A method, device, equipment and medium for collecting obfuscated scripts

Abstract

The present application discloses an obfuscated script collection method, device, equipment, and medium, the method comprising: collecting network data transmitted by the network device through a network probe in the network device; using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script; if the network data includes an obfuscated script, storing the obfuscated script in the network data into a preset obfuscated script storage space; if the script included in the network data is an unobfuscated script, storing the script in the network data into a preset unobfuscated script storage space. In this way, the real situation of obfuscated scripts on the network can be reflected, and obfuscated scripts can be collected automatically, which is efficient and not prone to errors, and a large number of obfuscated scripts can be collected without relying on third parties.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an obfuscated script collection method, device, equipment, and medium. Background Art

[0002] With the rapid development of computer hardware and the increasing computing resources, the performance overhead of the script language interpreter itself can be ignored in many scenarios. Scripting languages ​​have quickly occupied the market with their flexible programming advantages. However, the flexible writing characteristics of script programs also lead to extremely low obfuscation costs. The purposes of obfuscation include normal and malicious. The normal purpose is generally to protect the intellectual property rights of the program or to compress the program to improve network transmission efficiency. The malicious purpose is generally to avoid / bypass the detection of anti-virus systems. In network attack and defense confrontation, the study of obfuscated scripts has become a special, valuable and challenging topic. Therefore, it is necessary to collect a large number of obfuscated scripts for network attack and defense confrontation.

[0003] The main obfuscation script collection methods in the prior art mainly include the following: First, use open source obfuscation tools to confuse normal samples to generate obfuscated samples. Second, use web crawlers to automatically collect samples, and then manually screen the obfuscated samples. Third, purchase samples from third parties and screen the obfuscated scripts according to virus labels.

[0004] In the process of implementing the present application, the inventors found that the above-mentioned prior art may have the following deficiencies: the number of open source obfuscation tools used to obfuscate normal scripts is limited, the obfuscation method is fixed, and it cannot reflect the actual situation of obfuscated scripts on the Internet. The manual screening method has low manual efficiency and is prone to errors. In the method of purchasing third-party samples, the quantity and quality of samples depend on the third party. Summary of the invention

[0005] In view of this, the purpose of this application is to provide an obfuscated script collection method, device, equipment, and medium that can reflect the actual situation of obfuscated scripts on the network and automatically collect obfuscated scripts with high efficiency and low error rate. A large number of obfuscated scripts can be collected without relying on third parties.

[0006] The specific plan is as follows:

[0007] In a first aspect, the present application discloses a method for collecting obfuscated scripts, which is applied to a network device, comprising:

[0008] Collecting network data transmitted by the network device through a network probe in the network device;

[0009] Determine whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning;

[0010] If the network data includes an obfuscated script, storing the obfuscated script in the network data into a preset obfuscated script storage space;

[0011] If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space.

[0012] Optionally, the determining whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning comprises:

[0013] Determining whether the network data includes a script;

[0014] If the network data includes a script, a first rule in a preset obfuscated script detection rule and / or a first model in an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script.

[0015] Optionally, after determining whether the network data includes an obfuscated script by using a first rule in a preset obfuscated script detection rule and / or a first model in an obfuscated script recognition model obtained in advance based on machine learning, the method further includes:

[0016] If the script is not an obfuscated script, determining whether the network data includes a suspected obfuscated script by using a second rule in a preset obfuscated script detection rule and / or a second model in an obfuscated script recognition model obtained in advance based on machine learning, wherein the first rule is stricter than the second rule, and an obfuscated script detection threshold of the first model is greater than an obfuscated script detection threshold of the second model;

[0017] If the script is a suspected obfuscated script, whether the script is an obfuscated script is determined based on the acquired determination information, and the script is stored in a corresponding storage space, wherein the determination information is manually triggered determination information.

[0018] Optionally, after storing the script in the network data into a preset unobfuscated script storage space, the method further includes:

[0019] Determining a first preset number of target unobfuscated scripts from the unobfuscated script storage space;

[0020] The target unobfuscated script is obfuscated using an obfuscation tool to obtain a first counterfeit obfuscated script, and the first counterfeit obfuscated script is stored in a counterfeit obfuscated script storage space.

[0021] Optionally, after storing the script in the network data into a preset unobfuscated script storage space, the method further includes:

[0022] Determining a second preset number of target obfuscation scripts from the obfuscation script storage space;

[0023] Code hybridization is performed on the target obfuscated script to obtain a second counterfeit obfuscated script, and the second counterfeit obfuscated script is stored in the counterfeit obfuscated script storage space.

