Bounce shell process detection method and system, storage medium and computer device thereof

Abstract

The present application is suitable for the technical field of computer process detection, and provides a reverse shell process detection method, which comprises the following steps: obtaining a user ID of a system open web service and marking the user ID as a dangerous user ID; detecting whether a system startup process execution opens a network connection, and if yes, obtaining a process related to the network connection; scoring a preset first mark value and a second mark value according to the attributes of the process by using a preset scoring system; judging whether the statistical results of the first mark value and the second mark value meet a preset numerical condition, and if yes, determining that the process is a reverse shell process. Therefore, the present application can solve the problem that the existing detection method cannot detect reverse shells of the type of not executing a system shell.

Description

Technical Field

[0001] This invention relates to the field of computer process detection technology, and in particular to a method, system, storage medium, and computer device for detecting reverse shell processes. Background Technology

[0002] A reverse shell is essentially a reversal of the client and server roles in a network context. Current methods for detecting reverse shells (computer shells, commonly known as shells, refer to software that provides an interface for users) primarily focus on common system shell processes. When a new shell process is executed, the system checks for file descriptor redirection. This method works well for detecting simple reverse shells, but some forms of reverse shells do not invoke the system shell, making them undetectable by conventional methods.

[0003] In summary, the existing methods have many problems in practical use, so it is necessary to improve them. Summary of the Invention

[0004] To address the aforementioned shortcomings, the present invention aims to provide a method for detecting reverse shell processes, including a system, storage medium, and computer equipment, which can solve the problem that existing detection methods cannot detect reverse shells that do not execute system shells.

[0005] To achieve the above objectives, the present invention provides a method for detecting reverse shell processes, comprising:

[0006] Obtain the user ID (IdentityDocument) of the system's open web (World Wide Web) service and mark it as a dangerous user ID;

[0007] The system detects whether the startup process opens a network connection; if so, it retrieves the processes related to the network connection.

[0008] Based on the attributes of the process, a preset first indicator value and a preset point system are scored respectively for the preset first indicator value and the preset second indicator value;

[0009] Determine whether the statistical results of the first and second flag values ​​meet the preset numerical conditions. If so, determine that the process is a reverse shell process.

[0010] According to the aforementioned reverse shell process detection method, the initial values ​​of the first flag value and the second flag value are zero;

[0011] The step of scoring the preset first and second indicator values ​​according to the attributes of the process using a preset scoring system further includes:

[0012] Determine whether the process is a shell of a Linux system; if so, increment the first flag value by one.

[0013] Determine whether the process is a scripting language interpreter; if so, increment the second flag value by one.

[0014] Determine whether the process is an operation and maintenance command that initiates an active external connection during execution; if so, decrement the second flag value by two.

[0015] Determine whether the process is a port forwarding tool; if so, increment the second identifier value by two.

[0016] Determine whether the standard input and standard output of the process are both redirected to the socket file descriptor of the process; if so, increment the second flag value by two.

[0017] Determine whether the user ID of the process is the dangerous user ID; if so, increment the second identifier value by one.

[0018] The step of determining whether the statistical results of the first and second flag values ​​meet preset numerical conditions, and if so, determining that the process is a reverse shell process, further includes:

[0019] Calculate the statistical results of the first and second flag values;

[0020] Based on the statistical results, determine whether the second indicator value is greater than or equal to zero;

[0021] If the sum of the first and second flag values ​​is greater than or equal to zero, then determine whether the sum of the first and second flag values ​​is greater than one. If so, then determine that the process is the reverse shell process.

[0022] The step of determining whether the statistical results of the first and second flag values ​​meet preset numerical conditions, and if so, determining that the process is a reverse shell process, further includes:

[0023] If the second flag value is less than zero, or the sum of the first flag value and the second flag value is less than or equal to one, then the process is determined to be a normal process.

[0024] A reverse shell process detection system was also proposed, including:

[0025] The tagging unit is used to obtain the user ID of the system's open web services and mark it as a dangerous user ID;

[0026] The detection and acquisition unit is used to detect whether the system startup process has opened a network connection; if so, it acquires the process related to the network connection.

