Website back door detection method and device

Abstract

The invention provides a website back door detection method and device. The website backdoor detection method comprises steps of putting a file of a website to be detected into an independent space isolated from a practical execution environment of the file of the website to be detected for operation; constructing an external parameter carrying a danger label and supplying the external parameter to the file of the website to be detected by responding to an external parameter obtaining request transmitted by the file of the website to be detected during operation in the independent space, wherein the external parameter carrying the danger label goes through a booking string processing function and the danger label is maintained; determining whether the file of the website to be detected executes the danger function during a process of operating in the independent space and whether the parameter of the danger function has the danger label; if afacts that the file of the website to be detected executes the danger function in the process of operating in the independent space and the danger function calls the parameter with the danger labels is determined, detecting that the file of the website to be detected is a backdoor file. The embodiment of the website back door detection method and device can effectively detect the backdoor of the website.

Description

technical field [0001] The invention relates to information security, in particular to a website backdoor detection method and device. Background technique [0002] Website backdoors usually refer to those website files that bypass website security control to gain control of the website server, and are usually written in codes such as asp, php, jsp or cgi. Most web scripting languages ​​support the execution of dynamic codes, such as executing received parameters as codes, or executing variables after operations as codes. This is often used by hackers to write website backdoors and bypass security detection. That is to say, the Trojan horse executor puts the backdoor file which is not a Trojan horse into the website server, which usually has strong concealment, and will not be directly used by the Trojan horse attacker to attack the website server, but as a means for the Trojan horse attacker to attack the website server. aisle. That is, the Trojan horse attacker usually s...

AI Technical Summary

Problems solved by technology

The disadvantage of static detection is that most scripting languages ​​now support dynamic code generation at runtime and use assert to execute. Specific parameters may be encrypted and obfuscated before being provided to the backdoor, so that the backdoor has completely lost the backdoor in terms of static code. Features, only after specific parameters are encrypted and obfuscated and provided to the back door, the back door will show the characteristics of the back door

This detection method is prone to false negatives and false positives

Images