[0024] Optionally, performing code hybridization on the target obfuscated script to obtain a second counterfeit obfuscated script includes:

[0025] dividing the target obfuscation script into a first target obfuscation script and a second target obfuscation script based on the second preset number and the hybridization ratio;

[0026] splicing each third preset number of obfuscated scripts in the first target obfuscated script head to tail to obtain a first part of counterfeit obfuscated scripts in the second counterfeit obfuscated script;

[0027] The function definitions in every fourth preset number of obfuscated scripts in the second target obfuscated script are cross-joined to obtain a second part of counterfeit obfuscated scripts in the second counterfeit obfuscated script.

[0028] Optionally, after storing the second counterfeit obfuscation script in the counterfeit obfuscation script storage space, the method further includes:

[0029] A corresponding number of scripts are extracted from the obfuscated script storage space and the counterfeit obfuscated script storage space based on a preset number of samples and a preset ratio parameter to form an obfuscated script sample set, wherein the preset ratio parameter is the ratio of the preset number of counterfeit obfuscated scripts to the number of obfuscated scripts, and the obfuscated script sample set is used to iterate the obfuscated script recognition model.

[0030] In a second aspect, the present application discloses an obfuscated script collection device, which is applied to a network device, including:

[0031] A data collection module, used for collecting network data transmitted by the network device through a network probe in the network device;

[0032] An obfuscated script determination module, used to determine whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning;

[0033] A first storage module, configured to store the obfuscated script in the network data into a preset obfuscated script storage space if the network data includes an obfuscated script;

[0034] The second storage module is used to store the script in the network data into a preset unobfuscated script storage space if the script included in the network data is an unobfuscated script.

[0035] In a third aspect, the present application discloses a network device, including:

[0036] Memory and processor;

[0037] Wherein, the memory is used to store computer programs;

[0038] The processor is used to execute the computer program to implement the aforementioned obfuscated script collection method disclosed above.

[0039] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the aforementioned obfuscated script collection method disclosed above.

[0040] It can be seen that the present application is applied to a network device, and the network data transmitted by the network device is first collected by a network probe in the network device. Then, a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space. If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space. It can be seen that the present application directly deploys a network probe on a network device to collect network data transmitted by the network device, obtain a large amount of network data actually transmitted in the network, and then use the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning to determine whether the network data collected by the network probe includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script is directly stored in the preset obfuscated script storage space. If the script included in the network data is an unmixed script, the script in the network data is stored in the preset unobfuscated script storage space. In this way, the obfuscated script storage space stores the collected obfuscated scripts. These obfuscated scripts are directly detected from the network data and can reflect the actual situation of the obfuscated scripts in the network. After obtaining the network data, the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning are used to automatically determine whether the network data collected by the network probe includes an obfuscated script. Compared with the completely manual screening in the prior art, the efficiency is improved and the error rate is reduced, and there is no need for a third party to purchase the obfuscated script. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 1 A flow chart of an obfuscated script collection method disclosed in this application;

[0043] Figure 2 A flowchart of a specific obfuscated script collection method disclosed in this application;

[0044] Figure 3 A flowchart of a specific method for collecting obfuscated scripts disclosed in this application;

[0045] Figure 4 A flowchart of a specific obfuscated script collection method disclosed in this application;

[0046] Figure 5 This is a schematic diagram of the structure of an obfuscated script collection device disclosed in this application;

[0047] Figure 6 This is a schematic diagram of the network device structure disclosed in this application. DETAILED DESCRIPTION

[0048] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] At present, the methods for collecting obfuscated scripts mainly include: First, use open source obfuscation tools to confuse normal samples and generate obfuscated samples. In this method, due to the limited number of open source obfuscation tools and fixed obfuscation methods, it cannot reflect the actual situation of obfuscated scripts on the Internet. Second, use web crawlers to automatically collect samples, and then manually screen the obfuscated samples. In this method, the manual efficiency is low and it is easy to make mistakes. Third, purchase samples from third parties and screen the obfuscated scripts according to virus labels. In this method, the quantity and quality of samples depend on third parties.

[0050] See also Figure 1 As shown, the embodiment of the present application discloses a method for collecting obfuscated scripts, which is applied to a network device. The method includes:

[0051] Step S11: collecting network data transmitted by the network device through a network probe in the network device.

[0052] In the actual implementation process, a network probe is first deployed on the network security device, wherein the network probe is a component for capturing and analyzing network data packets. The network device can be a network device of a customer of a network security company with a certain number of customers. Then, the network probe can be used to collect network data transmitted by the network device, including collecting network traffic and intercepting files transmitted on the network.

[0053] Step S12: using preset obfuscation script detection rules and / or an obfuscation script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscation script.

[0054] It is understandable that after obtaining the network data, it is necessary to use preset obfuscation script detection rules and / or an obfuscation script identification module obtained in advance based on machine learning to determine whether the network data includes an obfuscation script. Obfuscation is a technical means of converting a computer program into a functionally equivalent but difficult to read and understand form, which is often used by hackers to bypass anti-virus systems. Script languages ​​are computer programming languages ​​created to shorten the writing-compiling-linking-running process of traditional computer high-level programming languages. Generally, a language that is interpreted and executed by a virtual machine rather than compiled and executed is called a scripting language.

