Reverse shell process detection method and device, electronic device, computer storage medium and program product

Abstract

The present invention proposes a reverse shell process detection method and device, electronic device, computer storage medium and program product, the method comprising: obtaining process information of a target process; generating a target directed graph based on the process information and an initialization graph structure; determining the state of a target loop in the target directed graph; and determining whether the target process is a reverse shell process according to the state of the target loop. The technical solution of the present invention is helpful to quickly identify and detect a large number of reverse shell processes, and improves the detection efficiency and accuracy of reverse shell processes.

Description

[Technical field]

[0001] The present invention relates to the field of computer technology, and in particular to a reverse shell process detection method and device, electronic equipment, computer storage medium and program product. [Background technology]

[0002] With the development of science and technology, computer security risks are frequent, and reverse shell has become one of them. The working method of reverse shell is that the remote computer sends its shell to a specific user, and this feature is often used by illegal objects to invade the computer. In this regard, the relevant technology can collect the characteristics of the target process to determine whether it is a reverse shell process, but this judgment method is based on a single basis and the detection accuracy is low.

[0003] Therefore, how to accurately and reliably detect the reverse shell process has become a technical problem that needs to be solved urgently. [Summary of the invention]

[0004] The embodiments of the present invention provide a reverse shell process detection method and device, electronic device, computer storage medium and program product, aiming to solve the technical problem of insufficient reverse shell process detection accuracy in related technologies.

[0005] In a first aspect, an embodiment of the present invention provides a reverse shell process detection method, comprising: obtaining process information of a target process; generating a target directed graph based on the process information and an initialization graph structure; determining a state of a target loop in the target directed graph; and determining whether the target process is a reverse shell process according to the state of the target loop.

[0006] In the above embodiment of the present invention, optionally, the state of the target loop includes: the existence of the target loop and the non-existence of the target loop; the step of determining whether the target process is a reverse shell process according to the state of the target loop includes: if the target loop exists in the target directed graph, determining whether the name of the target loop is related to the specified shell name; if so, determining that the target process is a reverse shell process.

[0007] In the above embodiment of the present invention, optionally, the step of generating a target directed graph based on the process information and the initialization graph structure includes: adding the process information to the initialization graph structure to obtain an intermediate graph structure; performing directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph.

[0008] In the above embodiment of the present invention, optionally, the step of adding the process information to the initialization graph structure to obtain the intermediate graph structure includes: for each of the target processes, if the mode value of the file pointed to by the file descriptor in the target process is a pipe type or a socket type, then taking the target process as a node of the initialization graph structure, setting the process information of the target process as the node attribute information of the node, and obtaining the intermediate graph structure.

[0009] In the above embodiment of the present invention, optionally, the process information of the target process includes: the process identifier of the target process, the value of the file descriptor in the target process, the index node number of the file pointed to by the file descriptor, and the mode value of the file pointed to by the file descriptor.

[0010] In the above embodiment of the present invention, optionally, the step of performing directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph includes: based on the node attribute information of each node in the intermediate graph structure and the preset rules, selecting the target node in the intermediate graph structure, and performing directed connection processing on the target node to obtain the target directed graph.

[0011] In the above embodiment of the present invention, optionally, the step of performing directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph includes: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are different, when the file descriptor of the first node is standard input, the file descriptor of the second node is non-standard input, and the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, an edge is established between the first node and the second node; when the file descriptor of the first node is standard output or standard error, the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established between the first node and the second node; wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0012] In the above embodiment of the present invention, optionally, the step of performing directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph includes: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard input and the file descriptor of the second node is non-standard input, an edge is established between the first node and the second node, wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0013] In the above embodiment of the present invention, optionally, the step of performing directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph includes: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established for the first node and the second node, wherein the edge points from a node of the first node and the second node whose file descriptor value is non-standard output and non-standard error to another node whose file descriptor value is standard output or standard error.

[0014] In a second aspect, an embodiment of the present invention provides a reverse shell process detection device, comprising: a process information acquisition unit, used to acquire process information of a target process; a target directed graph generation unit, used to generate a target directed graph based on the process information and an initialization graph structure; a loop state determination unit, used to determine the state of a target loop in the target directed graph; and a reverse shell determination unit, used to determine whether the target process is a reverse shell process based on the state of the target loop.

