WebShell detection methods, electronic devices, and computer-readable storage media

Abstract

This application relates to a WebShell detection method, electronic device, and computer-readable storage medium. The method includes: acquiring traffic data interacting with a file to be detected, the traffic data including a sequence of data packets; extracting the payload of each data packet in the data packet sequence and converting it into tensor data to obtain a tensor data sequence; using a trained convolutional neural network to extract spatial features of each tensor data in the tensor data sequence to obtain a first output feature map sequence characterizing the spatial features of each data packet; using a trained long short-term memory network's feature extraction kernel to extract temporal features from the first output feature map sequence to obtain a second output feature map characterizing the spatiotemporal features of the traffic data; and determining a first detection result of the traffic data based on the second output feature map, the first detection result being used to characterize whether the file to be detected is a WebShell. This application improves the detection rate of WebShells.

Description

Technical Field

[0001] This application relates to the field of information security, and in particular to a WebShell detection method, electronic device, and computer-readable storage medium. Background Technology

[0002] WebShells are typically implanted into a website server beforehand through website vulnerabilities. Remote hosts access the WebShell code implanted in the web server via a web interface. They are primarily used for website management and hacking.

[0003] WebShell source files primarily use programming languages ​​such as PHP, ASP, and JSP, and interact with remote hosts through ports such as 80 or 8080. The malicious HTTP data exchanged is mixed in with normal HTTP data, making it difficult to distinguish. Therefore, once an attacker successfully implants a WebShell source file into a server, they can gain access to the WebShell code through a browser, thereby gaining control of the server and stealing important data. Simply put, it's executable code used to gain specific privileges. Once granted access, attackers can often directly perform brute-force data deletion, steal user data, and extort cryptocurrency from victims, causing immense harm.

[0004] Traditional WebShell detection methods mainly suffer from the following problems:

[0005] 1. Low detection rate; it cannot effectively detect WebShell files, especially encrypted or obfuscated WebShell files.

[0006] 2. The detection methods are limited. Traditional detection methods often focus solely on files or traffic, which cannot provide comprehensive protection.

[0007] 3. It can only identify known WebShell files. Traditional rule matching often requires manual maintenance and can only identify the characteristics of WebShell files that are already in the rule base. It often misses cases for WebShell files with unknown characteristics. Summary of the Invention

[0008] This application provides a WebShell detection method, electronic device, and computer-readable storage medium to address the problem that WebShell detection methods in related technologies are prone to missing detections.

[0009] Firstly, this embodiment provides a WebShell detection method, including:

[0010] Acquire traffic data that interacts with the file to be detected, the traffic data including data packet sequences;

[0011] Extract the payload of each data packet in the data packet sequence and convert it into tensor data to obtain a tensor data sequence;

[0012] The spatial features of each tensor data in the tensor data sequence are extracted using a trained convolutional neural network to obtain a first output feature map sequence that characterizes the spatial features of each data packet.

[0013] The temporal features of the first output feature map sequence are extracted using the feature extraction kernel of a trained long short-term memory network to obtain a second output feature map that characterizes the spatiotemporal features of the traffic data.

[0014] Based on the second output feature map, a first detection result of the traffic data is determined, and the first detection result is used to characterize whether the file to be detected is a WebShell.

[0015] In some embodiments, a trained convolutional neural network is used to extract spatial features of each tensor data in the tensor data sequence to obtain a first output feature map sequence for characterizing the spatial features of each data packet, including:

[0016] The spatial features of each tensor data in the tensor data sequence are extracted using a trained convolutional neural network to obtain a third output feature map sequence.

[0017] The feature dimensions of each third output feature map in the third output feature map sequence are rearranged to obtain the first output feature map sequence, wherein the feature dimensions of each first output feature map in the first output feature map sequence are the same as the feature dimensions of the input feature maps of the trained long short-term memory network.

[0018] In some embodiments, extracting the payload of each data packet in the data packet sequence and converting it into tensor data to obtain a tensor data sequence includes:

[0019] For each data packet in the data packet sequence, the payload of the data packet is mapped to an eight-bit grayscale image with a preset width and height, and the eight-bit grayscale image is converted into two-dimensional tensor data, wherein each byte in the payload of the data packet is mapped to a pixel in the eight-bit grayscale image, and the grayscale value of the pixel is the value represented by the byte.

