及存储介质
CN108965340B (zh) 一种工业控制系统入侵检测方法及系统
CN109362235B (zh) 对网络可访问存储装置处的事务进行分类的方法
US10915626B2 (en) Graph model for alert interpretation in enterprise security system
JP2016505981A (ja) セキュリティ関連システム状態のリアルタイム表現
AU2019307885B2 (en) Systems and methods for reporting computer security incidents
CN110879889A (zh) Windows平台的恶意软件的检测方法及系统
US20200374179A1 (en) Techniques for correlating service events in computer network diagnostics
JP2023550974A (ja) イメージ基盤悪性コード検知方法および装置とこれを利用する人工知能基盤エンドポイント脅威検知および対応システム
US10282239B2 (en) Monitoring method
CN105930740B (zh) 软体文件被修改时的来源追溯方法、监测方法、还原方法及系统
CN114238330A (zh) 一种数据处理方法、装置、电子设备和存储介质
JP7274162B2 (ja) 異常操作検知装置、異常操作検知方法、およびプログラム
KR102311997B1 (ko) 인공지능 행위분석 기반의 edr 장치 및 방법
US10185465B1 (en) Techniques for presenting information on a graphical user interface
CA3172788A1 (en) Endpoint security using an action prediction model
CN112134723A (zh) 网络异常监测方法、装置、计算机设备和存储介质
US10554672B2 (en) Causality identification and attributions determination of processes in a network
WO2019123449A1 (en) A system and method for analyzing network traffic
KR102348359B1 (ko) 관심 동작 영역 기반의 edr 장치 및 방법
US11853173B1 (en) Log file manipulation detection
US11681805B1 (en) System for analytic data memorialization, data science, and validation
CN114640529B (zh) 攻击防护方法、装置、设备、存储介质和计算机程序产品
CN112541183B (zh) 数据处理方法及装置、边缘计算设备、存储介质
JP7302223B2 (ja) スクリプト検出装置、方法及びプログラム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20782092

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20782092

Country of ref document: EP

Kind code of ref document: A1