[0055] In a first specific implementation, using a preset obfuscated script detection rule and / or an obfuscated script identification model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script includes: using a preset obfuscated script detection rule to determine whether the network data includes an obfuscated script. Wherein, using a preset obfuscated script detection rule to determine whether the network data includes an obfuscated script also includes: when the script in the network data meets the preset obfuscated script detection rule, it is determined that the network data includes an obfuscated script, and when the script in the network data does not meet the preset obfuscated script detection rule, it is determined that the script in the network data is a non-obfuscated script. That is, the preset obfuscated script inspection rule is determined based on the characteristics that the obfuscated script needs to have. Alternatively, using a preset obfuscated script detection rule to determine whether the network data includes an obfuscated script includes: when the script in the network data does not meet the preset obfuscated script detection rule, it is determined that the network data includes an obfuscated script, and when the script in the network data meets the preset obfuscated script detection rule, it is determined that the script in the network data is an unobfuscated script. That is, the preset obfuscated script inspection rule is determined based on the characteristics that the unobfuscated script needs to have.

[0056] In a second specific implementation, using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script includes: using an obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script. That is, the obfuscated script recognition model obtained in advance based on machine learning will divide the scripts in the network data into obfuscated scripts and unobfuscated scripts.

[0057] In a third specific implementation, using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script includes: using a preset obfuscated script detection rule and an obfuscated script recognition module obtained in advance based on machine learning to determine whether the network data includes an obfuscated script. That is, after the preset obfuscated script detection rule determines that the network data includes an obfuscated script, the obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. If the obfuscated script recognition model determines that the network data includes an obfuscated script, it is finally determined that the network data includes an obfuscated script. When the preset obfuscated script detection rule determines that the script included in the network data is an unobfuscated script, the obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. If the obfuscated script recognition model determines that the network data includes an obfuscated script, it is finally determined that the network data includes an obfuscated script. When the obfuscated script recognition model obtained in advance based on machine learning determines that the script included in the network data is an unobfuscated script, the preset obfuscated script detection rule is used to determine whether the network data includes an obfuscated script. If the preset obfuscated script detection rule determines that the network data includes an obfuscated script, it is finally determined that the network data includes an obfuscated script. When the preset obfuscated script detection rule and the obfuscated script recognition model are used simultaneously to determine whether the network data includes an obfuscated script, after one or both of the preset obfuscated script detection rule and the obfuscated script recognition model determine that the network data includes an obfuscated script, it can be finally determined that the network data includes an obfuscated script.

[0058] Specifically, using preset obfuscated script detection rules and / or an obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script, including: determining whether the network data includes a script; if the network data includes a script, using a first rule in the preset obfuscated script detection rules and / or a first model in the obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes an obfuscated script.

[0059] First, determine whether the network data includes a script. If the network data does not include a script directly, there is no need to perform subsequent operations to determine whether the script is an obfuscated script. If the network data includes a script, it is necessary to perform subsequent operations to determine whether the script is an obfuscated script. Therefore, first determining whether the network data includes a script can reduce the amount of data processing.

[0060] If the network data includes a script, the first rule in the preset obfuscated script detection rule and / or the first model in the obfuscated script identification model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. Among them, the first rule is a strong rule, and the first rule is defined by a virus analyst based on experience to determine some strong rules that can determine obfuscated scripts. The strong rule refers to a rule that does not contain uncertainty, that is, only one of the two can be selected between compliance with the rule or non-compliance with the rule. The first rule requires that the strong rule must be strict enough to miss some obfuscated scripts, but it is not allowed to misjudge normal scripts as obfuscated scripts. The first model is obtained by modeling the obfuscated script through a classic machine learning algorithm, wherein the machine learning can be a random forest, a support vector machine, a neural network, etc., and the feature engineering in the machine learning can be completed based on lexical analysis, syntax analysis and other technologies, which will not be repeated here. That is, the first rule and / or the first model can determine the script as an obfuscated script or an unobfuscated script.

[0061] Step S13: If the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space.

[0062] It is understandable that after determining whether the network data includes an obfuscated script, if the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space so that the obfuscated script can be taken out from the obfuscated script storage space for use later.

[0063] Step S14: If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space.

[0064] If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space.

[0065] It can be seen that the present application is applied to a network device, and the network data transmitted by the network device is first collected by a network probe in the network device. Then, a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space. If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space. It can be seen that the present application directly deploys a network probe on a network device to collect network data transmitted by the network device, obtain a large amount of network data actually transmitted in the network, and then use the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning to determine whether the network data collected by the network probe includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script is directly stored in the preset obfuscated script storage space. If the script included in the network data is an unmixed script, the script in the network data is stored in the preset unobfuscated script storage space. In this way, the obfuscated script storage space stores the collected obfuscated scripts. These obfuscated scripts are directly detected from the network data and can reflect the actual situation of the obfuscated scripts in the network. After obtaining the network data, the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning are used to automatically determine whether the network data collected by the network probe includes an obfuscated script. Compared with the completely manual screening in the prior art, the efficiency is improved and the error rate is reduced, and there is no need for a third party to purchase the obfuscated script.