[0027] The scoring unit is used to score the preset first indicator value and the preset second indicator value according to the attributes of the process using a preset scoring system.

[0028] The judgment unit is used to determine whether the statistical results of the first flag value and the second flag value meet the preset numerical conditions. If so, the process is determined to be a reverse shell process.

[0029] The initial values ​​of the first and second flag values ​​are both zero;

[0030] The scoring unit further includes:

[0031] The first counting unit is used to determine whether the process is a shell of the Linux system. If so, the first flag value is incremented by one.

[0032] The second counting unit is used to determine whether the process is a scripting language interpreter; if so, the second flag value is incremented by one.

[0033] The third unit is used to determine whether the process is an operation and maintenance command that will initiate an active external connection during execution. If so, the second flag value is decremented by two.

[0034] The fourth counting unit is used to determine whether the process is a port forwarding tool; if so, the second flag value is incremented by two.

[0035] The fifth unit is used to determine whether the standard input and standard output of the process are both redirected to the socket file descriptor of the process. If so, the second flag value is incremented by two.

[0036] The sixth unit is used to determine whether the user ID of the process is the dangerous user ID. If so, the second identifier value is incremented by one.

[0037] The determination unit includes:

[0038] A statistical subunit is used to calculate the statistical results of the first label value and the second label value;

[0039] The first judgment subunit is used to determine whether the second indicator value is greater than or equal to zero based on the statistical results.

[0040] The second judgment subunit is used to determine whether the sum of the first and second flag values ​​is greater than one if the second flag value is greater than or equal to zero, and if so, to determine that the process is the reverse shell process.

[0041] The judgment unit further includes:

[0042] The third judgment subunit is used to determine that the process is a normal process if the second flag value is less than zero or the sum of the first flag value and the second flag value is less than or equal to one.

[0043] Additionally, a storage medium and a computer device are provided, the storage medium being used to store a computer program for performing the methods described above.

[0044] The computer device includes a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the computer program to implement the method described above.

[0045] The reverse shell process detection method, system, storage medium, and computer equipment described in this invention adopt a scoring system. By detecting system processes in real time and scoring each process, it can determine whether a process is a reverse shell process, thus avoiding the false negatives in conventional detection schemes. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating the steps of the reverse shell process detection method according to a preferred embodiment of the present invention;

[0047] Figure 2 This is a flowchart illustrating the scoring steps of the reverse shell process detection method according to a preferred embodiment of the present invention.

[0048] Figure 3 This is a flowchart illustrating the judgment steps of the reverse shell process detection method according to a preferred embodiment of the present invention.

[0049] Figure 4 This is a structural block diagram of the reverse shell process detection system according to a preferred embodiment of the present invention;

[0050] Figure 5 This is a block diagram of the specific structure of the reverse shell process detection system according to a preferred embodiment of the present invention;

[0051] Figure 6 This is a schematic diagram of the computer device of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0053] It should be noted that references to "an embodiment," "embodiment," "example embodiment," etc., in this specification refer to the described embodiment including specific features, structures, or characteristics, but not every embodiment must include these specific features, structures, or characteristics. Furthermore, such expressions do not refer to the same embodiment. Moreover, when describing specific features, structures, or characteristics in conjunction with embodiments, whether or not explicitly described, it is indicated that incorporating such features, structures, or characteristics into other embodiments is within the knowledge of those skilled in the art.

[0054] Furthermore, certain terms are used in the specification and subsequent claims to refer to specific components or parts. Those skilled in the art will understand that manufacturers may use different names or terms to refer to the same component or part. This specification and subsequent claims do not distinguish components or parts by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and subsequent claims are open-ended and should be interpreted as "including but not limited to." Additionally, the term "connection" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connections made through other means.

[0055] Figure 1 The preferred embodiment of the present invention illustrates the reverse shell process detection method, which includes the following steps:

[0056] S101: Obtain the user ID of the system's open web service and mark it as a dangerous user ID.

[0057] S102: Detect whether the system startup process has opened a network connection. If so, obtain the process related to the network connection.

[0058] If a process started by the system does not have a network connection, it is determined that it does not need to be checked. Specifically, whenever the system starts a new process, it checks whether the process has a network connection. If it does, the next step of the check is triggered.

