A fileless Trojan detection and killing method and device

Abstract

The present application provides a method and device for detecting and killing fileless Trojans, which relates to the field of information security and can also be used in the financial field, including: running a Java Agent engine and obtaining a stack call log and class bytecode information of a called program in a Web server application; determining the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information; determining the class file containing the fileless Trojan in the called program according to a preset detection and killing strategy and the risk level, and detecting and killing the fileless Trojan in the class file. The present application can realize the automatic detection and killing of fileless Trojans and protect the safe operation of Web applications.

Description

Technical Field

[0001] The present application relates to the field of information security and can be used in the financial field. Specifically, it is a method and device for detecting and killing fileless Trojans. Background Art

[0002] Fileless attack is an attack strategy that avoids storing malicious files on disk to evade detection by traditional security software. Among them, fileless Trojans (also called memory Trojans) are a common technical means of fileless attacks. It refers to writing malicious code such as backdoors or Trojans in memory and executing them to achieve the purpose of remotely controlling the Web server. Since traditional Web shells are designed based on file types, attackers can upload Trojans with files through tools or exploit vulnerabilities, and complete Trojan implantation on open Internet websites or applications in the enterprise. Compared with the above-mentioned traditional Trojan implantation method, fileless Trojans use the middleware process to execute malicious code to complete Trojan implantation, and no files will be landed.

[0003] In recent years, with the development of network security technology, fileless Trojans have gradually become a popular attack method due to their ability to effectively evade detection by traditional security software, posing a huge challenge to enterprise security protection. Currently, there is no effective detection method that can accurately locate and kill fileless Trojans. Summary of the invention

[0004] In view of the problems in the prior art, the present application provides a method and device for detecting and killing fileless Trojans, which can realize automatic detection and killing of fileless Trojans and protect the safe operation of Web applications.

[0005] In order to solve the above technical problems, this application provides the following technical solutions:

[0006] In a first aspect, the present application provides a fileless Trojan detection and killing method, comprising:

[0007] Run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0008] Determine the risk level of the called program according to preset detection rules, the stack call log and class bytecode information;

[0009] According to the preset killing strategy and the risk level, the class files containing the fileless Trojan in the called program are determined, and the fileless Trojan in the class files is killed.

[0010] Furthermore, the Java Agent engine is run to obtain the stack call log of the called program in the Web server application, including:

[0011] The Java Agent engine is hooked up to the Web server application program for operation;

[0012] Using the interface in the Java Agent engine to search the server memory for the called program in the Web server application and the stack list when it is called;

[0013] The stack call log of the called program is generated according to the stack list.

[0014] Furthermore, the class bytecode information includes: the class bytecode and feature information of the class bytecode; running the Java Agent engine and obtaining the class bytecode information of the called program in the Web server application includes:

[0015] The Java Agent engine is hooked up to the Web server application program for operation;

[0016] The class bytecode and the characteristic information of the class bytecode are read from the server memory by using the interface in the Java Agent engine.

[0017] Further, the determining the risk level of the called program according to the preset detection rules, the stack call log, the class bytecode and the feature information includes:

[0018] Determine the number of the detection rules hit by the called program according to the stack call log, the class bytecode and the feature information;

[0019] The risk level is determined according to a mapping relationship between the quantity and the risk level.

[0020] Further, the determining of the class containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and killing the fileless Trojan in the class file, includes:

[0021] Determine the class of fileless Trojans that need to be checked and killed in the called program according to the preset killing strategy and the risk level;

[0022] Locate the corresponding class file in the server memory according to the name of the class;

[0023] The Java bytecode enhancement technology is used to cover the class file to block the execution of the fileless Trojan in the class file and complete the killing.

[0024] In a second aspect, the present application provides a fileless Trojan detection and killing device, comprising:

[0025] A log class bytecode determination unit is used to run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0026] A risk level determination unit, used to determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information;

[0027] The detecting and killing unit is used to determine the class files containing the fileless Trojan in the called program according to the preset detecting and killing strategy and the risk level, and to detect and kill the fileless Trojan in the class files.

[0028] Furthermore, the log bytecode determination unit includes:

[0029] A mounting module, used for mounting the Java Agent engine to the Web server application program for operation;

[0030] A calling search module is used to use the interface in the Java Agent engine to search the called program in the Web server application program and the stack list when it is called from the server memory;

[0031] A log generating module is used to generate the stack call log of the called program according to the stack list.