[0066] See also Figure 2 As shown, the embodiment of the present application discloses a specific obfuscated script collection method, which is applied to a network device, and the method includes:

[0067] Step S21: collecting network data transmitted by the network device through a network probe in the network device.

[0068] Step S22: Determine whether the network data includes a script.

[0069] Step S23: If the network data includes a script, a first rule in a preset obfuscated script detection rule and / or a first model in an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script.

[0070] In the specific implementation process, after obtaining the network data, it is also necessary to determine whether the network data includes a script. If the network data includes a script, the first rule in the preset obfuscated script detection rule and / or the first model in the obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script.

[0071] Step S24: If the first rule and / or the first model determines that the script is an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space.

[0072] Correspondingly, if the first rule in the preset obfuscation script detection rule and / or the first model in the obfuscation script recognition model obtained in advance based on machine learning determines that the network data includes an obfuscation script, the obfuscation script is directly stored in the preset obfuscation script storage space.

[0073] Step S25: Otherwise, use the second rule in the preset obfuscated script detection rule and / or the second model in the obfuscated script recognition model obtained in advance based on machine learning to determine whether the network data includes suspected obfuscated scripts, wherein the first rule is stricter than the second rule, and the obfuscated script detection threshold of the first model is greater than the obfuscated script detection threshold of the second model.

[0074] After the above step S23, if it is determined that the script in the network data is not an obfuscated script, the second rule in the preset obfuscated script detection rule and / or the second model in the obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes suspected obfuscated scripts, wherein the first rule is stricter than the second rule, and the obfuscated script detection threshold of the first model is greater than the obfuscated script detection threshold of the second model.

[0075] That is, the first rule is a strong rule, and the second rule is a strong rule with relaxed restrictions, that is, the first rule is stricter than the second rule, and the obfuscated script detection threshold of the first model is greater than the obfuscated script detection threshold of the second model. In actual applications, since the first rule is a strong rule and the obfuscated script detection threshold of the first model is high, there will be some scripts that are misjudged as unobfuscated scripts by the first rule and the first model, so it is necessary to use the second rule and the second model to determine whether the script determined as an unobfuscated script by the first rule and / or the first model is a suspected obfuscated script.

[0076] Step S26: If the second rule and / or the second model determines that the script is a suspected obfuscated script, determine whether the script is an obfuscated script based on the acquired judgment information, and store the script in a corresponding storage space, wherein the judgment information is manually triggered judgment information.

[0077] If the second rule and / or the second model determines that the script is a suspected obfuscated script, then it is determined whether the script is an obfuscated script based on the obtained determination information, and the script is stored in the corresponding storage space, wherein the determination information is manually triggered determination information. That is, when the script is a suspected obfuscated script, it is necessary to manually determine whether the script is an obfuscated script or an unobfuscated script. If the script is an obfuscated script, the obfuscated script is stored in the obfuscated script storage space, and if the script is an unobfuscated script, the script is stored in the unobfuscated script storage space.

[0078] Step S27: Otherwise, the script is stored in the unobfuscated script storage space.

[0079] It can be understood that after step S25, if the script is determined to be an unobfuscated script, the script is stored in the unobfuscated script storage space.

[0080] Specifically, a collection tool may be deployed on the network probe, and the collection tool may be provided with the preset obfuscated script detection rules and / or an obfuscated script recognition model obtained in advance based on machine learning, so that the collection tool may implement the aforementioned obfuscated script identification method.

[0081] See also Figure 3 As shown, after storing the script in the network data into the preset unobfuscated script storage space, it also includes:

[0082] Step S31: determining a first preset number of target unobfuscated scripts from the unobfuscated script storage space.

[0083] In the actual implementation process, it is also necessary to determine a first preset number of target unobfuscated scripts from the unobfuscated script storage space. Specifically, the first preset number of unobfuscated scripts can be randomly selected from the unobfuscated script storage space as the target unobfuscated scripts.

[0084] Step S32: using an obfuscation tool to obfuscate the target unobfuscated script to obtain a first counterfeit obfuscated script, and storing the first counterfeit obfuscated script in a counterfeit obfuscated script storage space.

[0085] It is understandable that after determining the target unobfuscated script, it is necessary to use an obfuscation tool to obfuscate the target unobfuscated script to obtain a first counterfeit obfuscated script, and store the first counterfeit obfuscated script in the counterfeit obfuscated script storage space.