[0015] In the above embodiment of the present invention, optionally, the state of the target loop includes: the existence of the target loop and the non-existence of the target loop; the reverse shell determination unit is used to: if the target loop exists in the target directed graph, determine whether the name of the target loop is related to the specified shell name, and if so, determine that the target process is a reverse shell process.

[0016] In the above embodiment of the present invention, optionally, the target directed graph generation unit includes: an intermediate graph structure generation unit, used to add the process information to the initialization graph structure to obtain an intermediate graph structure; a node connection unit, used to perform directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph.

[0017] In the above embodiment of the present invention, optionally, the intermediate graph structure generating unit is used for: for each of the target processes, if the mode value of the file pointed to by the file descriptor in the target process is a pipe type or a socket type, then the target process is used as a node of the initialization graph structure, and the process information of the target process is set as the node attribute information of the node to obtain the intermediate graph structure.

[0018] In the above embodiment of the present invention, optionally, the process information of the target process includes: the process identifier of the target process, the value of the file descriptor in the target process, the index node number of the file pointed to by the file descriptor, and the mode value of the file pointed to by the file descriptor.

[0019] In the above embodiment of the present invention, optionally, the node connection unit is used to: select a target node in the intermediate graph structure based on the node attribute information of each node in the intermediate graph structure and the preset rules, and perform directed connection processing on the target node to obtain the target directed graph.

[0020] In the above embodiment of the present invention, optionally, the node connection unit is used for: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are different, when the file descriptor of the first node is standard input, the file descriptor of the second node is non-standard input, and the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, an edge is established between the first node and the second node; when the file descriptor of the first node is standard output or standard error, the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established between the first node and the second node; wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0021] In the above embodiment of the present invention, optionally, the node connection unit is used to: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard input and the file descriptor of the second node is non-standard input, build an edge for the first node and the second node, wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0022] In the above embodiment of the present invention, optionally, the node connection unit is used to: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, and the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output and non-standard error, build an edge for the first node and the second node, wherein the edge points from a node whose file descriptor value is non-standard output and non-standard error in the first node and the second node to another node whose file descriptor value is standard output or standard error.

[0023] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are configured to execute any of the methods described in the first aspect above.

[0024] In a fourth aspect, an embodiment of the present invention provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the method flow described in any one of the first aspects above.

[0025] In a fifth aspect, an embodiment of the present invention provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the method process described in any one of the first aspects above.

[0026] Through the above technical scheme, in order to solve the technical problem of insufficient accuracy of reverse shell process detection in related technologies, the creation of a target directed graph can be completed based on the process information of each target process and the initialization graph structure. The target directed graph integrates and connects target processes with common characteristics, which helps to quickly identify and detect a large number of reverse shell processes, thereby improving the detection efficiency and accuracy of reverse shell processes.

Brief Description of the Drawings

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A flowchart of a reverse shell process detection method according to an embodiment of the present invention is shown;

[0029] Figure 2 A flowchart of a method for constructing a directed graph according to an embodiment of the present invention is shown;

[0030] Figure 3 A block diagram of a reverse shell process detection device according to an embodiment of the present invention is shown;

[0031] Figure 4 A block diagram of an electronic device according to an embodiment of the present invention is shown. [Specific implementation method]

[0032] In order to better understand the technical solution of the present invention, the embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0033] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0035] Embodiment 1

[0036] Figure 1 A flow chart of a reverse shell process detection method according to an embodiment of the present invention is shown.

[0037] like Figure 1 As shown, the process of the reverse shell process detection method according to an embodiment of the present invention includes:

[0038] Step 102, obtaining process information of the target process.

[0039] The process information of the target process includes: a process identifier of the target process, a value of a file descriptor in the target process, an index node number of a file pointed to by the file descriptor, and a mode value of a file pointed to by the file descriptor.

[0040] Specifically, the process identifier can be described as PID_t, the file descriptor can be described as FD_t, the index node number (inode number) of the file pointed to by the file descriptor can be described as INode_t, and the mode value of the file pointed to by the file descriptor can be described as: Mode_t.

[0041] Step 104: Generate a target directed graph based on the process information and the initialization graph structure.

[0042] Each target process is used as a node in the initialization graph structure, and the process information of each target process is used as the edge building condition to build a target directed graph. In the target directed graph, the nodes corresponding to the target processes with common characteristics are connected to form a loop, thereby realizing the integration of the common characteristics of the target processes. Similarly, the reverse shell processes in these target processes are also extracted from the common characteristics in this graph building process. In other words, the target directed graph integrates and connects the target processes with common characteristics, which helps to quickly identify and detect a large number of reverse shell processes.

