Instruction detection method and device

Abstract

The present application provides an instruction detection method and device. After obtaining the instruction to be detected, the method performs lexical analysis on the instruction to be detected to obtain its corresponding lexical tree, and the lexical tree includes the word type after the instruction to be detected is converted into a word. Then, according to the word type, the lexical tree is simplified to simplify irrelevant characters in the instruction, and the simplified lexical tree is segmented to obtain one or more independent instructions. Then, command line semantic detection is performed on the one or more independent instructions to form general structured data, so that subsequent rule matching based on the structured data becomes simpler and clearer, and accurate instruction detection is achieved, which solves the problem that the existing instruction detection technology cannot accurately detect the meaning of the instruction in many cases, resulting in a high detection misjudgment rate.

Description

Technical Field

[0001] The present application relates to network technology of financial technology (Fintech), and in particular to an instruction detection method and device. Background Art

[0002] In recent years, with the development of computer technology, more and more technologies are applied in the financial field. Traditional finance is gradually transforming to financial technology. However, due to the security and real-time requirements of the financial industry, higher requirements are also placed on technology. For example, the network management system currently used by companies in the financial industry usually includes a complete enterprise-level information management system to ensure the security of user information and system communications.

[0003] Accordingly, in order to ensure the normal operation of the enterprise information management system, operation and maintenance has become an important part of the enterprise information management system, and the authority of the operation and maintenance personnel in the information management system is increasing. Once the operation and maintenance personnel make operational errors, it may lead to the loss of system data, causing huge losses to the enterprise.

[0004] Therefore, in order to reduce operational errors by operation and maintenance personnel, existing enterprises usually purchase special equipment or use existing open source jump servers to provide a user terminal interface, identify user input commands when users enter characters, and intercept high-risk commands to reduce the possibility of high-risk commands being executed. However, the above command detection technology cannot accurately detect the meaning of the command in many cases, resulting in a high detection misjudgment rate. Summary of the invention

[0005] In order to solve the problems existing in the prior art, the present application provides an instruction detection method and device.

[0006] In a first aspect, an embodiment of the present application provides an instruction detection method, the method comprising:

[0007] Acquire an instruction to be detected, perform lexical analysis on the instruction to be detected, and obtain a lexical tree corresponding to the instruction to be detected, wherein the lexical tree includes a word type after the instruction to be detected is converted into a word;

[0008] Simplifying the lexical tree according to the word types in the lexical tree, and performing instruction segmentation on the simplified lexical tree to obtain one or more independent instructions;

[0009] Performing command line semantic detection processing on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected;

[0010] Determine whether to execute the instruction to be detected according to the preset structured filtering rule and the structured instruction.

[0011] In a possible implementation, performing lexical analysis on the instruction to be detected to obtain a lexical tree corresponding to the instruction to be detected includes:

[0012] Determining the lexical structure of the instruction to be detected;

[0013] According to the lexical structure and preset lexical analysis rules, the instruction to be detected is subjected to lexical analysis to obtain a lexical analysis result;

[0014] According to the lexical analysis result, the lexical tree corresponding to the instruction to be detected is established.

[0015] In a possible implementation, before performing lexical analysis on the instruction to be detected according to the lexical structure and the preset lexical analysis rule, the method further includes:

[0016] Preprocessing the lexical structure according to a preset lexical structure, wherein the preprocessing includes removing the lexical structure that is the same as the preset lexical structure;

[0017] The step of performing lexical analysis on the instruction to be detected according to the lexical structure and preset lexical analysis rules includes:

[0018] The instruction to be detected is subjected to lexical analysis according to the preprocessed lexical structure and the preset lexical analysis rules.

[0019] In a possible implementation, the simplifying process of the lexical tree according to the word types in the lexical tree includes:

[0020] Get the preset word type to be simplified;

[0021] The lexical tree is simplified according to the word type to be simplified and the word types in the lexical tree. The simplification includes removing the word type that is the same as the word type to be simplified in the lexical tree.

[0022] In a possible implementation, the simplified lexical tree is segmented into instructions to obtain one or more independent instructions, including:

[0023] Get the preset word type to be segmented;

[0024] Determining a segmentation position in the simplified lexical tree according to the type of the word to be segmented and the type of the word in the lexical tree;

[0025] Based on the segmentation position, the simplified lexical tree is segmented into instructions to obtain the one or more independent instructions.

[0026] In a possible implementation, performing command line semantic detection processing on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected includes:

[0027] Establishing conditions based on the to-be-detected instruction and preset command line parsing rules, and determining a target command line parsing rule;

[0028] Based on the target command line parsing rule, command line semantic detection processing is performed on the one or more independent instructions to obtain the structured instruction corresponding to the instruction to be detected.

[0029] In a possible implementation, the target command line parsing rule includes a target instruction name, a target parameter, and a structured value corresponding to the target parameter;

[0030] The step of performing command line semantic detection processing on the one or more independent instructions based on the target command line parsing rule to obtain the structured instruction corresponding to the instruction to be detected includes:

[0031] Based on the target instruction name, determining, among the one or more independent instructions, a target independent instruction corresponding to an instruction name identical to the target instruction name;

[0032] According to the target parameter and the structured value corresponding to the target parameter, the target independent instruction is structured to obtain the structured instruction corresponding to the instruction to be detected.

[0033] In a possible implementation, the preset command line parsing rule establishment condition includes the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured value corresponding to the parameter in the command line parsing rule;

[0034] The step of establishing a condition based on the instruction to be detected and a preset command line parsing rule to determine a target command line parsing rule includes:

[0035] Determining parameters of the instruction to be detected in the scene to be intercepted;

[0036] The target command line parsing rule is determined according to the parameters in the scenario to be intercepted, the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured values ​​corresponding to the parameters in the command line parsing rule.

[0037] In a possible implementation, determining whether to execute the instruction to be detected according to the preset structured filtering rule and the structured instruction includes:

[0038] Matching the structured instruction with a preset structured filtering rule;

[0039] If the structured instruction does not match the preset structured filtering rule, it is determined to execute the instruction to be detected.

