A method and device for detecting malicious script code

Abstract

The present application discloses a malicious script code detection method and device, which is applicable to the computer field and can detect malicious code in a malicious script file that has been obfuscated. The method includes: obtaining a script file to be detected, the script file contains a first code segment; according to at least one code conversion rule, converting the code in the first code segment, and obtaining a first detection sample based on the conversion result; matching the first detection sample with multiple malicious features in a malicious script feature library, determining the first malicious feature in the match, the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to at least one code conversion rule; according to the first malicious feature in the match, determining that there is malicious code in the script file to be detected.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically, to a method and device for detecting malicious script codes. Background Art

[0002] At present, with the development of computer technology, script files are widely used in various scenarios, and malicious script files are also increasing rapidly. How to accurately identify malicious script files in various scenarios has become the main research direction of the entire industry.

[0003] For example, the industry mainly uses static detection methods to identify malicious script files in web pages. The static detection method is: after the computer device obtains the script file to be identified, the computer device will determine whether the script code in the script file matches the malicious features in the malicious script library. If the script code in the script file matches the malicious features in the malicious script library, it means that the script file is a malicious script file.

[0004] In order to prevent malicious script files from being identified by the above-mentioned static detection methods, hackers usually obfuscate the code in the malicious script files so that the obfuscated malicious script files do not contain script codes that match the malicious features in the malicious script library, thereby achieving the purpose of evading detection and better hiding the malicious scripts.

[0005] Therefore, how to identify obfuscated malicious code has become a problem that needs to be solved urgently. Summary of the invention

[0006] The present application provides a malicious script code detection method and device to effectively detect malicious code in a malicious script file that has been obfuscated.

[0007] In a first aspect, the present application provides a malicious script code detection method, the method comprising: obtaining a script file to be detected, the script file comprising a first code segment; converting the code in the first code segment according to at least one code conversion rule, and obtaining a first detection sample based on the conversion result, the at least one code conversion rule comprising a first conversion rule, the first conversion rule comprising converting a first variable name into a first value, and converting a second variable name into the first value, the first variable name being different from the second variable name; matching the first detection sample with a plurality of malicious features in a malicious script feature library, determining a first malicious feature in the match, the first malicious feature existing in both the malicious script feature library and the first detection sample, the first malicious feature being obtained by converting a first known malicious code according to at least one code conversion rule; determining, based on the first malicious feature in the match, that malicious code exists in the script file to be detected.

[0008] In the first aspect, at least one code conversion rule provided by the embodiment of the present application can convert the first code segment in the script file into a first detection sample, and the first detection sample reflects the substantial information of the corresponding program function of the first code segment. The first detection sample is further matched with multiple malicious features in the malicious script feature library, and the malicious features reflect the substantial information of the corresponding program function of the malicious code. The substantial information in the embodiment of the present application includes program structure and key data, and the program structure includes variable operations and the order of the functions called, as well as the relationship between variables, operations and functions, etc. The key data includes the assignment of variables, etc. No matter how the code is obfuscated and deformed, if the obfuscated code wants to realize the program function of the code before obfuscation, the obfuscated code needs to have the same substantial information as the code before obfuscation. If the first detection sample matches the first malicious feature in the malicious script feature library, it means that the program structure of the first code segment is the same as the substantial information of the first known malicious code. In the case where the program structure of the first code segment is identical to the substantial information of the first known malicious code, if the program function of the first known malicious code can infect the computer device with a virus or a Trojan horse, it means that the program function of the first code segment can also infect the computer device with a virus or a Trojan horse, thereby determining that the first code segment in the script file is malicious code. The embodiment of the present application can remove information that has no substantial effect on the implementation of the program function from the code of the script file through the conversion rule, while retaining information that has a substantial effect on the implementation of the program function, thereby being able to detect malicious code in a malicious script file that has been obfuscated.

[0009] In a possible implementation of the first aspect, at least one code conversion rule further includes a second conversion rule. The second conversion rule includes converting a first operator into a second value and converting the second operator into a third value, the first operator and the second operator are both used to perform operations on constants or variables, and the first operator is different from the second operator.

[0010] In the second conversion rule, each operator in the first code segment is converted into a corresponding numerical value so that the computer device can know which codes in the first code segment belong to the operator. Since each operator plays a different role and function in the first code segment, the numerical value corresponding to each operator is different. Considering that the operator is important information for implementing the program function corresponding to the code, the embodiment of the present application retains information that has a substantial impact on implementing the program function through the second conversion rule.

[0011] In a possible implementation of the first aspect, at least one code conversion rule further includes a third conversion rule. The third conversion rule includes that the content of the first function name remains unchanged after conversion, and the first function name belongs to a function name in a predetermined set of sensitive function names. Or the second function name is converted to the first value, and the second function name does not belong to a function name in the predetermined set of sensitive function names.

[0012] Since the predetermined sensitive function name itself has a relatively obvious function of identifying malicious features, the sensitive function name is retained in the third conversion rule, thereby better determining whether the first code segment is a malicious code.

[0013] In a possible implementation of the first aspect, at least one code conversion rule further includes a fourth conversion rule. The fourth conversion rule includes: when the value assigned to the first variable name and the value assigned to the second variable name are both strings, converting the value assigned to the first variable name to a fourth value and converting the value assigned to the second variable name to the fourth value; or when the value assigned to the first variable name and the value assigned to the second variable name are both numerical values, converting the value assigned to the first variable name to a fifth value and converting the value assigned to the second variable name to the fifth value.

[0014] In the fourth conversion rule, if the variable name in the first code segment is assigned a string, the variable name is converted to a fourth value so that the computer device can know which codes in the first code segment belong to the string. If the variable name in the first code segment is assigned a numerical value, the variable name is converted to a fifth value so that the computer device can know which codes in the first code segment belong to numerical values.

[0015] In a possible implementation manner of the first aspect, the at least one code conversion rule further includes a fifth conversion rule. The fifth conversion rule includes: when the value assigned to the first variable name is an invisible string, adding the value assigned to the first variable name to the first detection sample.

[0016] In the fifth conversion rule, if the value assigned to the variable name in the first code segment is an invisible string, it means that the value assigned to the variable name cannot be converted according to the predetermined encoding format. The invisible string itself is useful information for identifying malicious features. The embodiment of the present application adds the value assigned to the first variable name to the first detection sample so that the value assigned to the variable name is retained in the first detection sample obtained after the conversion, thereby better determining whether the first code segment is malicious code.

[0017] In a possible implementation of the first aspect, the at least one code conversion rule further includes a sixth conversion rule. The sixth conversion rule includes: when the value assigned to the second variable name is a visible string, converting the value assigned to the second variable name into a first string according to a predetermined coding format, and adding the first string to the first detection sample.