[0020] In some embodiments, the file to be detected is a PHP script; before acquiring traffic data, which includes packet sequences, the method further includes:

[0021] The PHP extension plugin VLD was used to extract the Opcode of the PHP script.

[0022] The Opcode is semantically detected using a first semantic detection model based on deep learning to obtain a second detection result for the PHP script, wherein the second detection result represents the first confidence level that the PHP script belongs to a WebShell;

[0023] When the first confidence level is less than the first preset value, the first detection result of the PHP script is obtained based on the traffic data.

[0024] In some embodiments, the method further includes:

[0025] If the first confidence level is not less than the first preset value, the PHP script is determined to be a WebShell.

[0026] In some embodiments, the method further includes:

[0027] Extract the static features of the source code of the file to be detected, and normalize the static features;

[0028] A second semantic detection model based on deep learning is used to perform source code semantic detection on normalized static features to obtain a third detection result of the file to be detected, wherein the third detection result represents the second confidence level that the file to be detected belongs to WebShell;

[0029] When the second confidence level is less than the second preset value, the first detection result of the file to be detected is obtained based on the traffic data, and / or the second detection result of the file to be detected is obtained based on the Opcode.

[0030] In some embodiments, the second semantic detection model includes a source code detection model based on Text CNN and a feature detection model based on a binary classification network; using the deep learning-based second semantic detection model to perform source code semantic detection on normalized static features, the third detection result of the file to be detected includes:

[0031] The source code detection model is used to perform semantic recognition on part or all of the source code of the file to be detected, and a fourth detection result is obtained.

[0032] The feature detection model is used to classify the normalized static features to obtain the fifth detection result.

[0033] The fourth and fifth detection results are combined to obtain the third detection result of the document to be detected.

[0034] In some embodiments, before extracting the static features of the source code of the file to be detected, the method further includes:

[0035] The source code of the file to be tested is cleaned to remove invalid characters.

[0036] Secondly, this embodiment also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps of the method described in the first aspect.

[0037] Thirdly, this embodiment also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0038] In summary, the WebShell detection method, electronic device, and computer-readable storage medium provided in this application embodiment solve the problem of easy false negatives in related technologies for WebShell detection methods and improve the detection rate of WebShell. Attached Figure Description

[0039] Figure 1 This is a flowchart of the WebShell detection method provided in this embodiment.

[0040] Figure 2 This is a schematic diagram of the structure of the WebShell detection model provided in this embodiment.

[0041] Figure 3 This is a flowchart of the multi-angle WebShell detection method provided in this embodiment.

[0042] Figure 4 This is a flowchart of the WebShell detection method based on Opcode provided in this embodiment.

[0043] Figure 5 This is a flowchart of the WebShell detection method based on static features of source code provided in this embodiment. Detailed Implementation

[0044] To better understand the purpose, technical solution, and advantages of this application, the application is described and illustrated below in conjunction with the accompanying drawings and embodiments.

[0045] To better understand the purpose, technical solutions, and advantages of this application, it has been described and illustrated below with reference to the accompanying drawings and embodiments. However, those skilled in the art should understand that this application can be implemented without these details. In some cases, to avoid obscuring various aspects of this application due to unnecessary description, well-known methods, processes, systems, components, and / or circuits already described at a higher level will not be elaborated upon. It will be apparent to those skilled in the art that various modifications can be made to the embodiments disclosed in this application, and the general principles defined in this application can be applied to other embodiments and application scenarios without departing from the principles and scope of this application. Therefore, this application is not limited to the illustrated embodiments, but conforms to the broadest scope consistent with the scope of protection claimed in this application.

[0046] Unless otherwise defined, the technical or scientific terms used in this application should have the general meaning understood by one of ordinary skill in the art to which this application pertains. The terminology used in this application is for the purpose of describing specific embodiments only and is not intended to limit the application. Words such as “a,” “an,” “an,” “the,” “the,” and “these,” as used in this application, do not indicate quantitative limitations and can be singular or plural. The terms “comprising,” “including,” “having,” and any variations thereof used in this application are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or device that includes a series of steps or modules (units) is not limited to the listed steps or modules (units) but may include steps or modules (units) not listed, or may include other steps or modules (units) inherent to these processes, methods, products, or devices.

[0047] In this application, "multiple" refers to two or more. Typically, the character " / " indicates that the objects before and after it are in an "or" relationship. The terms "first," "second," "third," etc., used in this application are merely for distinguishing similar objects and do not represent a specific order of the objects.