[0040] In a possible implementation manner, after matching the structured instruction with a preset structured filtering rule, the method further includes:

[0041] If the structured instruction matches the preset structured filtering rule, the instruction to be detected is intercepted and an interception prompt is generated;

[0042] If a continue execution instruction is received after the interception prompt is generated, the instruction to be detected is continued to be executed according to the continue execution instruction.

[0043] In a second aspect, an embodiment of the present application provides an instruction detection device, the device comprising:

[0044] A lexical analysis module, used for acquiring an instruction to be detected, performing lexical analysis on the instruction to be detected, and obtaining a lexical tree corresponding to the instruction to be detected, wherein the lexical tree includes a word type after the instruction to be detected is converted into a word;

[0045] An instruction normalization module, used for simplifying the lexical tree according to the word types in the lexical tree, and performing instruction segmentation on the simplified lexical tree to obtain one or more independent instructions;

[0046] An instruction structuring module, used to perform command line semantic detection processing on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected;

[0047] The instruction detection module is used to determine whether to execute the instruction to be detected according to a preset structured filtering rule and the structured instruction.

[0048] In a possible implementation, the lexical analysis module is specifically used to:

[0049] Determining the lexical structure of the instruction to be detected;

[0050] According to the lexical structure and preset lexical analysis rules, the instruction to be detected is subjected to lexical analysis to obtain a lexical analysis result;

[0051] According to the lexical analysis result, the lexical tree corresponding to the instruction to be detected is established.

[0052] In a possible implementation, the lexical analysis module is specifically used to:

[0053] Preprocessing the lexical structure according to a preset lexical structure, wherein the preprocessing includes removing the lexical structure that is the same as the preset lexical structure;

[0054] The instruction to be detected is subjected to lexical analysis according to the preprocessed lexical structure and the preset lexical analysis rules.

[0055] In a possible implementation, the instruction normalization module is specifically used to:

[0056] Get the preset word type to be simplified;

[0057] The lexical tree is simplified according to the word type to be simplified and the word types in the lexical tree. The simplification includes removing the word type that is the same as the word type to be simplified in the lexical tree.

[0058] In a possible implementation, the instruction normalization module is specifically used to:

[0059] Get the preset word type to be segmented;

[0060] Determining a segmentation position in the simplified lexical tree according to the type of the word to be segmented and the type of the word in the lexical tree;

[0061] Based on the segmentation position, the simplified lexical tree is segmented into instructions to obtain the one or more independent instructions.

[0062] In a possible implementation, the instruction structuring module is specifically used to:

[0063] Establishing conditions based on the to-be-detected instruction and preset command line parsing rules, and determining a target command line parsing rule;

[0064] Based on the target command line parsing rule, command line semantic detection processing is performed on the one or more independent instructions to obtain the structured instruction corresponding to the instruction to be detected.

[0065] In a possible implementation, the target command line parsing rule includes a target instruction name, a target parameter, and a structured value corresponding to the target parameter.

[0066] The instruction structuring module is specifically used for:

[0067] Based on the target instruction name, determining, among the one or more independent instructions, a target independent instruction corresponding to an instruction name identical to the target instruction name;

[0068] According to the target parameter and the structured value corresponding to the target parameter, the target independent instruction is structured to obtain the structured instruction corresponding to the instruction to be detected.

[0069] In a possible implementation, the preset command line parsing rule establishment condition includes the content form of the command line parsing rule, and setting requirements for instruction names, parameters, and structured values ​​corresponding to the parameters in the command line parsing rule.

[0070] The instruction structuring module is specifically used for:

[0071] Determining parameters of the instruction to be detected in the scene to be intercepted;

[0072] The target command line parsing rule is determined according to the parameters in the scenario to be intercepted, the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured values ​​corresponding to the parameters in the command line parsing rule.

[0073] In a possible implementation, the instruction detection module is specifically used to:

[0074] Matching the structured instruction with a preset structured filtering rule;

[0075] If the structured instruction does not match the preset structured filtering rule, it is determined to execute the instruction to be detected.

[0076] In a possible implementation, the instruction detection module is specifically used to:

[0077] If the structured instruction matches the preset structured filtering rule, the instruction to be detected is intercepted and an interception prompt is generated;

[0078] If a continue execution instruction is received after the interception prompt is generated, the instruction to be detected is continued to be executed according to the continue execution instruction.

[0079] In a third aspect, an embodiment of the present application provides an instruction detection device, including:

[0080] processor;

[0081] Memory; and

[0082] Computer programs;

[0083] The computer program is stored in the memory and is configured to be executed by the processor, wherein the computer program includes instructions for executing the method as described in the first aspect.

[0084] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program enables a server to execute the method described in the first aspect.

[0085] In a fifth aspect, an embodiment of the present application provides a computer program product, comprising computer instructions, wherein the computer instructions are executed by a processor according to the method described in the first aspect.

[0086] The instruction detection method and device provided in the embodiment of the present application, after obtaining the instruction to be detected, obtains its corresponding lexical tree by performing lexical analysis on the instruction to be detected, and the lexical tree includes the word type after the above-mentioned instruction to be detected is converted into a word, and then, according to the word type, the above-mentioned lexical tree is simplified, irrelevant characters in the instruction are simplified, and the simplified lexical tree is divided into instructions to obtain one or more independent instructions, thereby performing command line semantic detection processing on the one or more independent instructions to form general structured data, so that subsequent rule matching based on the structured data becomes simpler and clearer, and accurate instruction detection is achieved, which solves the problem that the existing instruction detection technology cannot accurately detect the meaning of the instruction in many cases, resulting in a high detection misjudgment rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0087] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0088] Figure 1 A schematic diagram of an instruction detection system architecture provided in an embodiment of the present application;

[0089] Figure 2 A flowchart of an instruction detection method provided in an embodiment of the present application;

[0090] Figure 3 A schematic diagram of a lexical tree provided in an embodiment of the present application;

[0091] Figure 4 A flowchart of another instruction detection method provided in an embodiment of the present application;

[0092] Figure 5 A flowchart of another instruction detection method provided in an embodiment of the present application;

[0093] Figure 6 A schematic diagram of the structure of an instruction detection device provided in an embodiment of the present application;

[0094] Figure 7 A possible structural schematic diagram of the instruction detection device of the present application is shown. DETAILED DESCRIPTION

[0095] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0096] The terms "first", "second", "third", and "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0097] For many companies, operation and maintenance has become an important part of the enterprise information management system. Especially in the field of financial technology, which directly involves the security of funds, operation and maintenance is even more important in financial technology companies. This makes the operation and maintenance personnel have more and more authority over the information management system. Once the operation and maintenance personnel make an operational error, it may cause the loss of system data and bring huge losses to the company. Therefore, in order to reduce the operational errors of operation and maintenance personnel, existing companies usually purchase special equipment or use existing open source jumpservers. By providing a user terminal interface, when the user enters characters, it identifies the user input instructions and intercepts high-risk instructions to reduce the possibility of high-risk instructions being executed.

