Method and device for identifying web page intrusion script features

Abstract

The present application provides a method and device for identifying features of web page intrusion scripts. By mapping a certain number of reference web page scripts and their feature information acquired into multi-dimensional space reference vectors and their assignments, according to the reference vectors and their assigned values The distribution model of the assignment in the multidimensional space is acquired, and when the feature recognition of the web page intrusion feature script is required, the webpage script to be tested is obtained and the feature information of the webpage script to be tested is mapped to the vector to be tested in the multidimensional space , the webpage intrusion script feature of the webpage script to be tested can be obtained only by inputting the characteristic information of the vector to be tested into the distribution model assigned in the multidimensional space, thus reducing the requirement for computing hardware, and ensuring that the webpage intrusion script While improving the recognition accuracy of features, the recognition time is greatly reduced.

Description

technical field [0001] The present application relates to the fields of communications and computers, in particular to a method and device for identifying features of web page intrusion scripts. Background technique [0002] Webpage intrusion script (Webshell) refers to the combination of certain harmful and specific string content in the webpage script, which will lead to serious consequences such as website attack and data leakage. To put it simply, a web page intrusion script is a Trojan horse backdoor of ASP (Active Server Page) or PHP (Hypertext Preprocessor, Hypertext Preprocessor). After hackers invade a website, they often use these ASP or PHP The Trojan horse backdoor file is placed in the web directory of the website server and mixed with normal webpage files. Then, the hacker can use the web (web page) mode to control the website server through the ASP or PHP Trojan horse backdoor, including uploading and downloading files, and viewing the database. , Execute arb...

AI Technical Summary

Problems solved by technology

However, as the number of reference webpage scripts continues to increase, the reference webpage scripts occupy a high disk and memory space, which can range from several megabytes to hundreds of megabytes, so there is a bottleneck in the library volume; and, when the volume reaches a certain level, During the feature recognition process of web page intrusion scripts, the CPU (memory) occupancy rate of the entire library is getting higher and higher, even up to 100% occupancy rate, which cannot meet the CPU usage limit requirements in production scenarios; in addition, the recognition speed is slow, and the average The recognition time of a single webpage script file is about 500 milliseconds to 1 second, and thus loses its use value

Images