[0032] Furthermore, the class bytecode information includes: the class bytecode and feature information of the class bytecode; the log class bytecode determination unit includes:

[0033] A mounting module, used for mounting the Java Agent engine to the Web server application program for operation;

[0034] The class bytecode reading module is used to read the class bytecode and the characteristic information of the class bytecode from the server memory by using the interface in the Java Agent engine.

[0035] Furthermore, the risk level determination unit includes:

[0036] A quantity determination module, used to determine the number of the called program hitting the detection rule according to the stack call log, the class bytecode and the feature information;

[0037] A risk level determination module is used to determine the risk level according to a mapping relationship between the quantity and the risk level.

[0038] Furthermore, the anti-virus detection unit includes:

[0039] A class determination module, used to determine the class of fileless Trojans that need to be detected and killed in the called program according to a preset detection and killing strategy and the risk level;

[0040] A class file locating module, used to locate the corresponding class file in the server memory according to the name of the class;

[0041] The detection and killing module is used to use Java bytecode enhancement technology to cover the class file to block the execution of the fileless Trojan in the class file and complete the detection and killing.

[0042] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the fileless Trojan detection and killing method when executing the program.

[0043] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the fileless Trojan detection and killing method.

[0044] In response to the problems in the prior art, the fileless Trojan detection and killing method and device provided by the present application can detect and kill fileless Trojans, making up for the defect that traditional file-based security detection software cannot detect and kill such Trojans, and ensuring the safe operation of the application system; at the same time, it combines dynamic execution information with static class feature analysis to greatly improve the accuracy of memory Trojan detection results; it adopts bytecode enhancement technology to achieve precise strikes without changing the source code, thereby improving the efficiency of fileless Trojan detection and killing. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 This is a flowchart of the fileless Trojan killing method in an embodiment of the present application;

[0047] Figure 2 This is a flowchart of obtaining logs in an embodiment of the present application;

[0048] Figure 3 A flowchart for obtaining class bytecode information in an embodiment of the present application;

[0049] Figure 4 A flow chart for determining risk levels in an embodiment of the present application;

[0050] Figure 5 This is a flowchart of detecting and killing fileless Trojans in an embodiment of the present application;

[0051] Figure 6 This is a structural diagram of a fileless Trojan killing device in an embodiment of the present application;

[0052] Figure 7 This is one of the structural diagrams of the log bytecode determination unit in the embodiment of the present application;

[0053] Figure 8 This is the second structural diagram of the log bytecode determination unit in the embodiment of the present application;

[0054] Fig. 9 This is a structural diagram of a log bytecode determination unit in an embodiment of the present application;

[0055] Fig.10 This is a structural diagram of the killing unit in the embodiment of the present application;

[0056] Fig.11 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0057] Fig.12 This is an application scenario diagram in an embodiment of the present application. DETAILED DESCRIPTION

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0059] It should be noted that the fileless Trojan detection and killing method and device provided in the present application can be used in the financial field, and can also be used in any field other than the financial field. The application field of the fileless Trojan detection and killing method and device provided in the present application is not limited.

[0060] In one embodiment, see Figure 1 In order to realize the automatic detection and killing of fileless Trojans and protect the safe operation of Web applications, the present application provides a method for killing fileless Trojans, including:

[0061] S101: Run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0062] S102: Determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information;

[0063] S103: Determine the class files containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and kill the fileless Trojan in the class files.

[0064] It is understandable that in order to solve the problem that traditional security detection software cannot detect fileless Trojans, the present application proposes a fileless Trojan detection and killing method based on bytecode enhancement technology. The method can automatically detect, locate and kill Web application fileless Trojans, thereby preventing attackers from attacking Web servers by remotely injecting malicious code, thereby improving the protection capabilities of Web application systems against such problems.

[0065] Specifically, see Fig.12 By running the Java Agent engine, the stack call log and class bytecode information of the called program in the Web server application can be obtained. The class bytecode information at least includes: class bytecode and its characteristic information. In order to better meet the detection and killing needs, detection rules can be set in advance. The detection rules contain risk level assessment rules. The risk level of the called program can be determined according to the preset detection rules, stack call logs and class bytecode information. Finally, the killing strategy is set, and the so-called killing strategy includes the killing operations required at each risk level. According to the preset killing strategy and the risk level, the class file containing the fileless Trojan in the called program is determined, and the fileless Trojan in the class file is killed.