[0018] Since the change of encoding format is also a way of obfuscation or deformation, the embodiment of the present application can normalize and convert the same content in multiple different encoding formats into a predetermined encoding format through the sixth conversion rule, which can greatly reduce the differences between different codes, thereby removing information that has no substantial effect on the implementation of program functions from the code of the script file. Through the sixth conversion rule, the function of deobfuscation can be achieved, so that malicious code in a malicious script file that has been obfuscated can be detected.

[0019] In a possible implementation of the first aspect, before obtaining the script file to be detected, the method further includes: obtaining a malicious script file set, the malicious script file set including one or more malicious script files. Selecting a malicious script file from the malicious script file set, and processing the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: converting the code in the code segment of the selected malicious script file according to at least one code conversion rule, and obtaining a malicious feature sample based on the conversion result. Adding the obtained malicious feature sample as a malicious feature to a malicious script feature library.

[0020] Among them, the present application converts all the codes of each malicious script file in the malicious script file set into multiple malicious feature samples, and adds the multiple malicious feature samples to the malicious script feature library, so that the malicious script feature library has mastered a large number of malicious code program structures. When it is necessary to determine whether there is malicious code in the script file to be detected, the first code segment of the script file to be detected can be converted into a first detection sample according to at least one code conversion rule, and the first detection sample is matched with multiple malicious features in the malicious script feature library. If the first detection sample is the first malicious feature in the malicious script feature library, it means that the program structure of the first code segment of the script file to be detected is the same as the program structure of the first known malicious code corresponding to the first malicious feature, so it can be determined that there is malicious code in the script file to be detected. Therefore, the embodiment of the present application can utilize the establishment of a malicious script feature library so that the malicious script code detection method provided by the embodiment of the present application can utilize the malicious script feature library to identify whether the obfuscated code is malicious code.

[0021] In a possible implementation manner of the first aspect, the first value, the second value, the third value, the fourth value, and the fifth value are all octal, decimal, or hexadecimal values.

[0022] In a second aspect, the present application provides a malicious script code detection method, the method comprising: obtaining a malicious script file set, the malicious script file set including one or more malicious script files. Selecting a malicious script file from the malicious script file set, processing the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: converting the code in the code segment of the selected malicious script file according to at least one code conversion rule, obtaining a malicious feature sample based on the conversion result, at least one code conversion rule including a first conversion rule, the first conversion rule including converting a first variable name to a first value, and converting a second variable name to a first value, the first variable name being different from the second variable name. Adding the obtained malicious feature sample as a malicious feature to a malicious script feature library.

[0023] In a third aspect, the present application provides a computer device, including a memory and a processor connected to the memory, wherein the memory is used to store instructions. The processor is used to execute instructions so that the computer device performs the following operations: obtaining a script file to be detected, wherein the script file contains a first code segment; converting the code in the first code segment according to at least one code conversion rule, and obtaining a first detection sample based on the conversion result, wherein at least one code conversion rule includes a first conversion rule, wherein the first conversion rule includes converting a first variable name to a first value and converting a second variable name to a first value, wherein the first variable name is different from the second variable name; matching the first detection sample with multiple malicious features in a malicious script feature library, determining a first malicious feature in the match, wherein the first malicious feature exists in both the malicious script feature library and the first detection sample, and wherein the first malicious feature is obtained by converting a first known malicious code according to at least one code conversion rule; and determining, according to the first malicious feature in the match, that malicious code exists in the script file to be detected.

[0024] In a possible implementation of the third aspect, at least one code conversion rule further includes a second conversion rule. The second conversion rule includes converting a first operator into a second value, and converting the second operator into a third value, the first operator and the second operator are both used to perform operations on constants or variables, and the first operator is different from the second operator.

[0025] In a possible implementation of the third aspect, at least one code conversion rule further includes a third conversion rule. The third conversion rule includes: the content of the first function name remains unchanged after conversion, and the first function name belongs to a function name in a predetermined set of sensitive function names. The second function name is converted to a first value, and the second function name does not belong to a function name in the predetermined set of sensitive function names.

[0026] In a possible implementation of the third aspect, at least one code conversion rule further includes a fourth conversion rule. The fourth conversion rule includes: when the value assigned to the first variable name and the value assigned to the second variable name are both strings, converting the value assigned to the first variable name to a fourth value and converting the value assigned to the second variable name to the fourth value; or when the value assigned to the first variable name and the value assigned to the second variable name are both numerical values, converting the value assigned to the first variable name to a fifth value and converting the value assigned to the second variable name to the fifth value.

[0027] In a possible implementation manner of the third aspect, the at least one code conversion rule further includes a fifth conversion rule. The fifth conversion rule includes: when the value assigned to the first variable name is an invisible string, adding the value assigned to the first variable name to the first detection sample.

[0028] In a possible implementation of the third aspect, the at least one code conversion rule further includes a sixth conversion rule. The sixth conversion rule includes: when the value assigned to the second variable name is a visible string, converting the value assigned to the second variable name into a first string according to a predetermined coding format, and adding the first string to the first detection sample.

[0029] In a possible implementation of the third aspect, the processor is further used to obtain a malicious script file set, the malicious script file set including one or more malicious script files; select a malicious script file from the malicious script file set, and process the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to at least one code conversion rule, convert the code in the code segment of the selected malicious script file, and obtain a malicious feature sample based on the conversion result; and add the obtained malicious feature sample as a malicious feature to a malicious script feature library.

[0030] In a possible implementation manner of the third aspect, the first value, the second value, the third value, the fourth value, and the fifth value are all octal, decimal, or hexadecimal values.

[0031] In a fourth aspect, the present application provides a computer device, including a memory and a processor connected to the memory, wherein the memory is used to store instructions. The processor is used to execute instructions so that the computer device performs the following operations: obtain a malicious script file set, wherein the malicious script file set includes one or more malicious script files. Select a malicious script file from the malicious script file set, and process the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to at least one code conversion rule, convert the code in the code segment of the selected malicious script file, and obtain a malicious feature sample based on the conversion result, wherein at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into a first value. Add the obtained malicious feature sample as a malicious feature to the malicious script feature library.

[0032] In a fifth aspect, the present application provides a computer device, comprising: an acquisition module, used to acquire a script file to be detected, the script file containing a first code segment; a processing module, used to convert the code in the first code segment according to at least one code conversion rule, and obtain a first detection sample based on the conversion result, at least one code conversion rule including a first conversion rule, the first conversion rule including converting a first variable name into a first value, and converting a second variable name into the first value, the first variable name being different from the second variable name; matching the first detection sample with multiple malicious features in a malicious script feature library, determining a first malicious feature in the match, the first malicious feature existing in both the malicious script feature library and the first detection sample, the first malicious feature being obtained by converting a first known malicious code according to at least one code conversion rule; determining, based on the first malicious feature in the match, that malicious code exists in the script file to be detected.

