WebShell detection method and system

Abstract

The invention provides a WebShell detection method and system. The system comprises a log auditing module, a local detection module, a remote detection module and a result output module. The system executes the following processing flow: A, collecting a server access log, and analyzing a URL (Uniform Resource Locator) with suspicious access behaviors; B, performing local detection and remote detection on the analyzed URL with suspicious access behaviors in combination with a WebShell feature library; C, and performing judgment according to the detection, reporting a WebShell path if WebShell is found, and meanwhile adding the path identified as WebShell into a WebShell path library. Through adoption of the method and the system, the detection rate and detection efficiency of WebShell detection in network Web application are increased, and the missing report rate and false report rate are lowered.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a WebShell detection method and system. Background technique [0002] With the birth of a series of new Internet products such as Web2.0, social network, and Weibo, Internet applications based on the Web environment are becoming more and more extensive. In the process of enterprise informatization, various applications are set up on the Web platform. The rapid development of business has also attracted the strong attention of hackers, followed by the emergence of web security threats. Hackers use the loopholes in the website operating system and the SQL injection loopholes in the web service program to gain control of the web server, and at least tamper with the webpage. The serious one is to steal important internal data, and the more serious one is to implant malicious code in the webpage, so that the website visitors are violated. This also makes more and more users...

AI Technical Summary

Problems solved by technology

Remote detection does not require additional permissions, but due to the concealment of WebShell and the limitation that web crawlers can only crawl pages with reference relationships, the path dictionary-based detection method has great limitations, because the upload path of WebShell The name of the file and the uploaded file are arbitrarily specified by the attacker. Once the attacker uses a very complicated path, and this path is not in the path dictionary of the remote detection, the remote detection cannot detect the WebShell, so the remote detection can only Detect the more common WebShell

Images