Server malicious program detection method based on code characteristics and flow behaviors

Abstract

The invention discloses a server malicious program detection method based on code characteristics and flow behaviors, which comprises the following steps: collecting a server backdoor program sample,extracting function characteristics, taking a hash value, and establishing a malicious program sample library; extracting code features and flow behavior vectors; performing feature optimization to obtain a new feature set; feature training: taking the new feature set as a training sample set for feature training, taking a labeling result as expected output, and training a classifier; and comprehensively judging and inputting the to-be-detected sample code characteristics and the flow behaviors into the classifier, judging whether the to-be-detected sample code characteristics and the flow behaviors are malicious programs or not, and outputting a result. According to the invention, the efficiency and accuracy of server backdoor program detection are improved.

Description

technical field [0001] The invention relates to the technical field of malicious program detection, in particular to a server-side malicious program detection method based on code features and traffic behavior. Background technique [0002] With the continuous confrontation between the offensive and defensive sides, in the past, the server backdoor programs were mainly script files such as asp, jsp, php, etc., which can also be called a web page backdoor program. Now, in addition to web page backdoor programs, based on powershell, bash File, elf, exe and other binary executable program fileless landing attack schemes are also quietly popular. After the attacker exploits the vulnerability to gain control of the server, he usually puts the server backdoor program file and the normal script file in the web directory of the website server together. Then use the browser to access the server backdoor program file, obtain the server backdoor program command execution environment, a...

AI Technical Summary

Problems solved by technology

[0004] 1. Static detection: Traditional static detection is based on the matching of feature databases. This kind of matching based on characteristic characters is generally realized through regular expressions. The coverage of regular expressions is not complete after matching, which will cause certain false positives and false positives. And attackers can easily evade this type of detection by using obfuscation

[0005] 2. Dynamic detection: After the server backdoor program file is uploaded to the server, the characteristics displayed when the attacker executes the server backdoor program file are called dynamic features, but only the behavior of uploading or accessing the server backdoor program can be detected. It cannot detect existing and unused server backdoor programs in the website, and there are certain false negatives and false positives

[0006] To sum up: the existing server backdoor program detection methods have incomplete coverage, high false positive and false negative rates, and cannot detect unknown server backdoor programs.

Images