[0033] In a sixth aspect, the present application provides a computer device, comprising: an acquisition module, used to acquire a malicious script file set, the malicious script file set including one or more malicious script files; a processing module, used to select a malicious script file from the malicious script file set, and process the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to at least one code conversion rule, the code in the code segment of the selected malicious script file is converted, and a malicious feature sample is obtained based on the conversion result, at least one code conversion rule includes a first conversion rule, the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into a first value, the first variable name is different from the second variable name; the obtained malicious feature sample is added to a malicious script feature library as a malicious feature.

[0034] In a seventh aspect, the present application provides a computer storage medium for storing computer software instructions for the above-mentioned computer device, which includes a program designed for executing the above-mentioned first aspect, the above-mentioned second aspect and any possible implementation method of the above-mentioned first aspect.

[0035] In an eighth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the methods in the above aspects.

[0036] In a ninth aspect, the present application provides a chip comprising a memory and a processor, the memory being used to store computer instructions, and the processor being used to call and run the computer instructions from the memory to execute the method in the first aspect, the second aspect, and any possible implementation of the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A schematic diagram of a possible application scenario of the malicious script code detection method provided in an embodiment of the present application;

[0038] Figure 2 A flowchart of a malicious script code detection method provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of another malicious script code detection method provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0041] Figure 5 A schematic diagram of the structure of another computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0042] At present, hackers usually design malicious script files for illegal purposes and place them in carriers such as web pages. Among them, malicious script files have the ability to self-replicate, spread and destroy, which is extremely harmful to computer equipment. Traditional static detection methods can identify malicious script files in carriers such as web pages. In order to prevent malicious script files from being identified by traditional static detection methods, hackers will confuse or deform the code in malicious script files in advance. Among them, hackers usually confuse the variable names, operators, strings, functions, arrays, objects and other codes in malicious script files.

[0043] The following is a simple example to illustrate how hackers obfuscate variables in malicious script files. The actual obfuscation process is relatively complicated, and there are many codes that need to be obfuscated. In order to save space and explain the principle, the following will use a relatively short code for exemplary explanation.

[0044] For example, assume that the malicious script file A designed by the hacker includes code segment X, and code segment X includes the following three lines of code:

[0045] a=1;

[0046] b = 2;

[0047] c = a + b;

[0048] Since code segment X has been stored as a malicious feature in the malicious script library S corresponding to the static detection method, in order to prevent code segment X of malicious script file A from being identified by the static detection method, the hacker will obfuscate code segment X of malicious script file A. Assume that the hacker obfuscates code segment X to obtain code segment Y, which includes the following three lines of code:

[0049] x=1;

[0050] y=2;

[0051] z=x+y;

[0052] By comparing code segment X and code segment Y, we can know that the hacker converted the variables "a, b, c" in code segment X into the variables "x, y, z" in code segment Y, but the code structure and data of code segment X and code segment Y are the same. Therefore, the function that code segment Y can achieve has not changed compared with code segment X. The hacker will design a malicious script file B with code segment Y, and design the malicious script file B into a carrier such as a web page.

[0053] Since the code segment Y is not stored as a malicious feature in the malicious script library S corresponding to the static detection method, the static detection method cannot use the malicious script library S to identify the malicious script file B in the web page.

[0054] To this end, an embodiment of the present application provides a malicious script code detection method, which can effectively detect malicious code in a malicious script file that has been obfuscated.

[0055] Figure 1 A schematic diagram of a possible application scenario of the malicious script code detection method provided in the embodiment of the present application. Optionally, Figure 1 Any one of the terminal device 101 located in the protected network, the message forwarding device, and the cloud detection device 102 located in the Internet can execute the method provided in the embodiment of the present application.

[0056] Optionally, the terminal device 101 includes but is not limited to a desktop computer, a mobile terminal, a PDA, a wearable device, a tablet computer, a laptop computer, an e-reader, and the like.

[0057] Optionally, the message forwarding device includes but is not limited to a firewall 103, a router, a security gateway 104, and the like.

[0058] When the terminal device 101 executes the malicious script code detection method provided in the embodiment of the present application, the terminal device 101 obtains the script file to be detected from the memory. Optionally, the script file to be detected is embedded in a web page file and downloaded and cached in the memory by the terminal device 101 when the user of the terminal device 101 accesses the Internet through a browser; or is carried in an attachment of an email and downloaded and cached in the memory by the terminal device 101 when the user of the terminal device 101 receives an email through an email client; or is embedded in a PDF document and released and cached in the memory when the terminal device 101 opens a portable document format (PDF, Portable Document Format) document.

[0059] When the message forwarding device executes the malicious script code detection method provided in the embodiment of the present application, the message forwarding device obtains the script file to be detected downloaded from the Internet or uploaded to the Internet by the terminal device 101 from the network traffic transmitted between the terminal device 101 and the Internet. Optionally, after the message forwarding device obtains the above-mentioned script file to be detected through a proxy mechanism, an intrusion detection system (IDS), a deep packet inspection (DPI), and other technologies, after executing the malicious script code detection method on the script file to be detected, the network traffic carrying the script file to be detected is blocked or released according to the detection result. Further, in order to avoid reducing the performance of the message forwarding device or avoiding the transmission delay caused by the detection, the message forwarding device sends the script file to be detected to the analysis device 105 connected to the message forwarding device bypass after obtaining the script file to be detected. After the analysis device 105 executes the malicious script code detection method on the script file to be detected in an offline manner, the detection result is notified to the message forwarding device, so that the message forwarding device intercepts the subsequent network traffic carrying the script file.

[0060] When the cloud detection device 102 executes the malicious script code detection method provided in the embodiment of the present application, the cloud detection device 102 receives the script file to be detected sent by other network devices, and after executing the malicious script code detection method on the script file to be detected, returns the detection result to the network device that sent the script file to be detected. In this way, the cloud detection device 102 provides a service for detecting malicious script codes to other network devices. Optionally, the cloud detection device 102 receives the script file to be detected submitted by the terminal device 101 or other network devices such as the message forwarding device through the WebUI, and returns the detection result to the device that submitted the script file to be detected through a web page, email, text message, etc.

[0061] See also Figure 2 As shown, Figure 2 The flowchart of a malicious script code detection method provided in the embodiment of the present application. The malicious script code detection method provided in the embodiment of the present application can be applied to a computer device. Optionally, the computer device is Figure 2 The terminal device 101, the message forwarding device and the cloud detection device 102 located in the Internet. The malicious script code detection method provided in the embodiment of the present application includes the following steps S101 to S104.

[0062] S101, obtaining a script file to be detected.

[0063] A script file refers to a file containing computer executable code written in a scripting language. Scripting languages ​​include but are not limited to JavaScript, VBScript, shell, Python, etc. Although these scripting languages ​​are different, the syntax and definition of the code in these scripting languages ​​basically follow the general structure of the programming language, and the code is executed sequentially. Therefore, although the embodiments of the present application are subsequently illustrated by taking JavaScript as an example, the malicious script code detection method provided in the embodiments of the present application is applicable to script files written in various scripting languages.