[0048] The terms "system," "engine," "unit," "module," and / or "block" used in this application are a method of distinguishing different components, elements, parts, components, assemblies, or functions at different levels. These terms may be replaced by other expressions that achieve the same purpose. Generally, "module," "unit," or "block" as used in this application refers to a collection of logical or software instructions embodied in hardware or firmware. The "modules," "units," or "blocks" described in this application can be implemented as software and / or hardware, and in the case of a software implementation, they can be stored in any type of non-volatile computer-readable storage medium or storage device.

[0049] In some embodiments, software modules / units / blocks may be compiled and linked into an executable program. It will be appreciated that software modules may be invoked from other modules / units / blocks or from themselves, and / or may be invoked in response to a detected event or interrupt. Software modules / units / blocks configured to execute on a computing device may be located on a computer-readable storage medium, such as an optical disc, digital video disc, flash drive, magnetic disk, or any other tangible media, or as a digital download (and may be initially stored in a compressed or installable format that requires installation, decompression, or decryption prior to execution). Such software code may be stored, partially or wholly, on the storage device of the executing computing device and applied to the operation of the computing device. Software instructions may be embedded in firmware, such as an EPROM. It will also be appreciated that hardware modules / units / blocks may be included in connected logical components, such as gates and flip-flops, and / or may be included in programmable units, such as programmable gate arrays or processors. The modules / units / blocks or computing device functions described herein may be implemented as software modules / units / blocks, and may also be represented in hardware or firmware. Typically, the modules / units / blocks described in this document can be combined with other modules / units / blocks, or, although they are physically organized or stored, can be divided into sub-modules / sub-units / sub-blocks. This description can apply to a system, an engine, or a part thereof.

[0050] It will be understood that when a unit, engine, module, or block is referred to as being "on," "connected," or "coupled to" another unit, engine, module, or block, it may be directly on, connected to, coupled to, or communicate with the other unit, engine, module, or block, or there may be an intermediate unit, engine, module, or block, unless the context clearly indicates otherwise. In this application, the term "and / or" may include any one or more of the relevant listed items or a combination thereof.

[0051] This embodiment provides a WebShell detection method. Figure 1 This is a flowchart of the WebShell detection method provided in this embodiment, as follows: Figure 1 As shown, the process includes the following steps:

[0052] Step S101: Obtain traffic data that interacts with the file to be detected. The traffic data includes a sequence of data packets.

[0053] Step S102: Extract the payload of each data packet in the data packet sequence and convert it into tensor data to obtain a tensor data sequence.

[0054] Step S103: Use a trained convolutional neural network to extract the spatial features of each tensor data in the tensor data sequence to obtain the first output feature map sequence used to characterize the spatial features of each data packet.

[0055] Step S104: Use the feature extraction kernel of the trained long short-term memory network to extract the temporal features of the first output feature map sequence to obtain the second output feature map used to characterize the spatiotemporal features of the traffic data.

[0056] Step S105: Based on the second output feature map, determine the first detection result of the traffic data. The first detection result is used to characterize whether the file to be detected is a WebShell.

[0057] Traffic data consists of data packets in chronological order. The content and transmission order of the data packets together constitute the characteristic information of the traffic data. In this embodiment, the features related to the content of the data packets are referred to as spatial features; the features related to the transmission order of the data packets are referred to as temporal features. Together, they constitute the spatiotemporal characteristics of the traffic data. This embodiment classifies the files to be detected that generate the traffic data based on the spatiotemporal characteristics of the traffic data to determine the probability (or confidence level) that the detected file is a WebShell.

[0058] In this embodiment, the traffic data of the file interaction to be detected may include sent data packets generated by the file to be detected, or received data packets sent to the file to be detected. Typically, after a WebShell is implanted into a web server, an intruder usually needs to send multiple commands to the WebShell to complete the intrusion operation, such as first checking the WebShell's liveness, collecting relevant information about the compromised web server through the WebShell, and then executing specific intrusion operations. Therefore, it is feasible to detect the WebShell based solely on either the sent or received data packets of the file to be detected. However, in a preferred embodiment, WebShell detection is performed based on both the sent and received data packets of the WebShell to fully utilize the time characteristics between the sent and received data packets and improve the WebShell detection rate.

