A webshell detection method and system thereof

Abstract

The embodiment of the invention discloses a WebShell detection method and system thereof. The method includes: deploying an encryption tool and a decryption tool; extracting relevant information of a Web application; judging whether there is a new dynamic script file in all file directories in the relevant information; if it exists, judging whether there is call chain information; , then the newly-added dynamic script file is isolated, and a malicious Webshell alarm is carried out; if it does not exist, the encryption of the dynamic script file is performed to obtain the encryption result; whether the encryption is successful is judged; if the encryption is successful, the encrypted Decrypt the dynamic script file to obtain the decryption result; judge whether the decryption is successful; if not, isolate the dynamic script file that failed to decrypt; generate a malicious WebShell alarm. By implementing the method of the embodiment of the present invention, it is possible to effectively identify changeable WebShell backdoors.

Description

technical field [0001] The invention relates to the technical field of webpage security analysis, and more specifically refers to a WebShell detection method and a system thereof. Background technique [0002] Traditional WebShell detection and recognition is based on known WebShell code characteristics and WebShell traffic characteristics. By detecting the WebShell code, it is detected whether the WebShell code matches the existing common WebShell code signature library, and the functions used in the code are detected to obtain a judgment ; To detect the WebShell traffic characteristics, one is based on the commands executed by WebShell and the payload characteristics, and the other is based on the traffic characteristics of common WebShell management tools, such as kitchen knife and ice scorpion. Because it relies on its own relevant matching rules or strategies, it often leads to a large number of false positives and false negatives in terms of security issues, and is oft...

AI Technical Summary

Problems solved by technology

Because it relies on its own relevant matching rules or strategies, it often leads to a large number of false positives and false negatives in terms of security issues, and is often at a disadvantage in intelligence updates and threat sniffing; at the same time, because its security judgment is based on rules, And the rules are often a collection of known threats, resulting in the existence of WebShell that can bypass detection and attack

Therefore, the current WebShell detection and identification method cannot effectively identify the changeable WebShell backdoor

Images