[0064] The script file includes a first code segment, which is all or part of the code segments in the script file. Usually, a script file includes code and comments, where the code is used to implement the functions corresponding to the script file, and the comments are used to explain and illustrate the code so that people can more easily understand the meaning of the code, thereby increasing the readability of the code and facilitating secondary development and modification. The first code segment refers to the code in the script file, and the first code segment does not include the comments in the script file.

[0065] Optionally, the script file to be detected is a script file in a web page, such as JavaScript, VBScript.

[0066] Taking a computer device as a terminal device as an example, assuming that when the computer device receives an instruction to open web page H1, from a security perspective, the computer device will first execute Figure 2 S101 to S104 are shown to detect whether there is malicious code in the script file of the web page H1. If there is no malicious code in the script file H1 of the web page, the computer device will execute the script file of the web page H1 to display the content of the web page. If there is malicious code in the script file of the web page H1, the computer device will prohibit the execution of the script file of the web page H1 and remind the user that there may be a Trojan or virus in the web page H1.

[0067] S102: Convert the code in the first code segment according to at least one code conversion rule, and obtain a first detection sample based on the conversion result.

[0068] The at least one code conversion rule includes a first conversion rule, the first conversion rule includes converting a first variable name into a first value and converting a second variable name into the first value, the first variable name is different from the second variable name, and the first value is a preset value.

[0069] For example, assuming that the first value is set to the value "15" in advance, and the first code segment includes a variable name "a" and a variable name "b", then the first conversion rule can be used to convert both the variable name "a" and the variable name "b" into "15".

[0070] Of course, when the number of variable names in the first code segment is greater than two, the first conversion rule further includes converting each variable name into a first value.

[0071] For example, assuming that the first value is set to the value "15" in advance, and the first code segment includes variable name "a", variable name "b", variable name "c" and variable name "d", then the first conversion rule can be used to convert variable name "a", variable name "b", variable name "c" and variable name "d" into "15".

[0072] In the first conversion rule, each variable name in the first code segment is converted into a first value, so that the computer device can know which codes in the first code segment belong to the variable name.

[0073] Since the variable name itself does not affect the program function of the code, the embodiment of the present application uses the first conversion rule, and the computer device converts a large number of different variable names into the first value, which can greatly reduce the differences between different codes, thereby removing information that has no substantial effect on the implementation of the program function from the code of the script file. Through the first conversion rule, the function of deobfuscation can be achieved, so that malicious code in a malicious script file that has been obfuscated can be detected.

[0074] Optionally, when there is an operator (also referred to as an operator) in the first code segment, then at least one code conversion rule further includes a second conversion rule. The second conversion rule includes converting the first operator to a second value, and converting the second operator to a third value, the first operator and the second operator are both used to perform operations on constants or variables, and the first operator is different from the second operator. Usually the second value is different from the third value.

[0075] The operators include, but are not limited to, symbols such as “+”, “-”, “×”, “÷”, “=”, “(”, “)”, “[”, “]”, “,”, “%”, “;” and “.”. Each operator is preset with a value. For example, the value after the operator “=” is converted is preset to “59”, the value after the operator “;” is preset to “54”, the value after the operator “(” is preset to “39”, the value after the operator “)” is preset to “40”, the value after the operator “[” is preset to “69”, the value after the operator “]” is preset to “70”, and the value after the operator “,” is preset to “46”.

[0076] In the second conversion rule, each operator in the first code segment is converted into a corresponding numerical value so that the computer device can know which codes in the first code segment belong to the operator. Since each operator plays a different role and function in the first code segment, the numerical value corresponding to each operator is different. Considering that the operator is important information for implementing the program function corresponding to the code, the embodiment of the present application retains information that has a substantial impact on implementing the program function through the second conversion rule.

[0077] Optionally, when a function name exists in the first code segment, the at least one code conversion rule further includes a third conversion rule. The third conversion rule includes that the content of the first function name remains unchanged after conversion, and the first function name belongs to a function name in a predetermined sensitive function name set. The second function name is converted to a first value, and the second function name does not belong to a function name in the predetermined sensitive function name set.

[0078] Among them, the predetermined sensitive function name set includes multiple sensitive function names, and the predetermined sensitive function name set includes but is not limited to the following sensitive function names: "appendChild", "eval", "innerHTML", "write", "charAt", "fromCharCode", "indexOf", "parseInt", "replace", "split", "substr" and "unescape".

[0079] For example, assuming that there is a function name "eval" in the first code segment, since the function name "eval" belongs to the function name in the predetermined sensitive function name set, the conversion result of the function name "eval" is "eval", and the content of the sensitive function name after conversion will not change, that is, the sensitive function name will not be converted, or in other words, the content of the sensitive function name after conversion is the same as the content before conversion.

[0080] For another example, assuming that there is a function name "alert" in the first code segment, and the first value is pre-set to "15", since the function name "alert" does not belong to the function names in the predetermined sensitive function name set, the conversion result of the function name "alert" is "15".

[0081] Since the predetermined sensitive function name itself has a relatively obvious function of identifying malicious features, the sensitive function name is retained in the third conversion rule, thereby better determining whether the first code segment is a malicious code.

[0082] Optionally, when there is a corresponding assignment for the variable name in the first code segment, at least one code conversion rule also includes a fourth conversion rule. The fourth conversion rule includes: when the assignment of the first variable name and the assignment of the second variable name are both strings, the assignment of the first variable name is converted to a fourth value, and the assignment of the second variable name is converted to a fourth value; or when the assignment of the first variable name and the assignment of the second variable name are both numerical values, the assignment of the first variable name is converted to a fifth value, and the assignment of the second variable name is converted to a fifth value. In an embodiment of the present application, the string contains at least one character. Optionally, the fourth value is "24" and the fifth value is "21".

[0083] In the fourth conversion rule, if the variable name in the first code segment is assigned a string, the variable name is converted to a fourth value so that the computer device can know which codes in the first code segment belong to the string. If the variable name in the first code segment is assigned a numerical value, the variable name is converted to a fifth value so that the computer device can know which codes in the first code segment belong to numerical values.

[0084] Optionally, when the value assigned to the variable name in the first code segment is an invisible string, the at least one code conversion rule further includes a fifth conversion rule. The fifth conversion rule includes: when the value assigned to the first variable name is an invisible string, adding the value assigned to the first variable name to the first detection sample. The invisible string is a string that cannot be converted according to a predetermined encoding format.

[0085] In the fifth conversion rule, if the value assigned to the variable name in the first code segment is an invisible string, it means that the value assigned to the variable name cannot be converted according to the predetermined encoding format. The invisible string itself is useful information for identifying malicious features. The embodiment of the present application adds the value assigned to the first variable name to the first detection sample so that the value assigned to the variable name is retained in the first detection sample obtained after the conversion, thereby better determining whether the first code segment is malicious code.