[0059] As for the interception and capture of traffic data, any existing methods in the relevant technologies can be used, and no limitation is made here. For example, in a web server system using reverse proxy technology, traffic data from various web servers can be intercepted and captured on the reverse proxy server, and traffic data interacting with a certain file to be detected can be filtered out based on the relevant tag information in the data packets.

[0060] To obtain the spatial features of traffic data, this embodiment employs a convolutional neural network to extract these features. Specifically, it extracts the spatial features of each data packet within the temporally ordered sequence of data packets carried by the traffic data. Typically, data packets are stored in the PCAP (Programmatic Computational Packet Access) file format. Each PCAP file includes a header and multiple data packets following the header. Each data packet includes a header and a payload, and may also include a checksum. The header and packet headers of the PCAP file typically carry information useful for parsing the PCAP file or data packets, such as timestamps, MAC addresses, and IP addresses. This information allows us to determine the temporal order of each data packet and the object each packet interacts with; that is, based on the header and packet headers of the PCAP file, we can determine whether a particular data packet belongs to the file to be checked.

[0061] However, apart from timestamps, the information in file and packet headers is usually irrelevant to the behavior of the file being detected. Therefore, during WebShell detection, after obtaining the sequence of packets in the traffic data interacting with the file based on timestamps, the irrelevant information in the file and packet headers is considered noise when performing subsequent WebShell detection based on spatiotemporal features. This noise can be removed through data cleaning techniques. For example, all file and packet headers can be removed, or the physical layer MAC address and network layer IP address can be removed from the file and packet headers, leaving only the payload.

[0062] Data packets are represented and stored in binary form, which allows them to be easily converted into tensor data that can be processed by convolutional neural networks. However, directly using binary data packets as tensor data has two drawbacks: firstly, its dimension is only one-dimensional, resulting in a large data volume; secondly, because behavioral features are sparsely distributed in binary data, training convolutional neural networks using binary data directly leads to slow convergence. Therefore, in this embodiment, the payload of the data packet is converted into an eight-bit grayscale image, and then two-dimensional tensor data is obtained based on the eight-bit grayscale image, thereby achieving dimensionality enhancement of the data packet payload data and visualizing its behavioral features.

[0063] The payload of a data packet can be represented in hexadecimal form. For example, hexadecimal FF represents decimal 255. Eight bits of binary data can represent any value from 0 to 255 in decimal. Therefore, in the payload of a hexadecimal data packet, each two bits of hexadecimal data (i.e., one byte) can represent a grayscale value (i.e., a pixel value) in an eight-bit grayscale image. Thus, each byte in the payload of a data packet can be mapped to a pixel in an eight-bit grayscale image, and the grayscale value of that pixel is the value represented by that byte.

[0064] In traffic data, the payload length of each data packet may differ. In this embodiment, at least two methods can be used to process the payload to generate an 8-bit grayscale image with a preset length and width. One method is to truncate or pad all payloads to the same length, and then convert them into 8-bit grayscale images of the same size. The padding can be uniformly filled with 0, 255, or any other identical value. Another method is to truncate all excessively long payloads into two parts and generate two 8-bit grayscale images of the same size in sequence. Excessively short data packets or excessively short portions obtained after truncation are also filled using the same padding method.

[0065] The aforementioned eight-bit grayscale image is preferably a rectangular image, meaning that the number of pixels is the same in both the length and width directions, such as a 32-pixel × 32-pixel eight-bit grayscale image or a 64-pixel × 64-pixel eight-bit grayscale image. The specific size of the eight-bit grayscale image can be determined based on statistical results of the effective payload length of the data packet, aiming to retain as much data related to the original payload as possible in each eight-bit grayscale image while minimizing the proportion of padding data, thereby improving the efficiency and detection rate of the convolutional neural network's training or recognition.

[0066] Convolutional neural networks have advantages in processing image data. In step S103 of this embodiment, a trained convolutional neural network is used to extract the spatial features of each tensor data in the tensor data sequence, thereby obtaining a first output feature map sequence used to characterize the spatial features of each data packet, with each tensor data corresponding to one first output feature map.