[0059] S103: Based on the attributes of the process, score the preset first indicator value and the preset second indicator value using a preset scoring system.

[0060] The preset first and second flag values ​​are initially 0. The preset scoring system can be used to evaluate whether the process belongs to a common system shell or a suspicious process, etc. Preferably, see [link to relevant documentation]. Figure 2 Step S103 further includes:

[0061] S1031. Determine whether the process is a shell of the Linux system. If so, increment the first flag value by one.

[0062] S1032. Determine whether the process is a scripting language interpreter; if so, increment the second flag value by one.

[0063] S1033. Determine whether the process is an operation and maintenance command that will initiate an active external connection during execution. If so, decrement the second flag value by two.

[0064] S1034. Determine whether the process is a port forwarding tool. If so, increment the second flag value by two.

[0065] S1035. Determine whether the standard input (referring to the data stream entering the program, such as the data stream obtained from the keyboard in the shell) and standard output (referring to the output data printed by the program, such as the output stream printed to the screen in the shell) of the process are both redirected to the socket file descriptor of the process. If so, increment the second flag value by two.

[0066] S1036. Determine whether the user ID of the process is the dangerous user ID. If so, increment the second flag value by one.

[0067] Therefore, the first flag value is used to indicate whether the process is a common system shell; the second flag value is used to indicate whether the process is a suspicious process that needs attention.

[0068] S104: Determine whether the statistical results of the first and second flag values ​​meet the preset numerical conditions. If so, determine that the process is a reverse shell process.

[0069] By statistically analyzing the first and second flag values, we can determine whether the process meets the numerical criteria for a reverse shell process, thus detecting whether it is a reverse shell process; see [link to relevant documentation]. Figure 3 Step S104 further includes:

[0070] S1041. Calculate the statistical results of the first label value and the second label value;

[0071] S1042. Determine whether the second indicator value is greater than or equal to zero based on the statistical results;

[0072] S1043. If the sum of the first flag value and the second flag value is greater than or equal to zero, then determine whether the sum of the first flag value and the second flag value is greater than one. If so, then step S1044 determines that the process is the reverse shell process.

[0073] Among them, the first condition in step S1042 is used to exclude system maintenance commands that are not of interest, and the second condition in step S1043 is used to determine whether it is a reverse shell; only when both conditions are met at the same time is it indicated that the connection to the relevant process is a suspicious process, thereby triggering a reverse shell warning.

[0074] Step S104 further includes:

[0075] S1045. If the second flag value is less than zero, or the sum of the first flag value and the second flag value is less than or equal to one, then the process is determined to be a normal process. That is, as long as either condition in steps S1042 or S1043 is not met, the detected process can be determined to be a normal process.

[0076] Furthermore, the procedure before step S102 includes:

[0077] Real-time monitoring to obtain system process execution information.

[0078] Step S102 includes:

[0079] The system process execution information is used to detect whether a network connection is open. If it is open, the process related to the network connection is retrieved.

[0080] Preferably, step S102 further includes:

[0081] If the network connection is detected to be open based on the system process execution information, then all processes that triggered the network connection are retrieved. That is, all processes that triggered the network connection are retrieved, and each process is scored and analyzed to detect the reverse shell process.

[0082] Alternatively, in other embodiments, step S102 further includes:

[0083] If the network connection is detected to be open based on the system process execution information, then processes related to the network connection that exceed a predetermined relevance threshold are identified. By pre-setting a network connection relevance threshold to filter processes for detection, detection efficiency is improved. The relevance of a network connection specifically refers to the degree of association triggered by the network connection, such as data transmission requesting a network connection.

[0084] Alternatively, in another embodiment, step S103 further includes:

[0085] If the network connection is detected to be open based on the system process execution information, the process with the highest relevance to the network connection is obtained. The process with the highest suspicion level is then selected based on the relevance matching and scored for further detection, thereby improving detection efficiency.