[0086] Step S33: determining a second preset number of target obfuscation scripts from the obfuscation script storage space.

[0087] In the actual implementation process, it is also necessary to determine a second preset number of target obfuscated scripts from the obfuscated script storage space. Specifically, the second preset number of obfuscated scripts can be randomly selected from the obfuscated script storage space as the target obfuscated scripts. The first preset number and the second preset number can be the same or different, and the first preset number and the second preset number can be determined according to actual conditions.

[0088] Step S34: performing code hybridization on the target obfuscated script to obtain a second counterfeit obfuscated script, and storing the second counterfeit obfuscated script in the counterfeit obfuscated script storage space.

[0089] After determining the target obfuscation script, it is also necessary to perform code hybridization on the target obfuscation script to obtain a second counterfeit obfuscation script, and store the second counterfeit obfuscation script in the counterfeit obfuscation script storage space.

[0090] Specifically, performing code hybridization on the target obfuscation script to obtain a second counterfeit obfuscation script includes: dividing the target obfuscation script into a first target obfuscation script and a second target obfuscation script based on the second preset number and the hybridization ratio; splicing every third preset number of obfuscation scripts in the first target obfuscation script head to tail to obtain a first part of counterfeit obfuscation scripts in the second counterfeit obfuscation script; cross-splicing function definitions in every fourth preset number of obfuscation scripts in the second target obfuscation script to obtain a second part of counterfeit obfuscation scripts in the second counterfeit obfuscation script.

[0091] Code hybridization is performed on the target obfuscation script, including two hybridization methods, so the hybridization ratio can be preset, and then the target obfuscation is divided into a first target obfuscation script and a second target obfuscation script based on the second preset number and the hybridization ratio, and every third preset number of obfuscation scripts in the first target obfuscation script are spliced ​​head to tail to obtain a first part of counterfeit obfuscation scripts in the second counterfeit obfuscation script, that is, coarse-grained hybridization is performed on the first target obfuscation script, wherein specifically, every third preset number of obfuscation scripts can be spliced ​​head to tail, wherein the third preset number is less than or equal to the total number of obfuscation scripts in the first target obfuscation script. For example, the first target obfuscation script includes 4 obfuscation scripts, namely obfuscation scripts 1, 2, 3, and 4. Each two obfuscation scripts in the 4 obfuscation scripts can be spliced ​​together to form a counterfeit obfuscation script. For example, obfuscation script 1 and obfuscation script 2 are spliced ​​together to form a counterfeit obfuscation script, obfuscation script 1 and obfuscation script 3 are spliced ​​together to form a counterfeit obfuscation script, obfuscation script 1 and obfuscation script 4 are spliced ​​together to form a counterfeit obfuscation script, obfuscation script 2 and obfuscation script 3 are spliced ​​together to form a counterfeit obfuscation script, obfuscation script 2 and obfuscation script 4 are spliced ​​together to form a counterfeit obfuscation script, and obfuscation script 3 and obfuscation script 4 are spliced ​​together to form a counterfeit obfuscation script. These 6 counterfeit obfuscation scripts constitute the first part of the counterfeit obfuscation script in the second counterfeit obfuscation script. Of course, the number of "third preset number" can change each time the head and tail are spliced ​​together in this application, which is also within the scope of protection of this application. Secondly, the number of "head and tail splicing" is not limited in this application.

[0092] Then, the function definitions in every fourth preset number of obfuscated scripts in the second target obfuscated script are cross-joined to obtain a second part of the counterfeit obfuscated scripts in the second counterfeit obfuscated script, that is, the second target obfuscated script is subjected to fine-grained hybridization, wherein the fourth preset number is less than or equal to the total number of obfuscated scripts in the second target obfuscated script. For example, the second target obfuscation script includes four obfuscation scripts, namely obfuscation scripts 5, 6, 7, and 8. The function definitions in every two obfuscation scripts of the four obfuscation scripts can be cross-spliced. For example, the function definitions in obfuscation script 5 and obfuscation script 6 are cross-spliced ​​to form a counterfeit obfuscation script, the function definitions in obfuscation script 5 and obfuscation script 7 are cross-spliced ​​to form a counterfeit obfuscation script, the function definitions in obfuscation script 5 and obfuscation script 8 are cross-spliced ​​to form a counterfeit obfuscation script, the function definitions in obfuscation script 6 and obfuscation script 7 are cross-spliced ​​to form a counterfeit obfuscation script, the function definitions in obfuscation script 6 and obfuscation script 8 are cross-spliced ​​to form a counterfeit obfuscation script, the function definitions in obfuscation script 7 and obfuscation script 8 are cross-spliced ​​to form a counterfeit obfuscation script, and these six counterfeit obfuscation scripts constitute the second part of the counterfeit obfuscation script in the second counterfeit obfuscation script. Among them, the function definitions in the obfuscated script 5 and the obfuscated script 6 are cross-spliced ​​to form a counterfeit obfuscated script. Specifically, for example, the obfuscated script 5 includes function definitions A, B, and C in sequence, and the obfuscated script 6 includes function definitions E, F, and G in sequence. Then the counterfeit obfuscated script includes function definitions A, E, B, F, C, and G in sequence, or A, B, E, F, C, and G. Of course, the number of the "fourth preset number" can change each time the end is spliced ​​in this application, which is also within the scope of protection of this application. Secondly, the number of "cross-splicing" is not limited in this application.