[0067] Since Long Short-Term Memory (LSTM) networks are used to extract the temporal features of traffic data in step S103, and the feature dimension (length) of the LSTM input feature map is determined by the number of neurons in each hidden layer of the LSTM, taking 160 neurons in each hidden layer as an example, the length of the LSTM input feature map should be 160. When the feature dimension of the output feature map (i.e., the third output feature map) of the spatial features of each tensor data extracted by the convolutional neural network is different from the feature dimension of the LSTM input feature map, the feature dimension of the third output feature map can be rearranged so that the feature dimension of the rearranged first output feature map is the same as the feature dimension of the LSTM input feature map.

[0068] For example, when the third output feature map is 1×1600, when using an LSTM with 160 neurons per hidden layer to extract time features, the third output feature map can be rearranged into a 10×160 input feature map.

[0069] Figure 2 This is a schematic diagram of the structure of the WebShell detection model provided in this embodiment, as shown below. Figure 2 As shown, the WebShell detection model mainly consists of two parts: a Convolutional Neural Network (CNN) for extracting spatial features and a Long Short-Term Memory (LSTM) network for extracting temporal features. The input feature map of the CNN is a single-channel grayscale image with a size of 40×40. After two convolution and pooling operations, it is processed by a fully connected layer to obtain a 1×1600 output feature map. The 1×1600 output feature map is reshaped and then used as the input feature map of the LSTM. It is then processed by an LSTM with two hidden layers, each with 160 neurons, to finally obtain a second output feature map representing the spatiotemporal features of the traffic data. The second output feature map is processed by a classifier to obtain the first detection result of the traffic data. This first detection result includes the confidence that the file to be detected is a WebShell. When the confidence is higher than a set value, the file to be detected can be considered a WebShell.

[0070] The aforementioned WebShell detection model is jointly trained using supervised learning. Positive samples are obtained by setting up an HTTP website and then using WebShells such as IceScorpion to perform upload, usage, and deletion actions to generate traffic, which is then captured using traffic capture methods such as Wireshark. Negative samples are obtained by capturing normal web traffic.

[0071] By using the above method, the spatiotemporal features related to the behavior of the file to be detected are obtained based on traffic data, thereby obtaining the detection result of whether the file to be detected belongs to WebShell. Compared with traditional detection methods based on static features or other spatial features, this method not only improves the detection rate of WebShell, but also fundamentally prevents problems such as the failure of spatial feature-based detection methods caused by code obfuscation.

[0072] WebShell detection methods based on traffic data require the collection of a certain amount of traffic data before detection results can be obtained. In order to detect possible WebShells more quickly and avoid losses as much as possible, a detection method based on spatial features can be used to detect the WebShells that can be identified. For WebShells that cannot be identified by the spatial feature-based detection method, the aforementioned WebShell detection method based on traffic data can be used for detection.

[0073] These spatial feature-based detection methods include, but are not limited to, at least one of the following: WebShell detection methods based on Opcode and WebShell detection methods based on static features of source code. Figure 3 This is a flowchart of the multi-angle WebShell detection method provided in this embodiment, such as... Figure 3 As shown, the process includes the following steps:

[0074] Step S301, Begin.

[0075] Step S302: Perform WebShell detection on the file to be detected based on the static features of the source code.

[0076] Step S303: If the detection result indicates that the confidence level of the file to be detected as a WebShell is greater than the set value, then proceed to step S309; ​​otherwise, proceed to step S304.

[0077] Step S304: Perform WebShell detection on the file to be detected based on the Opcode.

[0078] Step S305: If the detection result indicates that the confidence level of the file to be detected as a WebShell is greater than the set value, then proceed to step S309; ​​otherwise, proceed to step S306.

[0079] Step S306: Execute the WebShell detection method based on traffic data as shown in steps S101 to S105.

[0080] Step S307: If the detection result indicates that the confidence level of the file to be detected as a WebShell is less than the set value, then proceed to step S308; otherwise, proceed to step S309.

[0081] Step S308: Determine that the file to be detected is not a WebShell, and end the detection.

[0082] Step S309: Determine that the file to be detected is a WebShell, and end the detection.

[0083] It should be noted that, although in Figure 3 The example demonstrates performing WebShell detection on the file to be tested first using static features based on the source code, and then performing WebShell detection on the file to be tested using opcode. However, this application does not restrict the order of the two detections. For example, the file to be tested can be detected first using WebShell based on opcode, and then using WebShell detection based on static features based on the source code. Alternatively, both spatial feature-based WebShell detection methods can be performed simultaneously, and then the results can be used to determine whether to perform WebShell detection based on traffic data.