[0043] Step 106: Determine the state of the target loop in the target directed graph.

[0044] The state of the target loop includes: the target loop exists and the target loop does not exist. If the state of the target loop is that the target loop exists, the loop with the reverse shell process can be further screened out in the target loop. If the state of the target loop is that the target loop does not exist, it means that the reverse shell process does not exist.

[0045] Therefore, determining the state of the target loop in the target directed graph is helpful to further screen out the loop with the reverse shell process.

[0046] The target loop search algorithm may be a depth-first algorithm or a method of obtaining the target loop by traversing the key-value data structure of the directed graph.

[0047] Step 108: Determine whether the target process is a reverse shell process according to the state of the target loop.

[0048] Specifically, if there is a target loop in the target directed graph, it is determined whether the name of the target loop is related to the specified shell name, and if so, it is determined that the target process is a reverse shell process.

[0049] The specified shell name is a process name involved in the reverse shell process. After obtaining the target loop, if it is detected that the process name of the target loop is the specified shell name, the target loop is determined to be a reverse shell process.

[0050] The above technical solution establishes a target directed graph through the process information of each target process, and integrates and connects the target processes with common characteristics in the target directed graph, wherein the common characteristics of the reverse shell processes are inevitably extracted and connected, thereby facilitating rapid identification and detection of a large number of reverse shell processes, improving the detection efficiency and accuracy of the reverse shell processes, and increasing the security of the system.

[0051] Embodiment 2

[0052] On the basis of the first embodiment, a method for constructing a directed graph according to an embodiment of the present invention includes:

[0053] Step 202: Add the process information to the initialization graph structure to obtain an intermediate graph structure.

[0054] First, each target process needs to be used as a node in the initialization graph structure, and the process information of each target process is used as the node attribute information of the node to construct the intermediate graph structure.

[0055] Second, since there are many target processes, it is necessary to screen out valid target processes as valid nodes. Specifically, for each target process, if the mode value of the file descriptor pointing to the file in the target process is a pipe type or a socket type, the target process is used as a node of the initialization graph structure. At this point, the process information of the target process determined as a node is set as the node attribute information of the node to obtain the intermediate graph structure.

[0056] Among them, the S_ISFIFO macro and the S_ISSOCK macro can be used to detect the mode value of the file pointed to by the file descriptor.

[0057] If the S_ISFIFO macro detection return value is true, it indicates that the mode value of the file pointed to by the file descriptor is a pipe type, and the target process to which it belongs can be added as a node into the initialization graph structure.

[0058] If the S_ISSOCK macro detection return value is true, it indicates that the mode value of the file pointed to by the file descriptor is of the socket type, and the target process to which it belongs can be added as a node into the initialization graph structure.

[0059] Step 204 , performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph.

[0060] Specifically, in the intermediate graph structure, the node attribute information of the node corresponding to each target process is the process information of the target process. On this basis, based on the node attribute information of each node in the intermediate graph structure and the preset rules, the target nodes whose node attribute information meets the preset rules can be selected in the intermediate graph structure, and the target nodes can be directed connected to obtain the target directed graph.

[0061] The following introduces an implementation form of the preset rules through Example 3. Of course, the preset rules can be flexibly set based on actual reverse shell process detection requirements, including but not limited to the situation given in Example 3.

[0062] Embodiment 3

[0063] On the basis of the first and second embodiments, Figure 2 As shown, a method for constructing a directed graph according to an embodiment of the present invention includes:

[0064] Step 302: For each of the target processes, when the mode value of the file descriptor pointing to the file of the target process is a pipe type or a socket type, the target process is added as a node to the initialization graph structure.

[0065] Step 304, for any first node and second node in the initialization graph structure, determine whether the process identifiers of the first node and the second node are different. If the judgment result is yes, proceed to step 306, otherwise, proceed to step 310.

[0066] The process identifier is used as an identification code of the process to identify the unique identity of the process. Therefore, when the process identifiers of the first node and the second node are different, it can be determined that the two belong to different target processes. Conversely, if the process identifiers of the first node and the second node are the same, it means that the two belong to the data of the same target process.

[0067] Step 306: When the file descriptor of the first node is standard input, the file descriptor of the second node is non-standard input, and the inode numbers of the files pointed to by the file descriptors in the first node and the second node are the same, build an edge for the first node and the second node.

