A method for extracting webshell software gene based on RASP for webshell detection

Abstract

The invention discloses a method for extracting webshell software gene based on RASP technology, which can be used for webshell detection by deploying label probes and deploying detection probes to extract webshell software gene. The method includes extracting common software genes of webshell from existing webshell, Determining the parameter input point of the code of the system to be detected, extracting the input parameter, extracting the software gene and perfecting it as the static gene of the code of the system to be detected; Deploying RASP: determining the parameter input point of thesystem code to be detected, and marking the parameter input by inserting a marker probe; Determining a function insertion point of the system to be detected, and deploying a detection probe; Acquiringthe context of the code to be detected inserted into the detection probe, and forming a behavior gene of the code to be detected according to the detection result of the detection probe; comparing the software gene with webshell gene bank and virus trojan gene bank to determine whether it is webshell or not. The invention can improve the accuracy and efficiency of detecting webshell, and can be widely applied.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for extracting webshell software genes based on RASP technology for webshell detection. Background technique [0002] In recent years, the number of viruses and Trojan horses has grown rapidly, and the types have become increasingly complex, and the deformation of viruses and Trojan horses has become increasingly complex. The existing detection webshells are mainly static detection and dynamic detection. However, these detection methods have not penetrated into the program. The success rate of some webshell detection methods is low, and the existing detection methods rely heavily on manual work, so the detection efficiency is not ideal. It can be detected by a software-based gene detection method, which can overcome the above difficulties. [0003] The existing methods for extracting software genes are mainly static analysis based on semantics and dynamic a...

AI Technical Summary

Problems solved by technology

[0003] The existing methods for extracting software genes are mainly static analysis based on semantics and dynamic analysis combined with dynamic debugging. However, the existing methods for extracting software genes have not penetrated into the program, so the software genes extracted by the existing methods are accurate. The rate is low, and the existing methods to extract software genes largely rely on manual work, and the efficiency is also low

Using the existing method to extract the software gene of the webshell, and then detect the webshell, the accuracy of the webshell detection is low

Images