[0086] Figure 2 The preferred embodiment of the reverse shell process detection system 100 of the present invention is shown, comprising a marking unit 10, a detection and acquisition unit 20, a scoring unit 30, and a judgment unit 40; wherein:

[0087] The marking unit 10 is used to obtain the user ID of the system's open web service and mark it as a dangerous user ID; the detection and acquisition unit 20 is used to detect whether the system startup process has opened a network connection, and if so, obtain the process related to the network connection; the scoring unit 30 is used to score the preset first label value and the second label value according to the attributes of the process using a preset scoring system; the judgment unit 40 is used to judge whether the statistical results of the first label value and the second label value meet the preset numerical conditions, and if so, determine that the process is a reverse shell process. If a process started by the system does not have a network connection, it is determined that it is not an object that needs to be detected. Specifically, whenever the system starts a new process, it is determined whether the process has a network connection. If it does, the scoring unit 30 is triggered to start working. The preset first and second flag values ​​are initially 0. The scoring unit 30 scores the preset first and second flag values ​​according to the attributes of the process. The judgment unit 40 counts the scoring results to determine whether the process is a reverse shell process. Preferably, the specific functions of the marking unit 10, the detection and acquisition unit 20, the scoring unit 30 and the judgment unit 40 can be implemented by computer hardware and software.

[0088] See Figure 5 The scoring unit 30 specifically includes:

[0089] The first unit 301 is used to determine whether the process is a shell of the Linux system. Specifically, it determines whether the process is a common shell of the Linux system. If so, the first flag value is incremented by one.

[0090] The second counting unit 302 is used to determine whether the process is a scripting language interpreter, specifically whether it is a common scripting language interpreter, and if so, the second flag value is incremented by one.

[0091] The third molecular unit 303 is used to determine whether the process is an operation and maintenance command that will initiate an active external connection during execution. If so, the second flag value is decremented by two.

[0092] The fourth counting unit 304 is used to determine whether the process is a port forwarding tool, specifically to determine whether the process is a common port forwarding tool, etc. If so, the second flag value is incremented by two.

[0093] The fifth unit 305 is used to determine whether the standard input and standard output of the process are both redirected to the socket file descriptor of the process. If so, the second flag value is incremented by two. The standard input of the process refers to the data stream entering the program, such as the data stream obtained from the keyboard in a shell. The standard output refers to the output data printed by the program, such as the output stream printed to the screen in a shell.

[0094] The sixth molecular unit 306 is used to determine whether the user ID of the process is the dangerous user ID. If so, the second identifier value is incremented by one.

[0095] The judgment unit 40 specifically includes:

[0096] The statistical subunit 401 is used to calculate the statistical results of the first label value and the second label value;

[0097] The first judgment subunit 402 is used to determine whether the second indicator value is greater than or equal to zero based on the statistical results.

[0098] The second judgment subunit 403 is used to determine whether the sum of the first flag value and the second flag value is greater than one if the second flag value is greater than or equal to zero; if so, the process is determined to be the reverse shell process.

[0099] Preferably, the determination unit 40 further includes:

[0100] The third judgment subunit 404 is used to determine that the process is a normal process if the second flag value is less than zero or the sum of the first flag value and the second flag value is less than or equal to one.

[0101] Assuming the first identifier is bash and the second identifier is exec, the process must meet the following two conditions to be considered a reverse shell:

[0102] 1. exec≥0;

[0103] 2. bash+exec>1.

[0104] Based on this embodiment, it is preferable to further include a system monitoring unit; the system monitoring unit is used to monitor and obtain system process execution information in real time; the detection and acquisition unit 20 is used to detect whether a network connection is open based on the system process execution information, and if it is open, to obtain the process related to the network connection.

[0105] Preferably, the detection and acquisition unit 20 is further configured to acquire all processes that triggered the network connection if the network connection is detected to be open based on the system process execution information. That is, to acquire all processes that triggered the network connection, and then perform scoring and detection on each process to detect the reverse shell process.

[0106] Alternatively, in other embodiments, the detection and acquisition unit 20 is further configured to, if the network connection is detected to be open based on the system process execution information, acquire processes related to the network connection that exceed a predetermined relevance threshold. By pre-setting a network connection relevance threshold to filter processes for detection, detection efficiency is improved; the relevance of the network connection specifically refers to the degree of association triggered by the network connection, such as data transmission requesting a network connection.