[0068] Step 308: When the file descriptor of the first node is standard output or standard error, the inode numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is non-standard output and non-standard error, build an edge between the first node and the second node.

[0069] A file descriptor is an index value that points to a record table of open files maintained by the kernel for each process. It includes three types: standard input, standard output, and standard error. The values ​​of standard input, standard output, and standard error are 0, 1, and 2, respectively.

[0070] If the inode number of the file pointed to by the file descriptor in the first node and the second node is the same, and the file descriptors of the two are inconsistent, it means that the first node and the second node access the same pointed file in different target processes, and the two have commonalities. Further, this means that the processes to which the first node and the second node belong respectively also have commonalities, so an edge can be built for the first node and the second node.

[0071] In step 306 and step 308, the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input, that is, from a node whose file descriptor is not 0 in the first node and the second node to another node whose file descriptor is 0.

[0072] Step 310: When the file descriptor of the first node is a standard input and the file descriptor of the second node is a non-standard input, create an edge between the first node and the second node.

[0073] Among them, the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input, that is, from a node whose file descriptor is not 0 in the first node and the second node to another node whose file descriptor is 0.

[0074] Step 312: When the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output or non-standard error, create an edge between the first node and the second node.

[0075] Among them, the edge points from a node whose file descriptor value in the first node and the second node is non-standard output and non-standard error to another node whose file descriptor value is standard output or standard error, that is, from a node whose file descriptor in the first node and the second node is not 1 and not 2 to another node whose file descriptor is 1 or 2.

[0076] In the case where the first node and the second node belong to the same target process, when their file descriptors are different, it means that the two nodes are associated and sequential, that is, they have common characteristics, so an edge can be established between the first node and the second node.

[0077] At this point, based on the process information of each target process and the initialization graph structure, the creation of the target directed graph is completed. The target directed graph integrates and connects target processes with common characteristics, which helps to quickly identify and detect a large number of reverse shell processes, thereby improving the detection efficiency and accuracy of reverse shell processes.

[0078] Figure 3 A block diagram of a reverse shell process detection device according to an embodiment of the present invention is shown.

[0079] like Figure 3 As shown, an embodiment of the present invention provides a reverse shell process detection device 400, including: a process information acquisition unit 402, used to acquire process information of a target process; a target directed graph generation unit 404, used to generate a target directed graph based on the process information and an initialization graph structure; a loop state determination unit 406, used to determine the state of a target loop in the target directed graph; a reverse shell determination unit 408, used to determine whether the target process is a reverse shell process according to the state of the target loop.

[0080] In the above embodiment of the present invention, optionally, the state of the target loop includes: the existence of the target loop and the non-existence of the target loop; the reverse shell determination unit 408 is used to: if the target loop exists in the target directed graph, determine whether the name of the target loop is related to the specified shell name, and if so, determine that the target process is a reverse shell process.

[0081] In the above embodiment of the present invention, optionally, the target directed graph generation unit 404 includes: an intermediate graph structure generation unit, used to add the process information to the initialization graph structure to obtain an intermediate graph structure; a node connection unit, used to perform directed connection processing on the nodes of the intermediate graph structure according to preset rules to obtain the target directed graph.

[0082] In the above embodiment of the present invention, optionally, the intermediate graph structure generating unit is used for: for each of the target processes, if the mode value of the file pointed to by the file descriptor in the target process is a pipe type or a socket type, then the target process is used as a node of the initialization graph structure, and the process information of the target process is set as the node attribute information of the node to obtain the intermediate graph structure.

[0083] In the above embodiment of the present invention, optionally, the process information of the target process includes: the process identifier of the target process, the value of the file descriptor in the target process, the index node number of the file pointed to by the file descriptor, and the mode value of the file pointed to by the file descriptor.

[0084] In the above embodiment of the present invention, optionally, the node connection unit is used to: select a target node in the intermediate graph structure based on the node attribute information of each node in the intermediate graph structure and the preset rules, and perform directed connection processing on the target node to obtain the target directed graph.

[0085] In the above embodiment of the present invention, optionally, the node connection unit is used for: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are different, when the file descriptor of the first node is standard input, the file descriptor of the second node is non-standard input, and the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, an edge is established between the first node and the second node; when the file descriptor of the first node is standard output or standard error, the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established between the first node and the second node; wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0086] In the above embodiment of the present invention, optionally, the node connection unit is used to: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard input and the file descriptor of the second node is non-standard input, build an edge for the first node and the second node, wherein the edge points from a node whose file descriptor value is non-standard input in the first node and the second node to another node whose file descriptor value is standard input.