[0066] In summary, the method described in this application can combine dynamic execution information with static class feature analysis to detect and kill fileless Trojans. The dynamic execution information at least corresponds to the stack log, and the static class feature at least corresponds to the class bytecode.

[0067] From the above description, it can be seen that the fileless Trojan detection and killing method provided by the present application can realize the detection and killing of fileless Trojans, making up for the defect that traditional file-based security detection software cannot detect and kill such Trojans, and ensuring the safe operation of the application system; at the same time, it combines dynamic execution information with static class feature analysis, greatly improving the accuracy of fileless Trojan detection results; using bytecode enhancement technology, it can achieve precise strikes without changing the source code, thereby improving the efficiency of fileless Trojan detection and killing.

[0068] In one embodiment, see Figure 2 , run the Java Agent engine and obtain the stack call log of the called program in the Web server application, including:

[0069] S201: attaching the Java Agent engine to the Web server application to run;

[0070] S202: using the interface in the Java Agent engine to search the server memory for the called program in the Web server application and the stack list when it is called;

[0071] S203: Generate the stack call log of the called program according to the stack list.

[0072] It can be understood that in the embodiment of the present application, a Class dump operation is first required to obtain all class bytecodes in the Web server memory, and then the key system functions in the Web server memory are dynamically inserted. Finally, based on the results of the Class dump and the results of the dynamic insertion, the fileless Trojan is detected and killed.

[0073] ①Class dump operation: This operation is implemented through the JVM interface. Start the Java Agent engine and attach the JavaAgent engine to the Web server application to run it. Then, you can use the function of the Java Agent engine to periodically dump all class bytecodes loaded into the memory of the Web application under test.

[0074] ② Dynamic instrumentation operation: This operation implements instrumentation of key system functions. These system functions include but are not limited to command execution functions, file read and write functions, and database read and write functions, so as to monitor the calling of key system functions in real time. When the monitored system function is called, the call stack information is recorded, including the stack call log.

[0075] It should be noted that the dynamic instrumentation operation specifically includes bytecode enhancement and log recording. The former mainly implements instrumentation of key system functions to facilitate real-time detection and recording of their call status. The latter realizes the generation of call logs of key system functions. When a key system function is detected to be called, the call stack of the relevant function will be recorded to generate a key function call log.

[0076] The reason for dynamic instrumentation is at least because when using the interface in the Java Agent engine to find the called program in the Web server application and its stack list when it is called from the server memory, the specific steps include the following:

[0077] First, using the interface in the Java Agent engine to search the called program in the Web server application from the server memory as the system key function;

[0078] Second, perform instrumentation operations on key system functions;

[0079] Third, the system key function is run, and at the same time, a stack list when the system key function is called is recorded according to the result of the instrumentation operation.

[0080] ③ Fileless Trojan detection operation: Since the Class dump operation has obtained the Class list, also known as the class list, the dynamic instrumentation operation has also collected the key system function execution stack. The fileless Trojan detection operation can match the content of each Class file with the characteristics of the fileless Trojan according to the Class list and the key system function execution stack. If the strategy is not hit, it will be executed normally; if the strategy is hit, the Class will be classified and recorded according to the number of hit rules and the risk level. In addition, if a Class marked as suspicious exists in the execution stack of the key system function, its risk level can be set to a higher level. Finally, a suspicious Class risk level list is generated as a parameter for use in fileless Trojan detection. Among them, the strategy is pre-set by system maintenance technicians according to actual needs, and this application is not limited to this.

[0081] ④ Fileless Trojan Killing Operation: This operation will combine the Class risk level determined in the previous step and the killing strategy set by the user to perform fileless Trojan warning and killing. For the fileless Trojan class that is confirmed to need to be killed, the bytecode enhancement technology is used to modify the class logic or simulate the middleware cancellation class method to destroy its execution process and achieve the purpose of clearing the fileless Trojan. See the explanation in the embodiment of the Filter-type fileless Trojan killing described below. Among them, the killing strategy is pre-set by the system maintenance technician according to actual needs, and this application is not limited to this.