[0086] Optionally, when the value assigned to the variable name in the first code segment is a visible string, the at least one code conversion rule further includes a sixth conversion rule. The sixth conversion rule includes: when the value assigned to the second variable name is a visible string, converting the value assigned to the second variable name into a first string according to a predetermined coding format, and adding the first string to the first detection sample. The visible string is a string that can be converted according to a predetermined coding format.

[0087] Optionally, the predetermined encoding format is ASCII (American Standard Code for Information Interchange), GB2312 (Chinese Character Coded Character Set for Information Interchange), Unicode (single code) or UTF-8 (8-bit Unicode Transformation Format, variable-length character encoding for Unicode).

[0088] Since the change of encoding format is also a way of obfuscation or deformation, the embodiment of the present application can normalize and convert the same content in multiple different encoding formats into a predetermined encoding format through the sixth conversion rule, which can greatly reduce the differences between different codes, thereby removing information that has no substantial effect on the implementation of program functions from the code of the script file. Through the sixth conversion rule, the function of deobfuscation can be achieved, so that malicious code in a malicious script file that has been obfuscated can be detected.

[0089] When there is a keyword for declaring a variable name in the first code segment, the at least one code conversion rule further includes a seventh conversion rule. The seventh conversion rule includes: converting each keyword into a corresponding numerical value, and the numerical value corresponding to each keyword is different.

[0090] For example, "var" is a keyword for declaring a variable, and the value corresponding to "var" is set to "97" in advance. "let" is a keyword for declaring a variable, and the value corresponding to "let" is set to "98" in advance.

[0091] In the seventh conversion rule, each keyword in the first code segment is converted into a corresponding numerical value so that the computer device can know which codes in the first code segment belong to the keyword. Since the role and function of each keyword in the first code segment are different, the numerical value corresponding to each keyword is different. Considering that the keyword is important information for implementing the program function corresponding to the code, the embodiment of the present application retains information that has a substantial impact on implementing the program function through the seventh conversion rule.

[0092] The first value, the second value, the third value, the fourth value and the fifth value mentioned in the embodiments of the present application are all octal, decimal or hexadecimal values. Of course, the first value, the second value, the third value, the fourth value and the fifth value can also be values ​​of other bases.

[0093] In order to more clearly show how the embodiment of the present application converts the code in the first code segment according to at least one code conversion rule and obtains the first detection sample based on the conversion result, an example is used below to illustrate. The following example uses the first conversion rule, the second conversion rule, and the fourth conversion rule in the at least one code conversion rule.

[0094] For example, assume that the first code segment includes the following three lines of code:

[0095] x=1;

[0096] y=2;

[0097] z=x+y;

[0098] In the first code segment, the first line of code is "x=1;". "x" is the variable name, and the value corresponding to "x" is "15". "=" is an operator, and the value corresponding to "=" is "59". "1" is a value, and the value corresponding to "1" is "21". ";" is an operator, and the value corresponding to ";" is "54". Finally, the first line of code in the first code segment can be converted into "15 59 21 54" using at least one code conversion rule.

[0099] In the first code segment, the second line of code is "y=2;". "y" is the variable name, and the value corresponding to "y" is "15". "=" is an operator, and the value corresponding to "=" is "59". "2" is a value, and the value corresponding to "21". ";" is an operator, and the value corresponding to ";" is "54". Finally, the second line of code in the first code segment can be converted into "15 59 21 54" using at least one code conversion rule.

[0100] In the first code segment, the third line of code is "z=x+y;". Among them, "z" is the variable name, and the value corresponding to "z" is "15". "=" is the operator, and the value corresponding to "=" is "59". "x" is the variable name, and the value corresponding to "x" is "15". "+" is the operator, and the value corresponding to "+" is "60". "y" is the variable name, and the value corresponding to "y" is "15". ";" is the operator, and the value corresponding to ";" is "54". Finally, the first line of code in the first code segment can be converted into "15 59 15 60 15 54" using at least one code conversion rule.

[0101] Please refer to Table 1, which shows a first detection sample generated after converting three lines of code of a first code segment according to at least one code conversion rule.

[0102] Table 1

[0103]

[0104] S103. Match the first detection sample with multiple malicious features in the malicious script feature library to determine the first malicious feature in the match. In other words, "the first malicious feature in the match" means that the first malicious feature is a malicious feature in the malicious script feature library that matches the first detection sample. The meaning of "matching" or "matching" is also understood to mean that the first malicious feature exists in both the malicious script feature library and the first detection sample. The first malicious feature is obtained by converting the first known malicious code according to at least one code conversion rule.

[0105] The malicious script feature library will pre-store multiple malicious features, and the malicious features in the malicious script feature library are obtained by converting the malicious code according to at least one code conversion rule. The malicious features are used to represent the program structure of the malicious code. The malicious code refers to the dangerous code that infects the computer device with a virus or a Trojan horse. Figure 3 In the illustrated embodiment, the process of establishing a malicious script feature library is described in detail.

[0106] For example, please refer to Table 1 and Table 2. Table 2 shows a pre-established malicious script feature library, and the malicious script feature library shown in Table 2 includes multiple pre-stored malicious features.

[0107] Table 2

[0108]

[0109] In the examples shown in Table 1 and Table 2, since the first detection sample in Table 1 completely matches the malicious feature corresponding to number 1 in Table 2, the computer device determines that the malicious feature corresponding to number 1 in Table 2 is the first malicious feature.

[0110] S104: Determine, based on the first malicious feature in the match, whether malicious code exists in the script file to be detected.

[0111] exist Figure 2 In the illustrated embodiment, at least one code conversion rule provided in the embodiment of the present application can convert the first code segment in the script file into a first detection sample, and the first detection sample reflects the substantial information of the corresponding program function of the first code segment. The first detection sample is further matched with multiple malicious features in the malicious script feature library, and the malicious features reflect the substantial information of the corresponding program function of the malicious code.

[0112] The essential information in the embodiments of the present application includes program structure and key data. The program structure includes the sequence of variable operations and called functions, as well as the relationship between variables, operations and functions, etc. The key data includes the assignment of variables, etc. No matter how the code is obfuscated and deformed, if the obfuscated code wants to realize the program function of the code before obfuscation, the obfuscated code needs to have the same essential information as the code before obfuscation.

[0113] If the first detection sample matches the first malicious feature in the malicious script feature library, it means that the program structure of the first code segment is the same as the substantial information of the first known malicious code. In the case where the program structure of the first code segment is the same as the substantial information of the first known malicious code, if the program function of the first known malicious code can infect the computer device with a virus or a Trojan horse, it means that the program function of the first code segment can also infect the computer device with a virus or a Trojan horse, thereby determining that the first code segment in the script file is malicious code. The embodiment of the present application can remove information that has no substantial effect on the implementation of the program function from the code of the script file through conversion rules, while retaining information that has a substantial effect on the implementation of the program function, thereby being able to detect malicious code in obfuscated malicious script files.

