Webshell detection method and device, computer device, readable storage medium

Abstract

The embodiment of the invention discloses a Webshell detection method and device, a computer device, and a readable storage medium for quickly and effectively realizing the detection of Webshell. The method of the embodiment comprises a step of obtaining an access log which comprises Http request information initialized by a browser to a Web service system, data request information initialized by the Web service system to a database system based on the Http request information, data response information fed by the database system to the Web service system based on the data request information, and Http response information fed by the Web service system to the browser based on the data response information, a step of extracting the Http response information from the access log, a step of detecting whether the Http response information comprises sensitive information of the database system or not, and a step of determining a condition that the Http response information points at the Webshell.

Description

Technical field [0001] The present invention relates to the field of Internet security technology, in particular to a Webshell detection method and device, a computer device, and a readable storage medium. Background technique [0002] General data intrusion is to control the web system first, and then access the database through the web system to steal data. Since the identity of the visitor is legal when accessing through the web system, the firewall cannot recognize that this is an abnormal access, so it cannot defend against other types of attacks. Therefore, it is very important for database security products to have the ability to recognize webshell behavior. [0003] However, the development of webshell detection technology has focused more on web host detection and network detection: 1. Host detection requires installing detection and killing tools or software on the website server. The main techniques used are static feature library matching and file creation. And modifi...

AI Technical Summary

Problems solved by technology

[0003] However, since the development of webshell detection technology, more emphasis has been placed on web host detection and network detection: 1. Host detection requires installation of detection and killing tools or software on the website server. The main technologies used include static feature library skin matching and file creation. And modification time monitoring, longest word detection, coincidence index detection, information entropy detection, file compression ratio detection, hook risk function, etc. This detection method is relatively mature, but the real-time performance is not good; 2. Network detection, that is, network traffic characteristics Matching is reflected in the matching of the transmission traffic characteristics of the webshell's own code and the communication traffic characteristics of the webshell during execution. The network traffic characteristic matching method is simple and the inspection is quick, but complex semantic analysis requires large resources and high costs, and for uploaded Poor detection after webshell

Images