Webshell page detection method and device based on intra-domain page association

Abstract

The invention provides a webshell page detection method and device based on intra-domain page association. The method comprises steps as follows: acquiring a script file and / or a tag language file of a dynamic page of a to-be-detected website according to a file directory of the to-be-detected website; extracting URL links in the script file and / or the tag language file of the dynamic page, and generating a URL link tag tree of the intra-domain page association, wherein the URL link tag tree comprises pages corresponding to URLs and inclusion relations among the pages; traversing the URL link tag tree and extracting first-class nodes and second-class nodes, wherein the first-class nodes are isolated nodes which contain no superior and subordinate nodes, the second-class nodes are nodes which contain subordinate nodes but do not contain superior nodes, and pages corresponding to the subordinate nodes are extra-domain pages; acquiring suspected webshell pages according to the pages corresponding to the extracted first-class and second-class nodes. Whether the webshell pages exist in a website or not can be detected accurately and quickly.

Description

technical field [0001] The present invention relates to the field of communication technologies, in particular to a method and device for detecting webshell pages based on intra-domain page association relationships. Background technique [0002] With the continuous progress and development of WEB application technology, WEB applications carry more and more services, and the security problems that WEB applications face are more and more complicated. According to statistics from authoritative organizations such as Public Vulnerabilities and Exposure CVE, security attacks on web applications have surpassed the sum of security attacks on other layers, and hacker attacks have gradually shifted from the traditional network layer to the application layer. After hackers invade a website, they often achieve the purpose of long-term control of the website by implanting a webshell backdoor in the website. [0003] Webshell is a script backdoor program in the form of a webpage. Like o...

AI Technical Summary

Problems solved by technology

Based on this feature, the isolated page in the website is found by sorting out the page association relationship. The isolated page is the webshell, but the main function of the background login page of the website, or some functional pages in the background, is realized by passing parameters through post. It may be an isolated page itself and may not contain other pages or be not included by other pages, so it is easy to be misjudged as a webshell; and some webshells may have links such as links to the author's Weibo or backdoor links in the backdoor, from which to judge whether Detecting methods for unrelated pages may cause false positives from the webshell

Images