[0114] pass Figure 2 It can be seen from the embodiment shown that hackers can confuse the code in the script file to obtain the first code segment. If the first code segment has not been saved in the database corresponding to the conventional static detection method, then the conventional static detection method cannot identify whether the first code segment is a malicious code. However, the malicious script feature library provided in the embodiment of the present application will save a large number of program structures of malicious codes. As long as the program structure of the first code segment is pre-stored in the malicious script feature library, even if the first code segment has not been saved in the malicious script feature library, the embodiment of the present application can also identify that the first code segment belongs to malicious code. Compared with the conventional static detection method, the malicious script code detection method provided in the embodiment of the present application can identify whether the obfuscated code is malicious code.

[0115] In order to more clearly show the use of multiple conversion rules in at least one code conversion rule, another example is used below to illustrate. The following example uses the first conversion rule, the second conversion rule, the third conversion rule, the fourth conversion rule, the fifth conversion rule, the sixth conversion rule and the seventh conversion rule in at least one code conversion rule.

[0116] Please refer to Table 3, which shows the correspondence between the conversion rule, the code and the numerical value generated in advance according to at least one code conversion rule.

[0117] Table 3

[0118]

[0119] Please refer to Table 4, which shows the pre-established correspondence between operators and numerical values ​​generated according to at least one code conversion rule.

[0120] Table 4

[0121] Operators Numeric Space 30 ＝ 59 [ 69 ] 70 , 46 ； 54 ( 39 ) 40 …… ……

[0122] Please refer to Table 5, which shows the correspondence between keywords and values ​​of declared variable names generated in advance according to at least one code conversion rule.

[0123] Table 5

[0124] Keywords for declaring variable names Numeric var 97 let 98 …… ……

[0125] For example, assume that the first code segment includes the following six lines of code:

[0126] var s=[],

[0127] j='0x90909090……',

[0128] e='abc',

[0129] r='\u006d\u0061\u006c\u0077\u0061\u0072\u0065...';

[0130] alert(r);

[0131] eval(j);

[0132] Please refer to Table 6, which shows a first detection sample generated after converting six lines of code of the first code segment according to at least one code conversion rule.

[0133] Table 6

[0134]

[0135] The first row of samples in Table 6 is “97 30 15 59 69 70 46”. The first row of samples in Table 6 is generated by the first row of code “var s=[],” of the first code segment according to at least one code conversion rule.

[0136] In the first line of code in the first code segment, "var" is the keyword for declaring the variable name. From Table 5, we can know that the value corresponding to "var" is "97". "Space" is an operator. From Table 4, we can know that the value corresponding to "space" is "30". "s" is the variable name. From Table 3, we can know that the value corresponding to "s" is "15". "=" is an operator. From Table 4, we can know that the value corresponding to "=" is "59". "[" is an operator. From Table 4, we can know that the value corresponding to "[" is "69". "]" is an operator. From Table 4, we can know that the value corresponding to "]" is "70". "," is an operator. From Table 4, we can know that the value corresponding to "," is "46".

[0137] Regarding the second line of code in the first code segment to the fifth line of code in the first code segment, the conversion process is similar to that of the first line of code in the first code segment, that is, the numerical value corresponding to the code is determined by the mapping relationship in Table 3 to Table 5, which will not be repeated here.

[0138] In the sixth line of the first code segment, "eval" belongs to a function name in the predetermined sensitive function name set, that is, "eval" belongs to the first function name in Table 3. According to the third conversion rule, the content of the first function name remains unchanged after conversion, so "eval" is directly converted to "eval", so the first sample of the sixth line of samples in Table 6 is "eval".

[0139] In the second line of the first code segment, "'0x90909090...'" is the value assigned to the variable name "j", and the value assigned to the variable name "j" is an invisible string. According to the fifth conversion rule, by adding the value assigned to the variable name "j" to the first detection sample, the seventh line sample "0x90909090..." of the first detection sample in Table 6 can be obtained.

[0140] In the fourth line of the first code segment, "'\u006d\u0061\u006c\u0077\u0061\u0072\u0065......'" is the value assigned to the variable name "r", and the value assigned to the variable name "r" is a visible string. According to the sixth conversion rule, the value assigned to the variable name "r" is converted into the first string "malware......" according to the predetermined encoding format, and the first string "malware......" is added to the first detection sample, so that the eighth line sample "malware......" of the first detection sample in Table 6 can be obtained.

[0141] Through the examples shown in Tables 3 to 6, the embodiments of the present application illustrate how to convert the code in the first code segment into the first detection sample through at least one code conversion rule. Of course, the at least one code conversion rule is not limited to the seven conversion rules provided.

[0142] See also Figure 3 As shown, Figure 3 A flowchart of another malicious script code detection method provided in an embodiment of the present application, Figure 3 The method shown is to establish Figure 2 The process of the malicious script feature library mentioned in S103. Figure 3 The method shown includes the following steps S201 to S204.

[0143] S201. Obtain a set of malicious script files.

[0144] The malicious script file set includes one or more malicious script files, each of which includes malicious code, and the malicious code refers to dangerous code that infects computer devices with viruses or Trojans.

[0145] For example, suppose that multiple malicious script files are collected in advance, and it is confirmed that each malicious script file has malicious code. Then, the multiple malicious script files are added to the malicious script file collection. Of course, some new malicious script files can be added to the malicious script file collection regularly.

[0146] S202: Select a malicious script file from a set of malicious script files.

[0147] Each malicious script file in the malicious script file set will execute steps S203 and S204.

[0148] S203: According to at least one code conversion rule, convert the code in the code segment of the selected malicious script file, and obtain a malicious feature sample based on the conversion result.

[0149] in, Figure 3 The S203 and Figure 2 The execution process of S102 is similar. Figure 3 For details of S203, please see Figure 2 A detailed description of S102.

[0150] S204: Add the obtained malicious feature sample as a malicious feature to a malicious script feature library.

[0151] After obtaining the malicious feature sample, the malicious feature sample can be added to the malicious script feature library.

[0152] exist Figure 3 In the illustrated embodiment, the embodiment of the present application converts all the codes of each malicious script file in the malicious script file set into multiple malicious feature samples, and adds the multiple malicious feature samples to the malicious script feature library, so that the malicious script feature library has mastered a large number of malicious code program structures. When it is necessary to determine whether there is malicious code in the script file to be detected, the first code segment of the script file to be detected can be converted into a first detection sample according to at least one code conversion rule, and the first detection sample is matched with multiple malicious features in the malicious script feature library. If the first detection sample is the first malicious feature in the malicious script feature library, it means that the program structure of the first code segment of the script file to be detected is the same as the program structure of the first known malicious code corresponding to the first malicious feature, so it can be determined that there is malicious code in the script file to be detected. Therefore, the embodiment of the present application can utilize the establishment of a malicious script feature library so that the malicious script code detection method provided by the embodiment of the present application can utilize the malicious script feature library to identify whether the obfuscated code is malicious code.