[0098] However, the above instruction detection technology cannot accurately detect the meaning of the instruction in many cases, resulting in a high rate of false positives. For example, when user A logs in to the host and prepares to delete a temporary folder, he accidentally enters an extra space between / and tmp by entering: rm-rf / tmp / folder_a. The existing instruction detection cannot accurately detect this space and executes the above instruction, causing the host operating system to be deleted. For another example, when detecting that a certain instruction hits a rule, the instruction is not necessarily high-risk (such as rm-rf / tmp / folder_a / / tmp / folder_b). The rm instruction has many uses in the operating system, and more rules need to be added to prevent it from being bypassed, resulting in the instruction being difficult to detect accurately.

[0099] Here, the above instructions can be understood as a script that contains processing logic (judgment and loop, etc.) and commands for executing the affected commands, such as a SHELL script (SHELL can be understood as a command processor, which usually runs in a text window and can execute commands directly entered by the user. For example, commonly used SHELLs include sh, bash, dash, etc. SHELL can also read commands from files. Such files are called scripts. One or more SHELLs are provided in the Linux operating system. In addition, the above high-risk instructions can be understood as instructions that can be executed in the operating system or program, and after running, they cause irreversible impacts on the operating system or program data.

[0100] Therefore, an embodiment of the present application proposes an instruction detection method, which performs lexical analysis on the instruction to be detected to obtain its corresponding lexical tree, and then simplifies the lexical tree according to the word type in the lexical tree, simplifies irrelevant characters in the instruction, and performs instruction segmentation on the simplified lexical tree to obtain one or more independent instructions, thereby performing structured parsing of the instruction lines for the one or more independent instructions to form general structured data, so that subsequent rule matching based on the structured data becomes simpler and clearer, thereby achieving accurate high-risk instruction detection.

[0101] Among them, lexical analysis can be understood as the process of converting a character sequence into a word (Token). In the embodiment of the present application, a lexical analyzer can be used to perform lexical analysis on the instruction to be detected. The lexical analyzer may include a program or function for performing lexical analysis. The above word can be understood as a string, which is the smallest unit constituting the lexical.

[0102] Optionally, the instruction detection method provided in this application can be applied to Figure 1 The schematic diagram of the instruction detection system architecture is shown in FIG. Figure 1 As shown, the system may include a receiving device 101 , a processing device 102 and a display device 103 .

[0103] In a specific implementation process, the receiving device 101 may be an input / output interface or a communication interface, and may be used to receive the instruction to be detected.

[0104] The processing device 102 can obtain the above-mentioned instructions to be detected through the above-mentioned receiving device 101, and then perform lexical analysis on the above-mentioned instructions to be detected to obtain the lexical tree corresponding to the above-mentioned instructions to be detected, and then simplify the lexical tree according to the word type in the lexical tree, simplify irrelevant characters in the instructions, and perform instruction segmentation on the simplified lexical tree to obtain one or more independent instructions, thereby performing structured analysis of the instruction lines of the one or more independent instructions to form general structured data, and then perform rule matching based on the structured data to achieve accurate high-risk instruction detection.

[0105] In addition, the display device 103 can be used to display the above-mentioned instructions to be detected, lexical trees, structured instructions, etc.

[0106] The display device may also be a touch display screen, which is used to receive user instructions while displaying the above content to achieve interaction with the user.

[0107] Moreover, after determining whether to execute the instruction to be detected, the processing device 102 may generate an interception prompt if the instruction to be detected is intercepted. If a continue execution instruction is received after the interception prompt is generated, the processing device 102 may continue to execute the instruction to be detected according to the continue execution instruction to meet the actual application needs.

[0108] It should be understood that the above-mentioned processing device can be implemented by a processor reading instructions in a memory and executing the instructions, or it can be implemented by a chip circuit.

[0109] The above system is only an exemplary system, and can be configured according to application requirements during specific implementation.

[0110] It is understandable that the structure illustrated in the embodiment of the present application does not constitute a specific limitation on the architecture of the instruction detection system. In other feasible implementations of the present application, the above architecture may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, which can be determined according to the actual application scenario and is not limited here. Figure 1 The components shown may be implemented in hardware, software, or a combination of software and hardware.

[0111] In addition, the system architecture described in the embodiments of the present application is intended to more clearly illustrate the technical solutions of the embodiments of the present application, and does not constitute a limitation on the technical solutions provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the system architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0112] The technical solution of the present application is described below by taking several embodiments as examples, and the same or similar concepts or processes may not be repeated in some embodiments.

[0113] Figure 2 A flowchart of an instruction detection method provided in an embodiment of the present application. The execution subject of this embodiment may be Figure 1 The processing device in the embodiment shown can be specifically determined according to actual conditions. Figure 2 As shown, the instruction detection method provided in the embodiment of the present application includes the following steps:

[0114] S201: Acquire an instruction to be detected, perform lexical analysis on the instruction to be detected, and obtain a lexical tree corresponding to the instruction to be detected. The lexical tree includes word types after the instruction to be detected is converted into words.

[0115] Here, the above-mentioned instruction to be detected can be determined according to actual conditions, such as the above-mentioned rm instruction.