[0093] In this way, after obtaining the obfuscated script, the obfuscated script is also used for hybridization to construct a counterfeit obfuscated script, which can increase the number of obfuscated scripts obtained, which is conducive to obtaining a large number of obfuscated scripts, and increases the types of obfuscated scripts, which is conducive to obtaining a large number of rich obfuscated scripts.

[0094] Step S35: Based on a preset number of samples and a preset ratio parameter, a corresponding number of scripts are extracted from the obfuscated script storage space and the counterfeit obfuscated script storage space to form an obfuscated script sample set, wherein the preset ratio parameter is the ratio of the preset number of counterfeit obfuscated scripts to the number of obfuscated scripts, and the obfuscated script sample set is used to iterate the obfuscated script recognition model.

[0095] After storing the first counterfeit obfuscation script and the counterfeit obfuscation script in the counterfeit obfuscation script storage space, a corresponding number of scripts can be extracted from the obfuscation script storage space and the counterfeit obfuscation script storage space to form an obfuscation script sample set based on a preset sample number and a preset ratio parameter, wherein the preset ratio parameter is a ratio of the preset number of counterfeit obfuscation scripts to the number of obfuscation scripts, and the obfuscation script sample set is used to iterate the obfuscation script recognition model. Iterating the obfuscation script recognition model using counterfeit obfuscation scripts and directly collected obfuscation scripts can improve the recognition ability of the obfuscation script recognition model, that is, improve the detection rate of the obfuscation script recognition model, and iterating the obfuscation script recognition model using directly collected obfuscation scripts can improve the accuracy of the obfuscation script recognition model.

[0096] That is, the obfuscated script sample set may include a certain number of obfuscated scripts actually detected from the network and a certain number of counterfeit obfuscated scripts, and the ratio of the number of obfuscated scripts actually detected to the number of counterfeit obfuscated scripts can be set, that is, the preset ratio parameter can be preset. For example, the preset ratio parameter is 1:1, and the preset number of samples is 20,000, then 10,000 obfuscated scripts are extracted from the obfuscated script storage space, and 10,000 counterfeit obfuscated scripts are extracted from the counterfeit obfuscated script storage space to form an obfuscated script sample set, and then the obfuscated script recognition model is iterated using the obfuscated script sample set.

[0097] See also Figure 4 The following is a flowchart of obfuscated script detection. First, based on the strong rules of manually defining obfuscated scripts, and using machine learning algorithms to train and identify obfuscated script models, a collection tool is deployed on the network probe, and the collection tool includes the preset obfuscated script detection rules and / or the obfuscated script identification model obtained in advance based on machine learning. The collection tool can determine the scripts in the network data collected by the network probe as obfuscated real scripts, suspected obfuscated real scripts, and confirmed unobfuscated real scripts. Then, for the suspected obfuscated real scripts, manual judgment can be performed. If it is determined to be obfuscated, it can be determined as a confirmed obfuscated real script. If it is not obfuscated, it can be determined as a confirmed unobfuscated real script. Then, a target obfuscated script is determined from the confirmed obfuscated real script for hybridization, and a target unobfuscated script is determined from the confirmed unobfuscated real script. The obfuscated tool is used to process the target unobfuscated script to determine the obfuscated counterfeit script, and then the confirmed obfuscated real script and the confirmed obfuscated counterfeit script are proportioned to form an obfuscated script.

[0098] See also Figure 5As shown, the embodiment of the present application discloses an obfuscated script collection device, which is applied to a network device, including:

[0099] A data collection module 11 is used to collect network data transmitted by the network device through a network probe in the network device;

[0100] The obfuscated script determination module 12 is used to determine whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning;

[0101] A first storage module 13, configured to store the obfuscated script in the network data into a preset obfuscated script storage space if the network data includes an obfuscated script;

[0102] The second storage module 14 is configured to store the script in the network data into a preset unobfuscated script storage space if the script included in the network data is an unobfuscated script.