[0153] Accordingly, an embodiment of the present application provides a computer device for executing the remote control detection method provided in each of the above embodiments. Figure 4 The schematic diagram of the structure of a computer device provided in an embodiment of the present application is as follows. The computer device includes a processor 131 and a memory 132. Optionally, the computer device also includes a network interface 133.

[0154] The processor 131 is one or more CPUs. Optionally, the CPU is a single-core CPU or a multi-core CPU.

[0155] The memory 132 includes, but is not limited to, random access memory (RAM), read only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), flash memory, or optical memory, etc. The memory 132 stores operating system code.

[0156] The network interface 133 is a wired interface, such as a fiber distributed data interface (FDDI) or a Gigabit Ethernet (GE) interface; the network interface 133 may also be a wireless interface. The network interface 133 is used to receive data streams from the internal network and / or the external network, and communicate with the switch in the internal network according to the instructions of the processor 131.

[0157] Optionally, the processor 131 implements the method in the above embodiment by reading instructions stored in the memory 132, or the processor 131 may also implement the method in the above embodiment through internally stored instructions. In the case where the processor 131 implements the method in the above embodiment by reading instructions stored in the memory 132, the memory 132 stores instructions for implementing the method provided in the above embodiment of the present application.

[0158] After the processor 131 executes the instructions stored in the memory 132, the computer device performs the following operations: obtain a script file to be detected, the script file includes a first code segment; according to at least one code conversion rule, convert the code in the first code segment, and obtain a first detection sample based on the conversion result, at least one code conversion rule includes a first conversion rule, the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, and the first variable name is different from the second variable name; match the first detection sample with multiple malicious features in a malicious script feature library, determine a first malicious feature in the match, the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to at least one code conversion rule; according to the first malicious feature in the match, determine that malicious code exists in the script file to be detected.

[0159] At least one processor 131 further executes the method described in the above method embodiment according to several corresponding relationship tables (such as Tables 1 to 6 in the previous embodiment) stored in the memory 132. For more details on how the processor 131 implements the above functions, please refer to the description in the previous method embodiments, which will not be repeated here.

[0160] Optionally, the computer device further includes a bus 134 , and the processor 131 and the memory 132 are interconnected via the bus 134 , or may be interconnected in other ways.

[0161] Optionally, the computer device may further include an input device 135 and an output device 136. The input device 135 is used to input data into the computer device, and the output device 136 is used to output the processing result of the computer device. The input device 135 includes but is not limited to a keyboard, a touch screen, a microphone, etc. The output device 136 includes but is not limited to a display, a printer, etc.

[0162] Figure 5 A schematic diagram of the structure of another computer device provided in an embodiment of the present application. The computer device includes an acquisition module 141 and a processing module 142.

[0163] An acquisition module 141 is used to acquire a script file to be detected, where the script file includes a first code segment;

[0164] The processing module 142 is used to convert the code in the first code segment according to at least one code conversion rule, and obtain a first detection sample based on the conversion result, wherein the at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, and the first variable name is different from the second variable name; the first detection sample is matched with multiple malicious features in a malicious script feature library to determine a first malicious feature in the match, the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to at least one code conversion rule; according to the first malicious feature in the match, it is determined that malicious code exists in the script file to be detected.

[0165] For more details on the additional functions that can be implemented by the acquisition module 141 and the processing module 142 and the implementation of the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here.

[0166] Figure 5 The described device embodiments are merely illustrative. For example, the division of the modules is merely a logical function division. There may be other division methods in actual implementation, such as multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0167] Figure 5The above modules can be implemented in the form of hardware or software functional units. For example, when software is used, the acquisition module 141 and the processing module 142 can be composed of Figure 4 The processor 131 in the processor reads the program code stored in the memory and generates a software function module to implement it. Figure 5 The above modules can also be implemented by different hardware in the computer device, for example, the acquisition module 141 is implemented by Figure 4 The network interface 133 in is implemented, and the processing module 142 is implemented by Figure 4 The processing module 141 is implemented by using some processing resources in the processor 131 (such as other cores in a multi-core processor), or by using a field programmable gate array (FPGA) or a coprocessor or other programmable device. Obviously, the above functional modules can also be implemented in a combination of software and hardware. For example, the acquisition module 141 is implemented by the network interface 133, and the processing module 142 is a software functional module generated by the CPU after reading the instructions stored in the memory.

[0168] Figure 5 For more details on other additional functions that the device can implement, the interaction process with other network element devices, the technical effects that can be achieved, and how the acquisition module 141 and the processing module 142 implement the above functions, please refer to the description of the computer device in the previous method embodiments, which will not be repeated here.

[0169] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0170] Those skilled in the art will understand that when software is used to implement various aspects of the embodiments of the present application, or possible implementations of various aspects, the above-mentioned various aspects, or possible implementations of various aspects can be implemented in whole or in part in the form of a computer program product. A computer program product refers to computer-readable instructions stored in a computer-readable medium. When the computer instructions are loaded and executed on a computer, the process or function described in the embodiments of the present application is generated in whole or in part.

[0171] The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium includes, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or apparatuses, or any appropriate combination of the foregoing. For example, the computer-readable storage medium is a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM) or a portable read only memory (CD-ROM).

[0172] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the scope of the present invention. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present invention, the present invention is also intended to include these modifications and variations.

Claims

1. A method for detecting malicious script code, characterized in that: The method comprises: Obtaining a script file to be detected, wherein the script file includes a first code segment; According to at least one code conversion rule, convert the code in the first code segment, and obtain a first detection sample based on the conversion result, the at least one code conversion rule includes a first conversion rule, the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, the first variable name is different from the second variable name; Matching the first detection sample with multiple malicious features in a malicious script feature library to determine a first malicious feature in the match, where the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to the at least one code conversion rule; According to the first malicious feature in the match, it is determined that malicious code exists in the script file to be detected.

2. The malicious script code detection method according to claim 1, characterized in that: The at least one code conversion rule also includes a second conversion rule, The second conversion rule includes converting a first operator into a second value and converting a second operator into a third value, the first operator and the second operator are both used to perform operations on constants or variables, and the first operator is different from the second operator.

3. The malicious script code detection method according to claim 1, characterized in that: The at least one code conversion rule also includes a third conversion rule, The third conversion rule includes that the content of the first function name remains unchanged after conversion, and the first function name belongs to a function name in a predetermined set of sensitive function names; or the second function name is converted to a first value, and the second function name does not belong to a function name in the predetermined set of sensitive function names.

