File risk detection method and device

Abstract

The embodiment of the invention discloses a file risk detection method and device, and the method comprises the steps: obtaining a webpage file when detecting that the webpage file is abnormal; performing file label analysis on the webpage file to obtain multi-dimensional file feature data of the webpage file; performing global information integration on the multi-dimensional file feature data ofthe webpage file according to pre-acquired whole network file feature statistical information to obtain multi-dimensional file risk information; and when the multi-dimensional file risk information reaches a preset requirement, determining that the webpage file is a malicious webpage file. According to the embodiment of the invention, the malicious degree of the file can be analyzed without depending on the file content, whether the webpage file is malicious or not is effectively confirmed, the missed detection condition of the webpage file is avoided, the detection accuracy is improved, and meanwhile, better real-time performance is achieved.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a file risk detection method and device. Background technique [0002] Webshell refers to dynamic server pages (Active Server Pages, ASP), hypertext preprocessor (Hypertext Preprocessor, PHP), java server pages (Java Server Pages, JSP) or common gateway interface (Common Gateway Interface, CGI), etc. A command execution environment in the form of a web page file, which can also be called a web page backdoor. After an intruder invades a website, they usually mix backdoor files such as ASP or PHP with normal webpage files in the directory of the website server, and then use a browser to access backdoor files such as ASP or PHP to get a command to execute Environment, through the Webshell to obtain a certain degree of operating authority to the website server, so as to achieve the purpose of controlling the website server. [0003] In the prior art, the detection of Webshel...

AI Technical Summary

Problems solved by technology

[0004]A major problem in the existing technology is that it is necessary to perform feature matching on the static features of the text. When the corresponding features are hit, it will enter the background detection and analysis process. When the intruder Deliberately bypassing detection, using deformed or more concealed control functions, so that malicious web files do not have corresponding detection features, the system will not perceive the existence of this file on the target machine, there is a risk of missing detection, and the detection accuracy is low. Unable to effectively guarantee the security of the website server

Images