[0082] It should be noted that before performing fileless Trojan detection and killing, the device needs to be deployed on the application server, and the detection and killing engine needs to be connected to the application service through preloading or hot loading. System maintenance technicians can customize the detection and killing strategy through the browser and view the detection and killing results of fileless Trojans.

[0083] From the above description, it can be seen that the fileless Trojan detection method provided by the present application can run the Java Agent engine and obtain the stack call log of the called program in the Web server application.

[0084] In one embodiment, see Figure 3 , the class bytecode information includes: class bytecode and feature information of the class bytecode; running the Java Agent engine and obtaining the class bytecode information of the called program in the Web server application, including:

[0085] S301: attaching the Java Agent engine to the Web server application to run;

[0086] S302: Read the class bytecode and feature information of the class bytecode from the server memory using the interface in the Java Agent engine.

[0087] It can be understood that in the embodiment of the present application, in order to obtain the class bytecode and its characteristic information in the server memory, it is first necessary to mount the Java Agent, and then obtain the class bytecode and its characteristic information through the Class dump operation.

[0088] ① Java Agent attachment operation: After running the Web application to be tested, attach the Java Agent engine to the running application process. Java Agent attachment can be achieved by adding Agent parameters at startup or attaching a process.

[0089] ②Class dump operation: dump the full amount of Class bytecode loaded in the memory, also known as class bytecode; obtain the characteristic information of the bytecode. This characteristic information includes but is not limited to the class name, the inherited parent class, the class loader to which it belongs, the function body content, etc.

[0090] From the above description, it can be seen that the fileless Trojan detection and killing method provided by this application can run the Java Agent engine and obtain the class bytecode information of the called program in the Web server application.

[0091] In one embodiment, see Figure 4 , the risk level of the called program is determined according to the preset detection rules, the stack call log, the class bytecode and the feature information, including:

[0092] S401: Determine the number of the called program hitting the detection rule according to the stack call log, the class bytecode and the feature information;

[0093] S402: Determine the risk level according to a mapping relationship between the quantity and the risk level.

[0094] It is understandable that the detection rules preset in the embodiment of the present application may include several items, and the more hits there are, the higher the risk of containing a fileless Trojan. These rules can be set according to actual needs, and the present application is not limited thereto.

[0095] In the specific implementation, first, obtain the full class information dumped in the memory and the stack log of the key function call. Then, realize the automatic identification of fileless Trojans based on the above information. That is, by defining the feature rules of fileless Trojans, set the identification strategy of fileless Trojans, such as: the class name contains keywords such as shell or random numbers, there is no related class in the corresponding web configuration file, there is no entity Class file under the corresponding class loading path or it is loaded with a special class loader, and the key function execution stack contains the class, etc. The class information that hits more than one rule is passed to the next processing link for evaluation and recording; the class that does not hit the strategy can be executed normally. Finally, the class name that hits the strategy is statistically recorded according to the preset risk level classification, and a class risk level list is generated and passed as a parameter to the next processing link.

[0096] From the above description, it can be seen that the fileless Trojan detection and killing method provided by the present application can determine the risk level of the called program based on the preset detection rules, the stack call log, the class bytecode and the feature information.

[0097] In one embodiment, see Figure 5 , the determining of the class containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and killing the fileless Trojan in the class file, includes:

[0098] S501: Determine the class of fileless Trojans that need to be checked and killed in the called program according to the preset killing strategy and the risk level;

[0099] S502: Locate the corresponding class file in the server memory according to the name of the class;

[0100] S503: Using Java bytecode enhancement technology to cover the class file to block the execution of the fileless Trojan in the class file and complete the killing.

[0101] It is understandable that the embodiment of the present application first receives a class risk level list, and locates the memory Trojan function that needs to be detected and killed in combination with the detection and killing strategy set by the user. Then, the Java bytecode enhancement technology is used to clear the memory Trojan to prevent the execution of malicious code. The malicious code can be directly modified or the class can be deregistered for removal.

[0102] In order to more clearly illustrate the feasibility of this method, the workflow of this method is now shown by taking the killing scenario of Filter-type fileless Trojan as an example. It should be noted that the method described in this application is not limited to killing Filter-type fileless Trojan, and this embodiment is only for illustration.

[0103] ① Start the application to be tested on the Web application server.

[0104] ②Hook the Java Agent engine to the running application process.