[0116] After obtaining the above-mentioned instructions to be detected, the above-mentioned processing device can first determine the lexical structure of the above-mentioned instructions to be detected, and then, according to the lexical structure and preset lexical analysis rules, perform lexical analysis on the above-mentioned instructions to be detected to obtain lexical analysis results, and finally establish a lexical tree corresponding to the above-mentioned instructions to be detected based on the lexical analysis results.

[0117] Wherein, before the processing device performs lexical analysis on the instruction to be detected according to the lexical structure and the preset lexical analysis rules, it can also pre-process the lexical structure according to the preset lexical structure, and the pre-processing includes removing the lexical structure that is the same as the preset lexical structure. Thus, the processing device can perform lexical analysis on the instruction to be detected according to the pre-processed lexical structure and the preset lexical analysis rules.

[0118] In the embodiment of the present application, the preset lexical structure can be set according to the actual situation, such as meaningless lexical structures such as spaces and / or exclamation marks. The processing device preprocesses the lexical structure according to the preset lexical structure, removes irrelevant characters in the instruction, and improves the accuracy of subsequent processing results.

[0119] Exemplarily, for the convenience of understanding the above description of obtaining the lexical tree corresponding to the instruction to be detected, here, taking the above instruction to be detected "你好,世界!(Hello,World!)" as an example, the process of obtaining the lexical tree corresponding to the instruction to be detected is described as follows. After obtaining the instruction to be detected, the above processing device can first determine the lexical structure of the instruction, that is, determine that the lexical structure of the above "Hello,World!" is in the form of word + space + separator + space + word + exclamation mark. Then, according to the preset lexical method, the above lexical structure is preprocessed to remove the irrelevant characters in the instruction. For example, if the preset lexical method is space, the above processing device removes the spaces in the above lexical structure according to the above preset lexical method. Furthermore, the above processing device performs lexical analysis on the above instruction according to the preprocessed lexical structure and the preset lexical analysis rules.

[0120] Among them, the above preset lexical analysis rules can be set according to the actual situation. For example, the LARK rule (LARK is an extended lexical representation based on the Extended Backus–Naur Form (EBNF) grammar. The rules are the same as EBNF, but use more concise terminal symbols for representation. For example, the ::= symbol in EBNF can be simply represented as :, which simplifies the program processing. EBNF is the extended Backus normal form, and the Backus normal form is a notation for describing the context-free grammar of computer programming languages and is a relatively common grammar representation meta-language).

[0121] Exemplarily, the above processing device performs lexical analysis on the above instruction according to the preprocessed lexical structure and the preset lexical analysis rules, such as the LARK rule, which may include the following steps (that is, its code implementation process):

[0122]

[0123] Finally, the above processing device obtains the lexical analysis result, that is, the string: "Hello,World". Further, the above processing device establishes the lexical tree corresponding to the instruction to be detected according to this lexical analysis result. Exemplarily, as Figure 3 shown. Figure 3 The lexical tree in includes the word types after the above instruction to be detected is converted into words, such as the word ('字', '你好')(Token('WORD', 'Hello')), the word ('SEP', ',')(Token('SEP', ',')), and the word ('字', '世界')(Token('WORD', 'World')). Among them, Figure 3 '字' and 'SEP' in respectively represent the types of the corresponding words, and SEP represents the separator symbol.

[0124] S202: Simplify the lexical tree according to the word types in the lexical tree, and perform instruction segmentation on the simplified lexical tree to obtain one or more independent instructions.

[0125] Here, the processing device may obtain a preset word type to be simplified, and then simplify the lexical tree according to the word type to be simplified and the word type in the lexical tree, wherein the simplification process includes removing the word type that is the same as the word type to be simplified in the lexical tree.

[0126] The type of word to be simplified can be set according to the actual situation. For example, in the lexical tree corresponding to "Hello, World", the word type 'SEP' does not have the meaning of the instruction. The processing device can set the type of word to be simplified to the word type 'SEP'. In this way, the processing device removes the word type 'SEP' from the lexical tree to obtain a simplified lexical tree.

[0127] For another example, in the SHELL script lexical instruction: ls#comment. After obtaining its corresponding lexical tree, the processing device can set the type of word to be simplified to "#comment", i.e., comment, and then simplify the lexical tree according to the type of word to be simplified and the word type in the lexical tree.

[0128] In an embodiment of the present application, after simplifying the above-mentioned lexical tree, the above-mentioned processing device can also obtain a preset type of word to be segmented, and then, according to the type of word to be segmented and the word type in the above-mentioned lexical tree, determine the segmentation position in the above-mentioned simplified lexical tree, and then, based on the segmentation position, perform instruction segmentation on the above-mentioned simplified lexical tree to obtain one or more independent instructions, thereby facilitating subsequent instruction detection processing based on the one or more independent instructions to meet application needs.

[0129] Among them, the above-mentioned preset word types to be segmented can include instruction concatenation characters (such as &&, ||, ;, etc.) and pipes (such as |).

[0130] Here, after simplifying the above "Hello, World", the above processing device performs instruction segmentation on the simplified lexical tree, and can obtain two independent instructions, namely Hello and World. Similarly, after simplifying the above ls#comment, the above processing device performs instruction segmentation on the simplified lexical tree, and can obtain an independent instruction, namely ls.

[0131] S203: Perform command line semantic detection on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected.

[0132] Here, the above-mentioned processing device can determine a command line parsing rule, and then, based on the command line parsing rule, perform command line semantic detection processing on the above-mentioned one or more independent instructions to obtain common structured data, so that subsequent rule matching based on the structured data becomes simpler and clearer, thereby achieving accurate high-risk instruction detection.

[0133] The structured data may be JavaScript Object Notation (JSON) structured data.

[0134] S204: Determine whether to execute the instruction to be detected according to the preset structured filtering rules and the structured instruction.

[0135] In an embodiment of the present application, the above-mentioned processing device may match the above-mentioned structured instruction with a preset structured filtering rule. If the above-mentioned structured instruction does not match the above-mentioned preset structured filtering rule, the above-mentioned processing device may determine that the above-mentioned instruction to be detected is not a high-risk instruction, and may execute the above-mentioned instruction to be detected. If the above-mentioned structured instruction matches the above-mentioned preset structured filtering rule, the above-mentioned processing device may determine that the above-mentioned instruction to be detected is a high-risk instruction, intercept the above-mentioned instruction to be detected, and generate an interception prompt. If a continue execution instruction is received after the interception prompt is generated, the above-mentioned processing device may continue to execute the above-mentioned instruction to be detected according to the above-mentioned continue execution instruction.

