Rebound shell detection method based on behavior detection

Abstract

The invention discloses a rebound shell detection method based on behavior detection, and relates to the technical field of information security. The method comprises the following steps of: (1) obtaining a shell process creation opportunity; (2) checking the network connection state of the shell process; and (3) comprehensively judging whether the network connection belongs to rebound and whetherthe process belongs to a shell process. According to the invention, higher accuracy and real-time performance can be achieved, judgment links are reduced, the speed is high, the accuracy is high, thereliability is good, and the availability is high.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a detection method of a rebound shell based on behavior detection. Background technique [0002] Reverse shell technology is a kind of reverse Trojan horse, but there is a major difference. The difference is that the attacker does not need to install a special Trojan horse program on the intranet to use the vulnerability to start the shell program on the system to manipulate the intranet machine. . The Trojan horse in the rebound Trojan horse is a specific program, but the program corresponding to the reverse shell is a normal program that can execute scripts. The attacker uses the script to attack. The attacker uses the reverse shell to enter the system from the outside smoothly, and Perform various operations; historically, there has been little detection of this behavior due to the rebound characteristics and script nature of the network action of the reverse she...

AI Technical Summary

Problems solved by technology

These two methods are characterized by the need for a learning process, or the need for a large amount of security data as back-end support. If the support of security data is required, zero-day vulnerabilities and attacks cannot be resisted.

However, the current rebound shell detection method also has a relatively large problem. The terminal attribute of the judgment program can only be used in specific scenarios, such as webshell detection. In other environments, the judgment method of the terminal attribute will face normal programs and The terminal attribute of the behavioral program meets the conditions for abnormal judgment, resulting in false positives, too many false positives to handle, and finally loss of usability

Images