[0087] In the above embodiment of the present invention, optionally, the node connection unit is used to: for any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, and the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output and non-standard error, build an edge for the first node and the second node, wherein the edge points from a node whose file descriptor value is non-standard output and non-standard error in the first node and the second node to another node whose file descriptor value is standard output or standard error.

[0088] The reverse shell process detection device 300 uses any one of the solutions in the above embodiments, and therefore has all the above technical effects, which will not be repeated here.

[0089] Figure 4 A block diagram of an electronic device according to an embodiment of the present invention is shown.

[0090] like Figure 4 As shown, an electronic device 500 of an embodiment of the present invention includes at least one memory 502; and a processor 504 in communication with the at least one memory 502; wherein the memory stores instructions executable by the at least one processor 504, and the instructions are configured to execute the solution described in any of the above embodiments. Therefore, the electronic device 500 has the same technical effects as any of the above embodiments, and will not be described in detail here.

[0091] The electronic devices of the embodiments of the present invention exist in various forms, including but not limited to:

[0092] (1) Mobile communication devices: These devices are characterized by their mobile communication functions and their main purpose is to provide voice and data communications. These terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end phones.

[0093] (2) Ultra-mobile personal computer devices: These devices fall into the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access features. These terminals include: PDA, MID and UMPC devices, such as iPad.

[0094] (3) Portable entertainment devices: These devices can display and play multimedia content. They include audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0095] (4) Server: A device that provides computing services. The server consists of a processor, hard disk, memory, system bus, etc. The server is similar to a general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0096] (5) Other electronic devices with data interaction functions.

[0097] In addition, an embodiment of the present invention provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the method flow described in any of the above embodiments.

[0098] Furthermore, an embodiment of the present invention provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes the method flow described in any one of the first aspects above.

[0099] The technical solution of the present invention is described in detail above in conjunction with the accompanying drawings. The technical solution of the present invention completes the creation of a target directed graph based on the process information of each target process and the initialization graph structure. The target directed graph integrates and connects target processes with common characteristics, which helps to quickly identify and detect a large number of reverse shell processes, thereby improving the detection efficiency and accuracy of reverse shell processes.

[0100] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0101] It should be understood that although the terms first, second, etc. may be used to describe nodes in embodiments of the present invention, these nodes should not be limited to these terms. These terms are only used to distinguish nodes from each other. For example, without departing from the scope of embodiments of the present invention, a first node may also be referred to as a second node, and similarly, a second node may also be referred to as a first node.

[0102] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0103] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0104] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0105] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (Processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), disk or optical disk and other media that can store program codes.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A reverse shell process detection method, characterized in that: include: Get the process information of the target process; Based on the process information and the initialization graph structure, generating a target directed graph; Determining a state of a target loop in the target directed graph; The state of the target loop includes: the target loop exists and the target loop does not exist; Determining whether the target process is a reverse shell process according to the state of the target loop; The step of generating a target directed graph based on the process information and the initialization graph structure includes: Adding the process information to the initialization graph structure to obtain an intermediate graph structure; Performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph; The step of adding the process information to the initialization graph structure to obtain an intermediate graph structure includes: For each of the target processes, if the mode value of the file pointed to by the file descriptor in the target process is a pipe type or a socket type, the target process is used as a node of the initialization graph structure, and the process information of the target process is set as the node attribute information of the node to obtain the intermediate graph structure; The step of performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph includes: Based on the node attribute information of each node in the intermediate graph structure and the preset rule, a target node is selected in the intermediate graph structure, and the target node is processed in a directed manner to obtain the target directed graph; The step of determining whether the target process is a reverse shell process according to the state of the target loop includes: If a target loop exists in the target directed graph, determining whether the name of the target loop is related to the specified shell name; If relevant, determine that the target process is a reverse shell process.

2. The method according to claim 1, characterized in that The process information of the target process includes: a process identifier of the target process, a value of a file descriptor in the target process, an index node number of a file pointed to by the file descriptor, and a mode value of a file pointed to by the file descriptor.