[0136] Here, the processing device can accurately determine whether the instruction to be detected is a high-risk instruction by matching the structured instruction with the preset structured filtering rule. That is, if the structured instruction does not match the preset structured filtering rule, it means that the instruction to be detected is not a high-risk instruction. Otherwise, it means that the instruction to be detected is a high-risk instruction, which solves the problem that the existing instruction detection technology cannot accurately detect the meaning of the instruction in many cases, resulting in a high detection misjudgment rate. Moreover, when the structured instruction matches the preset structured filtering rule, that is, when the instruction to be detected is a high-risk instruction, the processing device will also generate a corresponding prompt to remind the user, and after receiving the continue execution instruction, continue to execute the instruction to be detected to meet the needs of actual applications.

[0137] In an embodiment of the present application, after obtaining the instruction to be detected, the processing device performs lexical analysis on the instruction to be detected to obtain its corresponding lexical tree, and the lexical tree includes the word type after the instruction to be detected is converted into a word, and then, according to the word type, the lexical tree is simplified to simplify irrelevant characters in the instruction, and the simplified lexical tree is segmented to obtain one or more independent instructions, thereby performing command line semantic detection on the one or more independent instructions to form common structured data, so that subsequent rule matching based on the structured data becomes simpler and clearer, and accurate instruction detection is achieved, which solves the problem that the existing instruction detection technology cannot accurately detect the meaning of the instruction in many cases, resulting in a high detection misjudgment rate.

[0138] In addition, when the processing device performs command line semantic detection processing on the one or more independent instructions to obtain the structured instructions corresponding to the instructions to be detected, it also considers establishing conditions based on the instructions to be detected and preset command line parsing rules to determine the target command line parsing rules, and then, based on the target command line parsing rules, performs command line semantic detection processing on the one or more independent instructions to obtain the structured instructions corresponding to the instructions to be detected, thereby determining whether to execute the instructions to be detected based on the preset structured filtering rules and the structured instructions, thereby achieving accurate instruction detection. Figure 4 This is a flow chart of another instruction detection method proposed in the embodiment of the present application. Figure 4 As shown, the method includes:

[0139] S401: Obtain an instruction to be detected, perform lexical analysis on the instruction to be detected, and obtain a lexical tree corresponding to the instruction to be detected. The lexical tree includes word types after the instruction to be detected is converted into words.

[0140] S402: Simplify the lexical tree according to the word types in the lexical tree, and perform instruction segmentation on the simplified lexical tree to obtain one or more independent instructions.

[0141] Among them, steps S401-S402 are implemented in the same way as the above steps S201-S202, and will not be repeated here.

[0142] S403: Establishing conditions according to the above-mentioned instructions to be detected and preset command line parsing rules, and determining target command line parsing rules.

[0143] The above-mentioned preset command line parsing rule establishment conditions include the content form of the command line parsing rule, as well as the setting requirements of the instruction name in the command line parsing rule, the setting requirements of the parameters, and the setting requirements of the structured values ​​corresponding to the parameters.

[0144] Here, the above-mentioned processing device can determine the above-mentioned target command line parsing rule based on the parameters of the above-mentioned command to be detected in the scenario to be intercepted, the content form of the above-mentioned command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured value corresponding to the parameters in the above-mentioned command line parsing rule.

[0145] Exemplarily, the above preset command line parsing rule establishment conditions may specifically include:

[0146] The content format of the command line parsing rules is: command name + 0-N parameters; parameter setting requirements include: setting fixed position and non-fixed position parameters (non-fixed position parameters are order-independent and need to use one or two hyphens as the starting identifier "-"; fixed parameters are used for the second parameter or the last parameter, and do not need to use a hyphen as the starting identifier); parameters support one or more short names and long names; parameters can be specified as non-repeatable and repeatable (the number of repetitions can be specified), etc.; instruction name setting requirements include: parameter names cannot be repeated (within the range of all short names and long names), etc.; parameter corresponding structured value setting requirements include: parameter values ​​can be storage type (store) or count type (count); storage type parameters need to provide values; count type parameters do not need to specify values, etc.

[0147] S404: Based on the target command line parsing rule, command line semantic detection is performed on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected.

[0148] Here, the target command line parsing rule may include a target instruction name, a target parameter, and a structured value corresponding to the target parameter.

[0149] The above-mentioned processing device can determine the target independent instruction corresponding to the instruction name that is the same as the above-mentioned target instruction name among the above-mentioned one or more independent instructions based on the above-mentioned target instruction name, and then, according to the above-mentioned target parameters and the structured values ​​corresponding to the above-mentioned target parameters, perform structured processing on the above-mentioned target independent instruction to obtain the structured instruction corresponding to the above-mentioned instruction to be detected.

[0150] Exemplarily, the above-mentioned processing device can extract the first lexical token as the instruction name, and perform name matching on the remaining lexical tokens according to the sequential parameters (short name and long name, fixed position parameters). After the matching is completed, for the matched independent instructions, if the parameter is a storage type parameter, the value is recorded; if the parameter is a counting type parameter, the number is recorded, that is, the above-mentioned independent instructions are structured to obtain the structured instructions corresponding to the above-mentioned instructions to be detected, such as obtaining the JSON structure data corresponding to the above-mentioned instructions to be detected.

[0151] For example, taking the rm command as an example, the operating system displays its usage as follows:

[0152]

[0153]

[0154] The above-mentioned processing device determines that the parameters of the rm instruction in the scenario to be intercepted are force&recursive parameters.