4. The malicious script code detection method according to claim 2, characterized in that: The at least one code conversion rule further comprises a fourth conversion rule, The fourth conversion rule includes: When the value assigned to the first variable name and the value assigned to the second variable name are both character strings, converting the value assigned to the first variable name to a fourth value and converting the value assigned to the second variable name to the fourth value; or When the value assigned to the first variable name and the value assigned to the second variable name are both numerical values, the value assigned to the first variable name is converted to a fifth value, and the value assigned to the second variable name is converted to the fifth value.

5. The malicious script code detection method according to claim 4, characterized in that: The at least one code conversion rule further comprises a fifth conversion rule, The fifth conversion rule includes: when the value assigned to the first variable name is an invisible character string, adding the value assigned to the first variable name to the first detection sample.

6. The malicious script code detection method according to claim 4, characterized in that: The at least one code conversion rule further includes a sixth conversion rule; The sixth conversion rule includes: when the value assigned to the second variable name is a visible character string, converting the value assigned to the second variable name into a first character string according to a predetermined coding format, and adding the first character string to the first detection sample.

7. The malicious script code detection method according to claim 4, characterized in that: The first value, the second value, the third value, the fourth value and the fifth value are all octal, decimal or hexadecimal values.

8. The malicious script code detection method according to any one of claims 1 to 7, characterized in that: Before obtaining the script file to be detected, the method further includes: Obtaining a malicious script file set, wherein the malicious script file set includes one or more malicious script files; A malicious script file is selected from the malicious script file set, and the selected malicious script file is processed in the following manner until each malicious script file in the malicious script file set is processed in the following manner: According to the at least one code conversion rule, convert the code in the code segment of the selected malicious script file, and obtain a malicious feature sample based on the conversion result; The obtained malicious feature sample is added to the malicious script feature library as a malicious feature.

9. A method for detecting malicious script code, characterized in that: The method comprises: Obtaining a malicious script file set, wherein the malicious script file set includes one or more malicious script files; A malicious script file is selected from the malicious script file set, and the selected malicious script file is processed in the following manner until each malicious script file in the malicious script file set is processed in the following manner: According to at least one code conversion rule, code in the code segment of the selected malicious script file is converted, and a malicious feature sample is obtained based on the conversion result, wherein the at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value and converting a second variable name into the first value, and the first variable name is different from the second variable name; The obtained malicious feature sample is added into the malicious script feature library as a malicious feature.

10. A computer device, characterized in that: The invention comprises a memory and a processor connected to the memory, wherein the memory is used to store instructions; The processor is configured to execute the instructions so that the computer device performs the following operations: Acquire a script file to be detected, wherein the script file contains a first code segment; convert the code in the first code segment according to at least one code conversion rule, and obtain a first detection sample based on the conversion result, wherein the at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, and the first variable name is different from the second variable name; match the first detection sample with multiple malicious features in a malicious script feature library, and determine a first malicious feature in the match, wherein the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to the at least one code conversion rule; determine, according to the first malicious feature in the match, that malicious code exists in the script file to be detected.

11. The computer device according to claim 10, characterized in that The at least one code conversion rule also includes a second conversion rule, The second conversion rule includes converting a first operator into a second value and converting a second operator into a third value, the first operator and the second operator are both used to perform operations on constants or variables, and the first operator is different from the second operator.

12. The computer device according to claim 10 or 11, characterized in that: The at least one code conversion rule also includes a third conversion rule, The third conversion rule includes that the content of the first function name remains unchanged after conversion, and the first function name belongs to a function name in a predetermined set of sensitive function names; or the second function name is converted to a first value, and the second function name does not belong to a function name in the predetermined set of sensitive function names.

13. The computer device according to claim 10 or 11, characterized in that: The at least one code conversion rule further comprises a fourth conversion rule, The fourth conversion rule includes: When the value assigned to the first variable name and the value assigned to the second variable name are both character strings, converting the value assigned to the first variable name to a fourth value and converting the value assigned to the second variable name to the fourth value; or When the value assigned to the first variable name and the value assigned to the second variable name are both numerical values, the value assigned to the first variable name is converted to a fifth value, and the value assigned to the second variable name is converted to the fifth value.

14. The computer device according to claim 13, characterized in that The at least one code conversion rule further comprises a fifth conversion rule, The fifth conversion rule includes: when the value assigned to the first variable name is an invisible character string, adding the value assigned to the first variable name to the first detection sample.

15. The computer device according to claim 13, characterized in that The at least one code conversion rule also includes a sixth conversion rule, The sixth conversion rule includes: when the value assigned to the second variable name is a visible character string, converting the value assigned to the second variable name into a first character string according to a predetermined coding format, and adding the first character string to the first detection sample.

16. The computer device according to claim 10, characterized in that: The processor is further used to obtain a malicious script file set, the malicious script file set including one or more malicious script files; select a malicious script file from the malicious script file set, and process the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to the at least one code conversion rule, convert the code in the code segment of the selected malicious script file, and obtain a malicious feature sample based on the conversion result; and add the obtained malicious feature sample as a malicious feature to the malicious script feature library.

17. A computer device, characterized in that: The invention comprises a memory and a processor connected to the memory, wherein the memory is used to store instructions; The processor is configured to execute the instructions so that the computer device performs the following operations: A malicious script file set is obtained, wherein the malicious script file set includes one or more malicious script files; a malicious script file is selected from the malicious script file set, and the selected malicious script file is processed in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to at least one code conversion rule, the code in the code segment of the selected malicious script file is converted, and a malicious feature sample is obtained based on the conversion result, wherein the at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value; and the obtained malicious feature sample is added to a malicious script feature library as a malicious feature.

18. A computer device, characterized in that: include: An acquisition module, used for acquiring a script file to be detected, wherein the script file includes a first code segment; A processing module is used to convert the code in the first code segment according to at least one code conversion rule, and obtain a first detection sample based on the conversion result, wherein the at least one code conversion rule includes a first conversion rule, and the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, and the first variable name is different from the second variable name; matching the first detection sample with multiple malicious features in a malicious script feature library, and determining a first malicious feature in the match, wherein the first malicious feature exists in both the malicious script feature library and the first detection sample, and the first malicious feature is obtained by converting a first known malicious code according to the at least one code conversion rule; and determining, according to the first malicious feature in the match, that malicious code exists in the script file to be detected.

19. A computer device, characterized in that: include: An acquisition module, used to acquire a malicious script file set, wherein the malicious script file set includes one or more malicious script files; A processing module is used to select a malicious script file from the malicious script file set, and process the selected malicious script file in the following manner until each malicious script file in the malicious script file set is processed in the following manner: according to at least one code conversion rule, the code in the code segment of the selected malicious script file is converted, and a malicious feature sample is obtained based on the conversion result, the at least one code conversion rule includes a first conversion rule, the first conversion rule includes converting a first variable name into a first value, and converting a second variable name into the first value, the first variable name is different from the second variable name; the obtained malicious feature sample is added to a malicious script feature library as a malicious feature.

Images