Webshell detection method based on image analysis, terminal equipment and storage medium

Abstract

The invention relates to a Webshell detection method based on image analysis, terminal equipment and a storage medium. The method comprises the following steps: S1, collecting a plurality of normal and abnormal Webshell samples; S2, according to the collected Webshell samples and the Opcode sequence and the Opcode frequency of the Webshell to be detected, generating a corresponding RGB image; S3, calculating the distance between the RGB image of the to-be-tested Webshell and the RGB image of each Webshell sample, sorting the Webshell samples according to the sequence of the distances from small to large, selecting the first N Webshell samples from the sorting result, judging the types of the first N Webshell samples, and taking the type with the maximum corresponding number as the type of the to-be-tested Webshell. According to the method, the malicious behavior of the Webshell is represented by the Opcode feature, the two-dimensional gray level image is generated by using the Opcode sequence, and then the RGB image is synthesized by combining the gray level image generated by the Opcode frequency, so that the malicious behavior of the Webshell can be represented more completely, and the detection performance is improved.

Description

technical field [0001] The invention relates to the field of Webshell detection, in particular to an image analysis-based Webshell detection method, a terminal device and a storage medium. Background technique [0002] Web application systems are now widely used in important business lines such as social networking, shopping, banking, and mail, and occupy a very important position in network assets. The system is vulnerable to intrusion due to its wide attack surface and multiple attack techniques. Webshell is a backdoor program that intruders control servers in the form of dynamic scripts. It is very important to effectively detect website backdoor programs and understand the security status of applications. Limited by detection technology, there are still a large number of website Trojans that cannot be detected. Webshell variants emerge in endlessly, and it is difficult for existing detection methods to effectively fight against them. The situation is very grim. [000...

AI Technical Summary

Problems solved by technology

The essence of regular expressions is a finite state automaton, which cannot well define behavioral characteristics and complete coverage risk models, so there is a bottleneck that cannot cross domains in detecting false negative rates and false positive rates

In a 2005 paper by Hansen of the University of Iowa, it was theoretically proved that there must be false negatives and false positives in the regular matching method.

Images