[0155] 1.#High-risk scenarios

[0156] 2.rm -rf / tmp

[0157] 3.rm -r --force / tmp

[0158] 4.rm-Rf / tmp

[0159] 5.rm --force --recursive / tmp

[0160] 6.rm '-rf' / tmp

[0161] 7.rm -r "--" force / tmp

[0162] 8.#Non-high-risk scenarios

[0163] 9.rm -rf --version / tmp

[0164] 10.rm -r –force --help / tmp

[0165] The processing device determines the target command line parsing rule according to the parameters in the scene to be intercepted and the preset command line parsing rule establishment conditions (the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured value corresponding to the parameters in the command line parsing rule), which can be:

[0166]

[0167]

[0168] Thus, the processing device can perform command line semantic detection processing on the one or more independent instructions based on the target command line parsing rule to obtain the structured instruction corresponding to the rm instruction: {"force":true,"recursive":true,"path":" / tmp"}

[0169] S405: Determine whether to execute the instruction to be detected according to the preset structured filtering rules and the structured instruction.

[0170] Here, the processing device matches the structured instruction with a preset structured filtering rule. If the match is inconsistent, it is determined that the instruction to be detected is not a high-risk instruction, and the instruction to be detected can be executed.

[0171] For example, taking the above rm instruction as an example, the above processing device can match the structured instruction with the preset structured filtering rule after obtaining the structured instruction corresponding to the above rm instruction. The preset structured filtering rule can be set according to the actual situation, for example, according to the structured value corresponding to the parameter of the above instruction to be detected in the interception scene. As described below, the structured filtering rule of the rm instruction set by the above processing device is:

[0172]

[0173] Among them, the structured filtering rule indicates that force is set, recursive is set, and help and version are both set, which is a high-risk command.

[0174] The processing device matches the structured instruction of the rm instruction with the structured filtering rule. If the match is inconsistent, it is determined that the rm instruction is not a high-risk instruction and the rm instruction can be executed. Otherwise, the processing device can determine that the rm instruction is a high-risk instruction, intercept the rm instruction, and generate an interception prompt. If a continue execution instruction is received after the interception prompt is generated, the processing device can continue to execute the rm instruction according to the continue execution instruction to achieve accurate instruction detection.

[0175] In an embodiment of the present application, when the processing device performs command line semantic detection processing on the one or more independent instructions to obtain the structured instructions corresponding to the instructions to be detected, it also considers establishing conditions based on the instructions to be detected and the preset command line parsing rules to determine the target command line parsing rules, and then, based on the target command line parsing rules, the one or more independent instructions are subjected to command line semantic detection processing to obtain the structured instructions corresponding to the instructions to be detected, thereby determining whether to execute the instructions to be detected based on the preset structured filtering rules and the structured instructions, and realizing accurate instruction detection. Moreover, after obtaining the instructions to be detected, the processing device performs lexical analysis on the instructions to be detected to obtain the corresponding lexical tree, which includes the word type after the instructions to be detected are converted into words, and then, according to the word type, simplifies the lexical tree to simplify irrelevant characters in the instructions, thereby improving the accuracy of subsequent instruction detection results.

[0176] Here, if Figure 5 As shown, Figure 5 A flowchart of another instruction detection method is provided for an embodiment of the present application. Figure 5 In the above-mentioned processing device, after obtaining the instruction to be detected, it can perform lexical analysis on the instruction to be detected to obtain the lexical tree corresponding to the instruction to be detected, and then perform instruction normalization based on the lexical tree, that is, simplify the lexical tree according to the word type in the lexical tree, and perform instruction segmentation on the simplified lexical tree to obtain one or more independent instructions, and then perform instruction structure based on the one or more independent instructions, that is, perform command line semantic detection on the one or more independent instructions to obtain the structured instructions corresponding to the instruction to be detected, and finally, perform rule matching on the structured instruction, and determine whether to execute the instruction to be detected according to the preset structured filtering rules and the structured instructions. If the result of matching the structured instruction with the preset structured filtering rules is inconsistent, it means that the instruction to be detected is not a high-risk instruction, and the above-mentioned processing device can execute the instruction to be detected. If the result of matching the structured instruction with the preset structured filtering rules is consistent, it means that the instruction to be detected is a high-risk instruction, and the above-mentioned processing device can intercept the instruction to be detected and generate an interception prompt. If a continue execution instruction is received after the interception prompt is generated, the processing device may continue to execute the instruction to be detected according to the continue execution instruction, otherwise, re-execute the step of obtaining the instruction to be detected.

[0177] Among them, the above-mentioned processing device normalizes the instructions by combining lexical analysis, simplifies irrelevant characters in the instructions, and performs structured analysis of the instruction lines to form universal structured data, making rule matching simpler and clearer, thereby achieving accurate high-risk instruction detection.

[0178] Corresponding to the instruction detection method of the above embodiment, Figure 6 A schematic diagram of the structure of the instruction detection device provided in the embodiment of the present application. For the convenience of explanation, only the parts related to the embodiment of the present application are shown. Figure 6 A schematic diagram of the structure of an instruction detection device provided in an embodiment of the present application, the instruction detection device 60 includes: a lexical analysis module 601, an instruction normalization module 602, an instruction structuring module 603 and an instruction detection module 604. The instruction detection device here can be the above-mentioned processing device itself, or a chip or integrated circuit that implements the function of the processing device. It should be noted here that the division of the lexical analysis module, the instruction normalization module, the instruction structuring module and the instruction detection module is only a division of logical functions, and the two can be physically integrated or independent.

[0179] The lexical analysis module 601 is used to obtain the instruction to be detected, perform lexical analysis on the instruction to be detected, and obtain a lexical tree corresponding to the instruction to be detected, wherein the lexical tree includes the word type after the instruction to be detected is converted into a word.

[0180] The instruction normalization module 602 is used to simplify the lexical tree according to the word types in the lexical tree, and perform instruction segmentation on the simplified lexical tree to obtain one or more independent instructions.

[0181] The instruction structuring module 603 is used to perform command line semantic detection processing on the one or more independent instructions to obtain structured instructions corresponding to the instructions to be detected;

[0182] The instruction detection module 604 is used to determine whether to execute the instruction to be detected according to the preset structured filtering rules and the structured instruction.

[0183] In a possible design, the lexical analysis module 601 is specifically used for:

[0184] Determining the lexical structure of the instruction to be detected;

[0185] According to the lexical structure and preset lexical analysis rules, the instruction to be detected is subjected to lexical analysis to obtain a lexical analysis result;

[0186] According to the lexical analysis result, the lexical tree corresponding to the instruction to be detected is established.