3. The method according to claim 1, characterized in that The step of performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph includes: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are different, When the file descriptor of the first node is a standard input, the file descriptor of the second node is a non-standard input, and the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, an edge is established between the first node and the second node; When the file descriptor of the first node is a standard output or a standard error, the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is a non-standard output and a non-standard error, an edge is established between the first node and the second node; The edge between the first node and the second node points to: from one of the first node and the second node, where the value of the file descriptor is non-standard input, to another node where the value of the file descriptor is standard input.

4. The method according to claim 1, characterized in that The step of performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph includes: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, When the file descriptor of the first node is a standard input and the file descriptor of the second node is a non-standard input, an edge is created between the first node and the second node, wherein: The edge between the first node and the second node points to: from one of the first node and the second node, where the value of the file descriptor is non-standard input, to another node where the value of the file descriptor is standard input.

5. The method according to claim 1, characterized in that The step of performing directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph includes: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, When the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established between the first node and the second node, wherein: The edge between the first node and the second node points to: from one of the first node and the second node, where the value of the file descriptor is non-standard output and non-standard error, to another node where the value of the file descriptor is standard output or standard error.

6. A reverse shell process detection device, characterized in that: include: A process information acquisition unit, used to acquire process information of a target process; A target directed graph generating unit, configured to generate a target directed graph based on the process information and the initialization graph structure; A loop state determination unit, used to determine the state of a target loop in the target directed graph; The state of the target loop includes: the target loop exists and the target loop does not exist; a reverse shell determination unit, configured to determine whether the target process is a reverse shell process according to a state of the target loop; Wherein, the target directed graph generation unit includes: An intermediate graph structure generating unit, used for adding the process information to the initialization graph structure to obtain an intermediate graph structure; A node connection unit, used to perform directed connection processing on the nodes of the intermediate graph structure according to a preset rule to obtain the target directed graph; Wherein, the intermediate graph structure generating unit is used for: For each of the target processes, if the mode value of the file pointed to by the file descriptor in the target process is a pipe type or a socket type, the target process is used as a node of the initialization graph structure, and the process information of the target process is set as the node attribute information of the node to obtain the intermediate graph structure; Wherein, the node connection unit is used for: Based on the node attribute information of each node in the intermediate graph structure and the preset rule, a target node is selected in the intermediate graph structure, and the target node is processed in a directed manner to obtain the target directed graph; Wherein, the reverse shell determination unit is used to: If there is a target loop in the target directed graph, it is determined whether the name of the target loop is related to the specified shell name, and if so, it is determined that the target process is a reverse shell process.

7. The device according to claim 6, characterized in that The process information of the target process includes: a process identifier of the target process, a value of a file descriptor in the target process, an index node number of a file pointed to by the file descriptor, and a mode value of a file pointed to by the file descriptor.

8. The device according to claim 6, characterized in that The node connection unit is used for: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are different, the file descriptor of the first node is standard input, the file descriptor of the second node is non-standard input, and the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, an edge is established for the first node and the second node; When the file descriptor of the first node is standard output or standard error, the index node numbers of the files pointed to by the file descriptors in the first node and the second node are the same, and the file descriptor of the second node is non-standard output and non-standard error, an edge is established between the first node and the second node; wherein the edge between the first node and the second node points to: from one node in the first node and the second node where the value of the file descriptor is non-standard input, to another node where the value of the file descriptor is standard input.

9. The device according to claim 6, characterized in that The node connection unit is used for: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard input and the file descriptor of the second node is non-standard input, an edge is built for the first node and the second node, wherein the edge between the first node and the second node points from a node in the first node and the second node where the value of the file descriptor is non-standard input to another node where the value of the file descriptor is standard input.

10. The device according to claim 6, characterized in that The node connection unit is used for: For any first node and second node in the intermediate graph structure, if the process identifiers of the first node and the second node are the same, when the file descriptor of the first node is standard output or standard error, and the file descriptor of the second node is non-standard output and non-standard error, an edge is built for the first node and the second node, wherein the edge between the first node and the second node points to: from one node in the first node and the second node whose file descriptor value is non-standard output and non-standard error to another node whose file descriptor value is standard output or standard error.

11. An electronic device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; The memory stores instructions executable by the at least one processor, and the instructions are configured to execute the method according to any one of claims 1 to 5.

12. A computer storage medium, characterized in that: Computer executable instructions are stored, and the computer executable instructions are used to execute the method process according to any one of claims 1 to 5.

13. A computer program product, characterized in that When the computer program product runs on an electronic device, the electronic device executes the method flow as claimed in any one of claims 1 to 5.

Images