[0105] ③Dump all class bytecodes in the application memory.

[0106] ④ Decompile the class bytecode to obtain all class information.

[0107] ⑤Insert key system functions, such as command execution functions, file read and write functions, database read and write functions, etc., and monitor the calling status of such functions in real time.

[0108] ⑥ During the detection process, when the system key function is called, the call stack corresponding to the function is recorded and the key function call log is dynamically generated.

[0109] ⑦ Traverse the class file table, obtain one element in the list each time, and identify the fileless Trojan.

[0110] ⑧ Pass the class to be detected into the feature matching unit, and determine whether the class meets the characteristics of fileless Trojans one by one. The detection strategies are: the Filter name contains keywords such as shell, there is no Filter configuration in web.xml, it is loaded by a specific classloader, such as TemplatesImpl and bvel, there is no class file in the corresponding classloader directory, and there are malicious codes such as invoke and getRuntime in the dumped Filter class. If the strategy is hit, the subsequent risk level assessment and killing will be carried out; otherwise, it will be executed normally.

[0111] ⑨ Record the risk categories according to the number and characteristics of the hit strategies. For the five detection strategies of Filter-type fileless Trojans, 4 or more hits are high risk, 3 or 2 are medium risk, and 1 is low risk. Determine the fileless Trojans that need to be detected and killed according to the detection and killing strategy set by the user, and pass its class name as a parameter to the next module.

[0112] ⑩ For the fileless Trojans confirmed to be to be detected and killed, locate the class file to be detected and killed in the memory according to the class name, that is, the malicious bytecode segment that needs to be modified; use Java bytecode enhancement technology to directly overwrite the malicious bytecode in the doFilter method of the class file to be detected and killed, prevent the execution of the fileless Trojan, and complete the killing; generate a fileless Trojan detection and killing report, including the policy hit status and killing results, and display it to the user through the browser.

[0113] From the above description, it can be seen that the fileless Trojan detection and killing method provided by the present application can determine the class containing the fileless Trojan in the called program according to the preset detection and killing strategy and the risk level, and detect and kill the fileless Trojan in the class file.

[0114] In summary, this application proposes a method and device for detecting and killing fileless Trojans in Web applications based on bytecode enhancement technology. In order to solve the problem that fileless Trojans without landing files are not easily detected and killed by traditional security detection software, a method for identifying fileless Trojan features is used by first dumping the full class bytecode in the memory, decompiling it, and then matching the characteristics of the fileless Trojans. Combined with the system key function call log obtained by plugging, the information of the fileless Trojans is analyzed and confirmed, and the killing is carried out according to the user-configured killing strategy. The fileless Trojans that have been determined to be killed are overwritten or deregistered using Java bytecode enhancement technology to prevent their execution, thereby completing the removal of the malicious Trojans.

[0115] The beneficial effects and advantages of this application include at least:

[0116] 1. It realizes the detection and killing of fileless Trojans, making up for the problem that traditional file-based security detection software cannot detect and kill such Trojans, thus ensuring the security of the application system.

[0117] 2. It can combine dynamic execution information with static class feature analysis, greatly improving the accuracy of fileless Trojan detection results; at the same time, it provides configuration function to set the detection and killing strategy according to the user's configuration to avoid false positives as much as possible.

[0118] 3. The bytecode enhancement technology is used to achieve precise strikes without changing the source code, improving the efficiency of detecting and killing fileless Trojans.

[0119] Based on the same inventive concept, the embodiments of the present application also provide a fileless Trojan killing device, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the fileless Trojan killing device is similar to that of the fileless Trojan killing method, the implementation of the fileless Trojan killing device can refer to the implementation of the method based on software performance benchmark determination, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0120] In one embodiment, see Figure 6 In order to realize automatic detection and killing of fileless Trojans and protect the safe operation of Web applications, the present application provides a fileless Trojan killing device, including: a log bytecode determination unit 601, a risk level determination unit 602 and a killing unit 603.

[0121] The log class bytecode determination unit 601 is used to run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0122] A risk level determination unit 602, configured to determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information;

[0123] The detecting and killing unit 603 is used to determine the class files containing the fileless Trojan in the called program according to the preset detecting and killing strategy and the risk level, and detect and kill the fileless Trojan in the class files.