[0187] In a possible implementation, the lexical analysis module 601 is specifically used to:

[0188] Preprocessing the lexical structure according to a preset lexical structure, wherein the preprocessing includes removing the lexical structure that is the same as the preset lexical structure;

[0189] The instruction to be detected is subjected to lexical analysis according to the preprocessed lexical structure and the preset lexical analysis rules.

[0190] In a possible implementation, the instruction normalization module 602 is specifically configured to:

[0191] Get the preset word type to be simplified;

[0192] The lexical tree is simplified according to the word type to be simplified and the word types in the lexical tree. The simplification includes removing the word type that is the same as the word type to be simplified in the lexical tree.

[0193] In a possible implementation, the instruction normalization module 602 is specifically configured to:

[0194] Get the preset word type to be segmented;

[0195] Determining a segmentation position in the simplified lexical tree according to the type of the word to be segmented and the type of the word in the lexical tree;

[0196] Based on the segmentation position, the simplified lexical tree is segmented into instructions to obtain the one or more independent instructions.

[0197] In a possible implementation, the instruction structuring module 603 is specifically used to:

[0198] Establishing conditions based on the to-be-detected instruction and preset command line parsing rules, and determining a target command line parsing rule;

[0199] Based on the target command line parsing rule, command line semantic detection processing is performed on the one or more independent instructions to obtain the structured instruction corresponding to the instruction to be detected.

[0200] In a possible implementation, the target command line parsing rule includes a target instruction name, a target parameter, and a structured value corresponding to the target parameter.

[0201] The instruction structuring module 603 is specifically used for:

[0202] Based on the target instruction name, determining, among the one or more independent instructions, a target independent instruction corresponding to an instruction name identical to the target instruction name;

[0203] According to the target parameter and the structured value corresponding to the target parameter, the target independent instruction is structured to obtain the structured instruction corresponding to the instruction to be detected.

[0204] In a possible implementation, the preset command line parsing rule establishment condition includes the content form of the command line parsing rule, and setting requirements for instruction names, parameters, and structured values ​​corresponding to the parameters in the command line parsing rule.

[0205] The instruction structuring module 603 is specifically used for:

[0206] Determining parameters of the instruction to be detected in the scene to be intercepted;

[0207] The target command line parsing rule is determined according to the parameters in the scenario to be intercepted, the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured values ​​corresponding to the parameters in the command line parsing rule.

[0208] In a possible implementation, the instruction detection module 604 is specifically configured to:

[0209] Matching the structured instruction with a preset structured filtering rule;

[0210] If the structured instruction does not match the preset structured filtering rule, it is determined to execute the instruction to be detected.

[0211] In a possible implementation, the instruction detection module 604 is specifically configured to:

[0212] If the structured instruction matches the preset structured filtering rule, the instruction to be detected is intercepted and an interception prompt is generated;

[0213] If a continue execution instruction is received after the interception prompt is generated, the instruction to be detected is continued to be executed according to the continue execution instruction.

[0214] The device provided in the embodiment of the present application can be used to execute the technical solution of the above-mentioned method embodiment. Its implementation principle and technical effect are similar, and the embodiment of the present application will not be repeated here.

[0215] Optionally, Figure 7 A possible structural diagram of the instruction detection device described in the present application is schematically provided.

[0216] See also Figure 7 The instruction detection device 700 includes at least one processor 701 and a communication interface 703. Optionally, it may also include a memory 702 and a bus 704.

[0217] The instruction detection device 700 may be the above-mentioned processing device, and the present application does not impose any particular limitation on this. In the instruction detection device 700, the number of processors 701 may be one or more. Figure 7 Only one of the processors 701 is illustrated. Optionally, the processor 701 may be a central processing unit (CPU), a graphics processing unit (GPU) or a digital signal processing (DSP). If the instruction detection device 700 has multiple processors 701, the types of the multiple processors 701 may be different or the same. Optionally, the multiple processors 701 of the instruction detection device 700 may also be integrated into a multi-core processor.

[0218] The memory 702 stores computer instructions and data; the memory 702 may store computer instructions and data required to implement the above instruction detection method provided in the present application, for example, the memory 702 stores instructions for implementing the steps of the above instruction detection method. The memory 702 may be any one or any combination of the following storage media: non-volatile memory (e.g., read-only memory (ROM), solid-state drive (SSD), hard disk (HDD), optical disk), volatile memory.

[0219] The communication interface 703 can provide information input / output for the at least one processor, and can also include any one or any combination of the following devices: a network interface (eg, an Ethernet interface), a wireless network card, and other devices with network access functions.

[0220] Optionally, the communication interface 703 may also be used to instruct the detection device 700 to perform data communication with other computing devices or terminals.

[0221] Further optional, Figure 7 A thick line represents bus 704. Bus 704 can connect processor 701 with memory 702 and communication interface 703. Thus, through bus 704, processor 701 can access memory 702, and can also use communication interface 703 to exchange data with other computing devices or terminals.

[0222] In the present application, the instruction detection device 700 executes the computer instructions in the memory 702, so that the instruction detection device 700 implements the above-mentioned instruction detection method provided in the present application, or the instruction detection device 700 deploys the above-mentioned instruction detection device.

[0223] From the perspective of logical function division, for example, Figure 7 As shown, the memory 702 may include a lexical analysis module 601, an instruction normalization module 602, an instruction structuring module 603, and an instruction detection module 604. The inclusion here only refers to the fact that when the instructions stored in the memory are executed, the functions of the lexical analysis module, the instruction normalization module, the instruction structuring module, and the instruction detection module can be realized respectively, without limiting the physical structure.

[0224] In addition, the above instruction detection device can also be used as described above Figure 7 In addition to being implemented through software, it can also be implemented through hardware as a hardware module or as a circuit unit.

[0225] The present application provides a computer-readable storage medium, wherein the computer program product includes computer instructions, and the computer instructions instruct a computing device to execute the above instruction detection method provided by the present application.