[0107] Alternatively, in another embodiment, the detection acquisition unit 20 is further configured to, if the network connection is detected to be open based on the system process execution information, acquire the process with the highest relevance to the network connection. The process with the highest suspicion level is then selected based on the relevance matching and scored for detection, thereby improving detection efficiency.

[0108] The present invention also provides a storage medium for storing, for example, Figures 1-3 The computer program for the reverse shell process detection method is described. For example, computer program instructions, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. The program instructions invoking the methods of this application may be stored in a fixed or removable storage medium, and / or transmitted via data streams in broadcast or other signal carrying media, and / or stored in the storage medium of a computer device operating according to the program instructions. Here, one embodiment according to this application includes a... Figure 6 The computer device 400 shown preferably includes a storage medium 200 for storing a computer program and a processor 300 for executing the computer program. When the computer program is executed by the processor 300, the computer device 400 is triggered to execute the methods and / or technical solutions based on the foregoing embodiments.

[0109] It should be noted that this application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In one embodiment, the software program of this application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drives, floppy disks, and similar devices. Furthermore, some steps or functions of this application can be implemented in hardware, for example, as circuitry that works with a processor to perform the various steps or functions.

[0110] The method according to the invention can be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code or portions thereof for the method according to the invention can be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code components stored on a computer-readable medium so as to execute the method according to the invention when the program product is executed on a computer.

[0111] In a preferred embodiment, the computer program includes computer program code components adapted to perform all the steps of the method according to the invention when the computer program is run on a computer. Preferably, the computer program is embodied on a computer-readable medium.

[0112] In summary, the reverse shell process detection method, system, storage medium, and computer equipment described in this invention adopt a scoring system. By detecting system processes in real time and scoring each process, it can determine whether a process is a reverse shell process, thus avoiding the false negatives in conventional detection schemes.

[0113] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.

Claims

1. A method for detecting a reverse shell process, characterized in that, include: Obtain the user IDs of the system's open web services and mark them as dangerous user IDs; The system detects whether the startup process opens a network connection; if so, it retrieves the processes related to the network connection. Based on the attributes of the process, a preset first indicator value and a preset point system are scored respectively for the preset first indicator value and the preset second indicator value; Determine whether the statistical results of the first and second flag values ​​meet the preset numerical conditions; if so, determine that the process is a reverse shell process. The initial values ​​of the first and second flag values ​​are both zero; The step of scoring the preset first and second indicator values ​​according to the attributes of the process using a preset scoring system further includes: Determine whether the process is a shell of a Linux system; if so, increment the first flag value by one. Determine whether the process is a scripting language interpreter; if so, increment the second flag value by one. Determine whether the process is an operation and maintenance command that initiates an active external connection during execution; if so, decrement the second flag value by two. Determine whether the process is a port forwarding tool; if so, increment the second identifier value by two. Determine whether the standard input and standard output of the process are both redirected to the socket file descriptor of the process; if so, increment the second flag value by two. Determine whether the user ID of the process is the dangerous user ID; if so, increment the second identifier value by one.

2. The method for detecting a reverse shell process according to claim 1, characterized in that, The step of determining whether the statistical results of the first and second flag values ​​meet preset numerical conditions, and if so, determining that the process is a reverse shell process, further includes: Calculate the statistical results of the first and second flag values; Based on the statistical results, determine whether the second indicator value is greater than or equal to zero; If the sum of the first and second flag values ​​is greater than or equal to zero, then determine whether the sum of the first and second flag values ​​is greater than one. If so, then determine that the process is the reverse shell process.

3. The method for detecting a reverse shell process according to claim 2, characterized in that, The step of determining whether the statistical results of the first and second flag values ​​meet preset numerical conditions, and if so, determining that the process is a reverse shell process, further includes: If the second flag value is less than zero, or the sum of the first flag value and the second flag value is less than or equal to one, then the process is determined to be a normal process.

4. The method for detecting a reverse shell process according to claim 1, characterized in that, Before the step of detecting whether the network connection is opened during the system startup process, and if so, obtaining the process related to the network connection, the following steps are included: Real-time monitoring to obtain system process execution information; The step of detecting whether to open a network connection during the system startup process, and if so, obtaining the process related to the network connection, includes: The system process execution information is used to detect whether a network connection is open. If it is open, the process related to the network connection is retrieved.