[0124] In one embodiment, see Figure 7 The log class bytecode determination unit 601 includes: a mounting module 701, a call search module 702 and a log generation module 703.

[0125] A mounting module 701 is used to mount the Java Agent engine to the Web server application program for operation;

[0126] A call search module 702 is used to use the interface in the Java Agent engine to search the called program in the Web server application program and the stack list when it is called from the server memory;

[0127] The log generating module 703 is used to generate the stack calling log of the called program according to the stack list.

[0128] In one embodiment, see Figure 8 The class bytecode information includes: the class bytecode and the characteristic information of the class bytecode; the log class bytecode determination unit 601 includes: a mounting module 701 and a class bytecode reading module 802.

[0129] A mounting module 701 is used to mount the Java Agent engine to the Web server application program for operation;

[0130] The class bytecode reading module 802 is used to read the class bytecode and the characteristic information of the class bytecode from the server memory by using the interface in the Java Agent engine.

[0131] In one embodiment, see Fig. 9 The risk level determination unit 602 includes: a quantity determination module 901 and a risk level determination module 902.

[0132] A quantity determination module 901 is used to determine the number of the called programs hitting the detection rules according to the stack call log, the class bytecode and the feature information;

[0133] The risk level determination module 902 is used to determine the risk level according to the mapping relationship between the quantity and the risk level.

[0134] In one embodiment, see Fig.10 The detection and killing unit 603 includes: a class determination module 1001, a class file positioning module 1002 and a detection and killing module 1003.

[0135] The class determination module 1001 is used to determine the class of the fileless Trojan horse that needs to be detected and killed in the called program according to the preset detection and killing strategy and the risk level;

[0136] A class file locating module 1002, used to locate a corresponding class file in the server memory according to the name of the class;

[0137] The detection and killing module 1003 is used to use Java bytecode enhancement technology to cover the class file to block the execution of the fileless Trojan in the class file and complete the detection and killing.

[0138] From the hardware level, in order to realize the automatic detection and killing of fileless Trojans and protect the safe operation of Web applications, the present application provides an embodiment of an electronic device for realizing all or part of the contents of the fileless Trojan killing method, and the electronic device specifically includes the following contents:

[0139] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize information transmission between the fileless Trojan killing device and related devices such as core business systems, user terminals and related databases; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the fileless Trojan killing method and the embodiment of the fileless Trojan killing device in the embodiment, and the contents thereof are incorporated herein, and the repeated parts are not repeated.

[0140] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0141] In practical applications, part of the fileless Trojan killing method can be executed on the electronic device side as described above, or all operations can be completed in the client device. The selection can be made based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0142] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0143] Fig.11 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig.11 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig.11 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0144] In one embodiment, the fileless Trojan killing method function may be integrated into the central processing unit 9100. The central processing unit 9100 may be configured to perform the following control:

[0145] S101: Run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0146] S102: Determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information;

[0147] S103: Determine the class files containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and kill the fileless Trojan in the class files.

[0148] From the above description, it can be seen that the fileless Trojan detection and killing method and device provided by the present application can realize the detection and killing of fileless Trojans, making up for the defect that traditional file-based security detection software cannot detect and kill such Trojans, and ensuring the safe operation of the application system; at the same time, the dynamic execution information is combined with the static class feature analysis, which greatly improves the accuracy of the fileless Trojan detection results; the bytecode enhancement technology is used to achieve precise strikes without changing the source code, thereby improving the efficiency of fileless Trojan detection and killing.

[0149] In another embodiment, the fileless Trojan killing device can be configured separately from the central processing unit 9100. For example, the data composite transmission device fileless Trojan killing device can be configured as a chip connected to the central processing unit 9100, and the function of the fileless Trojan killing method can be realized through the control of the central processing unit.

[0150] like Fig.11 As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig.11 In addition, the electronic device 9600 may also include Fig.11 For components not shown, reference may be made to the prior art.

[0151] like Fig.11 As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device. The central processing unit 9100 receives input and controls the operation of various components of the electronic device 9600.

[0152] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0153] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0154] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0155] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0156] The communication module 9110 is a transmitter / receiver 9110 that sends and receives signals via an antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0157] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the local machine through the microphone 9132, and the sound stored on the local machine can be played through the speaker 9131.