[0226] The present application provides a computer program product, including computer instructions, wherein the computer instructions are executed by a processor to implement the above instruction detection method provided in the present application.

[0227] The present application provides a chip, comprising at least one processor and a communication interface, wherein the communication interface provides information input and / or output for the at least one processor. Further, the chip may also include at least one memory, wherein the memory is used to store computer instructions. The at least one processor is used to call and run the computer instructions to execute the above-mentioned instruction detection method provided by the present application.

[0228] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0229] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0230] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

Claims

1. A command detection method, characterized in that: include: Acquire an instruction to be detected, perform lexical analysis on the instruction to be detected, and obtain a lexical tree corresponding to the instruction to be detected, wherein the lexical tree includes a word type after the instruction to be detected is converted into a word; Simplifying the lexical tree according to the word types in the lexical tree; Specifically, it includes: obtaining a preset word type to be simplified; performing a simplification process on the lexical tree according to the word type to be simplified and the word type in the lexical tree, wherein the simplification process includes removing the word type that is the same as the word type to be simplified in the lexical tree; The simplified lexical tree is segmented into instructions to obtain one or more independent instructions; Based on the target command line parsing rule, the one or more independent instructions are subjected to command line semantic detection processing to obtain the structured instruction corresponding to the instruction to be detected; wherein the target command line parsing rule includes a target instruction name, a target parameter, and a structured value corresponding to the target parameter; the command line semantic detection processing is performed on the one or more independent instructions based on the target command line parsing rule to obtain the structured instruction corresponding to the instruction to be detected, including: based on the target instruction name, determining the target independent instruction corresponding to the instruction name that is the same as the target instruction name in the one or more independent instructions; according to the target parameter and the structured value corresponding to the target parameter, the target independent instruction is subjected to structured processing to obtain the structured instruction corresponding to the instruction to be detected; Determine whether to execute the instruction to be detected according to the preset structured filtering rule and the structured instruction.

2. The method according to claim 1, characterized in that The step of performing lexical analysis on the instruction to be detected to obtain a lexical tree corresponding to the instruction to be detected includes: Determining the lexical structure of the instruction to be detected; According to the lexical structure and preset lexical analysis rules, the instruction to be detected is subjected to lexical analysis to obtain a lexical analysis result; According to the lexical analysis result, the lexical tree corresponding to the instruction to be detected is established.

3. The method according to claim 2, characterized in that Before performing lexical analysis on the instruction to be detected according to the lexical structure and the preset lexical analysis rules, the method further includes: Preprocessing the lexical structure according to a preset lexical structure, wherein the preprocessing includes removing the lexical structure that is the same as the preset lexical structure; The step of performing lexical analysis on the instruction to be detected according to the lexical structure and preset lexical analysis rules includes: The instruction to be detected is subjected to lexical analysis according to the preprocessed lexical structure and the preset lexical analysis rules.

4. The method according to any one of claims 1 to 3, characterized in that The simplified lexical tree is segmented into instructions to obtain one or more independent instructions, including: Get the preset word type to be segmented; Determining a segmentation position in the simplified lexical tree according to the type of the word to be segmented and the type of the word in the lexical tree; Based on the segmentation position, the simplified lexical tree is segmented into instructions to obtain the one or more independent instructions.

5. The method according to any one of claims 1 to 3, characterized in that The step of performing command line semantic detection processing on the one or more independent instructions based on the target command line parsing rule to obtain a structured instruction corresponding to the instruction to be detected includes: establishing conditions according to the instruction to be detected and a preset command line parsing rule to determine the target command line parsing rule; The preset command line parsing rule establishment conditions include the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters in the command line parsing rule, and the setting requirements of the structured values ​​corresponding to the parameters; The step of establishing a condition based on the instruction to be detected and a preset command line parsing rule to determine a target command line parsing rule includes: Determining parameters of the instruction to be detected in the scene to be intercepted; The target command line parsing rule is determined according to the parameters in the scenario to be intercepted, the content form of the command line parsing rule, and the setting requirements of the instruction name, the setting requirements of the parameters, and the setting requirements of the structured values ​​corresponding to the parameters in the command line parsing rule.

6. The method according to any one of claims 1 to 3, characterized in that The step of determining whether to execute the instruction to be detected according to the preset structured filtering rule and the structured instruction includes: Matching the structured instruction with a preset structured filtering rule; If the structured instruction does not match the preset structured filtering rule, it is determined to execute the instruction to be detected.

7. The method according to claim 6, characterized in that After matching the structured instruction with the preset structured filtering rule, the method further includes: If the structured instruction matches the preset structured filtering rule, the instruction to be detected is intercepted and an interception prompt is generated; If a continue execution instruction is received after the interception prompt is generated, the instruction to be detected is continued to be executed according to the continue execution instruction.

8. A command detection device, characterized in that: include: A lexical analysis module, used for acquiring an instruction to be detected, performing lexical analysis on the instruction to be detected, and obtaining a lexical tree corresponding to the instruction to be detected, wherein the lexical tree includes a word type after the instruction to be detected is converted into a word; An instruction normalization module, used for simplifying the lexical tree according to the word types in the lexical tree, and performing instruction segmentation on the simplified lexical tree to obtain one or more independent instructions; Specifically used to obtain the preset type of words to be simplified; According to the word type to be simplified and the word type in the lexical tree, the lexical tree is simplified, wherein the simplification process includes removing the word type that is the same as the word type to be simplified in the lexical tree; An instruction structuring module is used to perform command line semantic detection processing on the one or more independent instructions based on a target command line parsing rule to obtain a structured instruction corresponding to the instruction to be detected; wherein the target command line parsing rule includes a target instruction name, a target parameter, and a structured value corresponding to the target parameter; the instruction structuring module is specifically used to determine, based on the target instruction name, a target independent instruction corresponding to an instruction name identical to the target instruction name in the one or more independent instructions; and perform structured processing on the target independent instruction according to the target parameter and the structured value corresponding to the target parameter to obtain the structured instruction corresponding to the instruction to be detected; The instruction detection module is used to determine whether to execute the instruction to be detected according to a preset structured filtering rule and the structured instruction.

Images