[0103] It can be seen that the present application is applied to a network device, and the network data transmitted by the network device is first collected by a network probe in the network device. Then, a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space. If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space. It can be seen that the present application directly deploys a network probe on a network device to collect network data transmitted by the network device, obtain a large amount of network data actually transmitted in the network, and then use the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning to determine whether the network data collected by the network probe includes an obfuscated script. If the network data includes an obfuscated script, the obfuscated script is directly stored in the preset obfuscated script storage space. If the script included in the network data is an unmixed script, the script in the network data is stored in the preset unobfuscated script storage space. In this way, the obfuscated script storage space stores the collected obfuscated scripts. These obfuscated scripts are directly detected from the network data and can reflect the actual situation of the obfuscated scripts in the network. After obtaining the network data, the preset obfuscation script detection rules and / or the obfuscation script recognition model obtained in advance based on machine learning are used to automatically determine whether the network data collected by the network probe includes an obfuscated script. Compared with the completely manual screening in the prior art, the efficiency is improved and the error rate is reduced, and there is no need for a third party to purchase the obfuscated script.

[0104] In some specific implementation processes, the obfuscated script determination module 12 is used to:

[0105] Determining whether the network data includes a script;

[0106] If the network data includes a script, a first rule in a preset obfuscated script detection rule and / or a first model in an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script.

[0107] In some specific implementation processes, the obfuscated script determination module 12 is used to:

[0108] If the script is not an obfuscated script, determining whether the network data includes a suspected obfuscated script by using a second rule in a preset obfuscated script detection rule and / or a second model in an obfuscated script recognition model obtained in advance based on machine learning, wherein the first rule is stricter than the second rule, and an obfuscated script detection threshold of the first model is greater than an obfuscated script detection threshold of the second model;

[0109] If the script is a suspected obfuscated script, whether the script is an obfuscated script is determined based on the acquired determination information, and the script is stored in a corresponding storage space, wherein the determination information is manually triggered determination information.

[0110] In some specific implementation processes, the obfuscated script collection device further includes:

[0111] The first obfuscation counterfeiting module is used to determine a first preset number of target unobfuscated scripts from the unobfuscated script storage space; use an obfuscation tool to obfuscate the target unobfuscated scripts to obtain a first counterfeit obfuscated script, and store the first counterfeit obfuscated script in the counterfeit obfuscated script storage space.

[0112] In some specific implementation processes, the obfuscated script collection device further includes:

[0113] The second obfuscation counterfeiting module is used to determine a second preset number of target obfuscation scripts from the obfuscation script storage space; perform code hybridization on the target obfuscation scripts to obtain second counterfeit obfuscation scripts, and store the second counterfeit obfuscation scripts in the counterfeit obfuscation script storage space.

[0114] In some specific implementations, the second obfuscation and counterfeiting module is used to:

[0115] dividing the target obfuscation script into a first target obfuscation script and a second target obfuscation script based on the second preset number and the hybridization ratio;

[0116] splicing each third preset number of obfuscated scripts in the first target obfuscated script head to tail to obtain a first part of counterfeit obfuscated scripts in the second counterfeit obfuscated script;

[0117] The function definitions in every fourth preset number of obfuscated scripts in the second target obfuscated script are cross-joined to obtain a second part of counterfeit obfuscated scripts in the second counterfeit obfuscated script.

[0118] In some specific implementation processes, the obfuscated script collection device further includes:

[0119] A sample determination module is used to extract a corresponding number of scripts from the obfuscated script storage space and the counterfeit obfuscated script storage space to form an obfuscated script sample set based on a preset sample number and a preset ratio parameter, wherein the preset ratio parameter is a ratio of a preset number of counterfeit obfuscated scripts to a preset number of obfuscated scripts, and the obfuscated script sample set is used to iterate the obfuscated script recognition model.

[0120] For further information, see Figure 6 As shown, an embodiment of the present application further discloses a network device, including: a processor 21 and a memory 22.

[0121] The memory 22 is used to store computer programs; the processor 21 is used to execute the computer programs to implement the obfuscated script collection method disclosed in the above-mentioned embodiment.

[0122] Among them, the specific process of the above-mentioned obfuscated script collection method can refer to the corresponding content disclosed in the aforementioned embodiment, and will not be repeated here.

[0123] Furthermore, an embodiment of the present application also discloses a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the obfuscated script collection method disclosed in any of the aforementioned embodiments.

[0124] Among them, the specific process of the above-mentioned obfuscated script collection method can refer to the corresponding content disclosed in the aforementioned embodiment, and will not be repeated here.

[0125] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0126] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0127] Finally, it should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a series of processes, methods, articles or equipment containing other elements include not only those elements, but also other elements not explicitly listed, or also include elements inherent to such processes, methods, articles or equipment. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or equipment that includes the elements.