5. The method for detecting a reverse shell process according to claim 4, characterized in that, The step of detecting whether the network connection is opened during the system startup process, and if so, obtaining the process related to the network connection, further includes: If the network connection is detected to be open based on the system process execution information, then processes related to the network connection that exceed a predetermined relevance threshold are obtained.

6. The method for detecting a reverse shell process according to claim 4, characterized in that, The step of detecting whether the network connection is opened during the system startup process, and if so, obtaining the process related to the network connection, further includes: If the network connection is detected to be open based on the system process execution information, then the process with the highest relevance to the network connection is obtained.

7. The method for detecting a reverse shell process according to claim 4, characterized in that, The step of detecting whether the network connection is opened during the system startup process, and if so, obtaining the process related to the network connection, further includes: If the network connection is detected to be open based on the system process execution information, then all processes that triggered the network connection are obtained.

8. A reverse shell process detection system, characterized in that, include: The tagging unit is used to obtain the user ID of the system's open web services and mark it as a dangerous user ID; The detection and acquisition unit is used to detect whether the system startup process has opened a network connection, and if so, to acquire the process related to the network connection. The scoring unit is used to score the preset first indicator value and the preset second indicator value according to the attributes of the process using a preset scoring system. The judgment unit is used to determine whether the statistical results of the first flag value and the second flag value meet the preset numerical conditions. If so, the process is determined to be a reverse shell process. The initial values ​​of the first and second flag values ​​are both zero; The scoring unit further includes: The first counting unit is used to determine whether the process is a shell of the Linux system. If so, the first flag value is incremented by one. The second counting unit is used to determine whether the process is a scripting language interpreter; if so, the second flag value is incremented by one. The third unit is used to determine whether the process is an operation and maintenance command that will initiate an active external connection during execution. If so, the second flag value is decremented by two. The fourth counting unit is used to determine whether the process is a port forwarding tool; if so, the second flag value is incremented by two. The fifth unit is used to determine whether the standard input and standard output of the process are both redirected to the socket file descriptor of the process. If so, the second flag value is incremented by two. The sixth unit is used to determine whether the user ID of the process is the dangerous user ID. If so, the second identifier value is incremented by one.

9. The reverse shell process detection system according to claim 8, characterized in that, The determination unit includes: A statistical subunit is used to calculate the statistical results of the first label value and the second label value; The first judgment subunit is used to determine whether the second indicator value is greater than or equal to zero based on the statistical results. The second judgment subunit is used to determine whether the sum of the first and second flag values ​​is greater than one if the second flag value is greater than or equal to zero, and if so, to determine that the process is the reverse shell process.

10. The reverse shell process detection system according to claim 9, characterized in that, The judgment unit further includes: The third judgment subunit is used to determine that the process is a normal process if the second flag value is less than zero or the sum of the first flag value and the second flag value is less than or equal to one.

11. The reverse shell process detection system according to claim 8, characterized in that, It also includes a system monitoring unit; The system monitoring unit is used to monitor and obtain system process execution information in real time; The detection and acquisition unit is used to detect whether a network connection is open based on the system process execution information. If it is open, the unit acquires the process related to the network connection.

12. The reverse shell process detection system according to claim 11, characterized in that, The detection and acquisition unit is further configured to acquire processes related to the network connection that exceed a predetermined relevance threshold if the network connection is detected to be open based on the system process execution information.

13. The reverse shell process detection system according to claim 11, characterized in that, The detection and acquisition unit is further configured to acquire the process with the highest relevance to the network connection if the network connection is detected to be open based on the system process execution information.

14. The reverse shell process detection system according to claim 11, characterized in that, The detection and acquisition unit is further configured to acquire all processes that triggered the network connection if the network connection is detected to be open based on the system process execution information.

15. A storage medium, characterized in that, Used to store a computer program for executing any one of the reverse shell process detection methods according to claims 1 to 7.

16. A computer device, characterized in that, The method includes a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor, when executing the computer program, implements the reverse shell process detection method according to any one of claims 1 to 7.

Images