[0158] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the fileless Trojan detection and killing method in the above-mentioned embodiment, wherein the execution subject is a server or a client. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, all the steps of the fileless Trojan detection and killing method in the above-mentioned embodiment are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0159] S101: Run the Java Agent engine and obtain the stack call log and class bytecode information of the called program in the Web server application;

[0160] S102: Determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information;

[0161] S103: Determine the class files containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and kill the fileless Trojan in the class files.

[0162] From the above description, it can be seen that the fileless Trojan detection and killing method and device provided by the present application can realize the detection and killing of fileless Trojans, making up for the defect that traditional file-based security detection software cannot detect and kill such Trojans, and ensuring the safe operation of the application system; at the same time, the dynamic execution information is combined with the static class feature analysis, which greatly improves the accuracy of the fileless Trojan detection results; the bytecode enhancement technology is used to achieve precise strikes without changing the source code, thereby improving the efficiency of fileless Trojan detection and killing.

[0163] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0165] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0166] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0167] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A fileless Trojan detection and killing method, characterized in that: include: Get the stack call log and class bytecode information of the called program in the Web server application; Determine the risk level of the called program according to preset detection rules, the stack call log and class bytecode information; According to the preset killing strategy and the risk level, the class file containing the fileless Trojan in the called program is determined, and the fileless Trojan in the class file is killed.

2. The fileless Trojan detection and killing method according to claim 1 is characterized in that: The step of determining the class file containing the fileless Trojan in the called program according to the preset killing strategy and the risk level, and killing the fileless Trojan in the class file includes: Determine the class of fileless Trojans that need to be checked and killed in the called program according to the checking and killing strategy and the risk level; Locate the corresponding class file in the server memory according to the name of the class; The Java bytecode enhancement technology is used to cover the class file to block the execution of the fileless Trojan in the class file and complete the killing.

3. The fileless Trojan detection and killing method according to claim 2 is characterized in that: Get the call stack log of the called program in the Web server application, including: The Java Agent engine is hooked up to the Web server application program for operation; Using the interface in the Java Agent engine to search the server memory for the called program in the Web server application and its stack list when it is called; The stack call log of the called program is generated according to the stack list.

4. The fileless Trojan detection and killing method according to claim 3 is characterized in that: The method of using the interface in the Java Agent engine to search the server memory for the called program in the Web server application and the stack list when the program is called includes: Using the interface in the Java Agent engine to search the server memory for the called program in the Web server application as a system key function; Performing a plug-in operation on the key functions of the system; The system key function is run, and a stack list when the system key function is called is recorded according to the result of the plugging operation.

5. The fileless Trojan detection and killing method according to claim 3 is characterized in that: The class bytecode information includes: the class bytecode and the characteristic information of the class bytecode; obtaining the class bytecode information of the called program in the Web server application includes: The Java Agent engine is hooked up to the Web server application program for operation; The class bytecode and the characteristic information of the class bytecode are read from the server memory by using the interface in the Java Agent engine.

6. The fileless Trojan detection and killing method according to claim 5, characterized in that: Determining the risk level of the called program according to the preset detection rules, the stack call log and the class bytecode information includes: Determine the number of the detection rules hit by the called program according to the stack call log, the class bytecode and the feature information; The risk level is determined according to a mapping relationship between the quantity and the risk level.

7. A fileless Trojan detection and killing device, characterized in that: include: A log class bytecode determination unit is used to obtain the stack call log and class bytecode information of the called program in the Web server application; A risk level determination unit, used to determine the risk level of the called program according to a preset detection rule, the stack call log and the class bytecode information; The detecting and killing unit is used to determine the class files containing the fileless Trojan in the called program according to the preset detecting and killing strategy and the risk level, and detect and kill the fileless Trojan in the class files.

8. The fileless Trojan detection and killing device according to claim 7, characterized in that: The killing unit comprises: A class determination module, used to determine the class of fileless Trojans that need to be detected and killed in the called program according to a preset detection and killing strategy and the risk level; A class file locating module, used to locate the corresponding class file in the server memory according to the name of the class; The detection and killing module is used to use Java bytecode enhancement technology to cover the class file to block the execution of the fileless Trojan in the class file and complete the detection and killing.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the fileless Trojan detection and killing method described in any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the fileless Trojan detection and killing method described in any one of claims 1 to 6 are implemented.

Images