[0128] The above is a detailed introduction to the obfuscated script collection method, device, equipment, and medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for collecting obfuscated scripts, characterized in that: Applied to network equipment, including: Collecting network data transmitted by the network device through a network probe in the network device; Determine whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning; If the network data includes an obfuscated script, the obfuscated script in the network data is stored in a preset obfuscated script storage space, and a second preset number of target obfuscated scripts are determined from the obfuscated script storage space; the target obfuscated script is divided into a first target obfuscated script and a second target obfuscated script, and the first target obfuscated script and the second target obfuscated script are spliced ​​respectively using different script splicing methods to obtain a second counterfeit obfuscated script, and the second counterfeit obfuscated script is stored in the counterfeit obfuscated script storage space; If the script included in the network data is an unobfuscated script, the script in the network data is stored in a preset unobfuscated script storage space, part of the script in the unobfuscated script storage space is processed to obtain a first counterfeit obfuscated script, and the first counterfeit obfuscated script is stored in the counterfeit obfuscated script storage space.

2. The obfuscated script collection method according to claim 1, characterized in that: The determining whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning includes: Determining whether the network data includes a script; If the network data includes a script, a first rule in a preset obfuscated script detection rule and / or a first model in an obfuscated script recognition model obtained in advance based on machine learning is used to determine whether the network data includes an obfuscated script.

3. The obfuscated script collection method according to claim 2, characterized in that: After determining whether the network data includes an obfuscated script by using the first rule in the preset obfuscated script detection rule and / or the first model in the obfuscated script recognition model obtained in advance based on machine learning, the method further includes: If the script is not an obfuscated script, determining whether the network data includes a suspected obfuscated script by using a second rule in a preset obfuscated script detection rule and / or a second model in an obfuscated script recognition model obtained in advance based on machine learning, wherein the first rule is stricter than the second rule, and an obfuscated script detection threshold of the first model is greater than an obfuscated script detection threshold of the second model; If the script is a suspected obfuscated script, whether the script is an obfuscated script is determined based on the acquired determination information, and the script is stored in a corresponding storage space, wherein the determination information is manually triggered determination information.

4. The obfuscated script collection method according to claim 1, characterized in that: The step of processing part of the scripts in the unobfuscated script storage space to obtain a first counterfeit obfuscated script, and storing the first counterfeit obfuscated script in the counterfeit obfuscated script storage space includes: Determining a first preset number of target unobfuscated scripts from the unobfuscated script storage space; The target unobfuscated script is obfuscated using an obfuscation tool to obtain a first counterfeit obfuscated script, and the first counterfeit obfuscated script is stored in a counterfeit obfuscated script storage space.

5. The obfuscated script collection method according to claim 1, characterized in that: The method of dividing the target obfuscation script into a first target obfuscation script and a second target obfuscation script, and splicing the first target obfuscation script and the second target obfuscation script respectively using different script splicing methods to obtain a second counterfeit obfuscation script includes: dividing the target obfuscation script into a first target obfuscation script and a second target obfuscation script based on the second preset number and the hybridization ratio; splicing each third preset number of obfuscated scripts in the first target obfuscated script head to tail to obtain a first part of counterfeit obfuscated scripts in the second counterfeit obfuscated script; The function definitions in every fourth preset number of obfuscated scripts in the second target obfuscated script are cross-joined to obtain a second part of counterfeit obfuscated scripts in the second counterfeit obfuscated script.

6. The obfuscated script collection method according to claim 1, characterized in that: After storing the second counterfeit obfuscation script in the counterfeit obfuscation script storage space, the method further includes: A corresponding number of scripts are extracted from the obfuscated script storage space and the counterfeit obfuscated script storage space based on a preset number of samples and a preset ratio parameter to form an obfuscated script sample set, wherein the preset ratio parameter is the ratio of the preset number of counterfeit obfuscated scripts to the number of obfuscated scripts, and the obfuscated script sample set is used to iterate the obfuscated script recognition model.

7. A device for collecting obfuscated scripts, characterized in that: Applied to network equipment, including: A data collection module, used for collecting network data transmitted by the network device through a network probe in the network device; An obfuscated script determination module, used to determine whether the network data includes an obfuscated script by using a preset obfuscated script detection rule and / or an obfuscated script recognition model obtained in advance based on machine learning; A first storage module is used for storing the obfuscated script in the network data into a preset obfuscated script storage space if the network data includes an obfuscated script, determining a second preset number of target obfuscated scripts from the obfuscated script storage space; dividing the target obfuscated script into a first target obfuscated script and a second target obfuscated script, and splicing the first target obfuscated script and the second target obfuscated script respectively using different script splicing methods to obtain a second counterfeit obfuscated script, and storing the second counterfeit obfuscated script in the counterfeit obfuscated script storage space; The second storage module is used to store the script in the network data into a preset unobfuscated script storage space if the script included in the network data is an unobfuscated script, process part of the script in the unobfuscated script storage space to obtain a first counterfeit obfuscated script, and store the first counterfeit obfuscated script into the counterfeit obfuscated script storage space.

8. A network device, characterized in that: include: Memory and processor; Wherein, the memory is used to store computer programs; The processor is used to execute the computer program to implement the obfuscated script collection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the obfuscated script collection method according to any one of claims 1 to 6 is implemented.

Images