[0084] In addition, the confidence levels of the various detection methods mentioned above can be set to the same value, or they can be set separately based on the characteristics of different detection models. Furthermore, these confidence levels can be set to larger or smaller values ​​compared to a conventional single WebShell detection model, thereby optimizing the overall stability or false alarm rate of the solution.

[0085] For example, WebShell detection methods based on static features of source code have relatively poor stability. When using a single model, the confidence level is usually set relatively low, such as 0.6, to reduce the false negative rate. While a confidence level of 0.6 reduces the false negative rate, it can also lead to legitimate files being falsely flagged as WebShells. However, when using a multi-faceted WebShell detection approach, the confidence level in the static feature-based method can be set to a value greater than 0.6, thereby reducing false positives.

[0086] For example, the Opcode-based WebShell detection method is relatively stable. When using a single model, the confidence level is usually set relatively high, such as 0.8, to avoid false positives for normal files. While a confidence level of 0.8 prevents false positives for normal files, the false negative rate for WebShells is still significant. When employing a multi-faceted WebShell detection approach, since WebShell detection based on traffic data is performed after Opcode-based detection, the confidence level in the Opcode-based WebShell detection method can be set to a value less than 0.8.

[0087] Figure 4 This is a flowchart of the WebShell detection method based on Opcode provided in this embodiment. The file to be detected is a PHP script. Figure 4 As shown, the process includes the following steps:

[0088] Step S401: Use the PHP extension plugin VLD to extract the Opcode of the PHP script.

[0089] Step S402: Use a first semantic detection model based on deep learning to perform semantic detection on the Opcode to obtain a second detection result for the PHP script, wherein the second detection result represents the first confidence level that the PHP script belongs to the WebShell.

[0090] Step S403: When the first confidence level is less than the first preset value, obtain the first detection result of the PHP script based on the WebShell detection method shown in steps S101 to S105.

[0091] In some embodiments, a PHP script is identified as a WebShell if the first confidence level is not less than a first preset value. This method enables rapid identification of some WebShells, reducing the risk of web server corruption.

[0092] The aforementioned first semantic detection model based on deep learning can be a detection model based on TextCNN. The training of the TextCNN model includes the following steps: data preparation, VLD extension plugin installation, Opcode extraction, model building, and model optimization, which are described below.

[0093] Step 1: Data preparation.

[0094] In this embodiment, the training samples include positive samples from WebShell collection projects on GitHub and well-known open-source CMS systems, including 10 large-scale and well-known WebShell open-source projects such as php-WebShell, which collected a total of 6328 PHP WebShell files. Negative samples were collected from 6 open-source projects such as php-begin, which collected a total of 7512 normal PHP files. The positive and negative samples have a strong balance, which overcomes the problem of drifting to large sample test cases during training.

[0095] Step 2: Install Vld extension plugins.

[0096] First, download and install the PHP language environment, and then download and install the Vld extension plugin to your local system. Then, execute system commands using the program.

[0097] php-dvld.active=1-dvld.execute=0 filename.php

[0098] Use regular expressions to obtain the Opcode data for each PHP file.

[0099] Step 3: TextCNN model construction.

[0100] Keras was used as the deep learning framework, TextCNN was used as the model network, word window sizes of 3, 4, and 5 were used, WordEmbedding was used for word vector embedding with a dimension of 30, and binary cross-entropy was used as the loss function. The input was the first 1000 Opcode sequences, and the output was the probability of identifying WebShell files.

[0101] Step 4: Model optimization.

[0102] Based on the established network model structure, supervised learning is used to train the data. The Keras deep learning model optimization framework is then used to train the network model to obtain the first semantic detection model.

[0103] Figure 5 This is a flowchart of the WebShell detection method based on static features of source code provided in this embodiment, as follows: Figure 5 As shown, the process includes the following steps:

[0104] Step S501: Extract the static features of the source code of the file to be detected, and normalize the static features.

[0105] Step S502: Use a second semantic detection model based on deep learning to perform source code semantic detection on the normalized static features to obtain the third detection result of the file to be detected. The third detection result represents the second confidence level of the file to be detected belonging to WebShell.

[0106] In step S503, when the second confidence level is less than the second preset value, the first detection result of the PHP script is obtained based on the WebShell detection method shown in steps S101 to S105, and / or the first detection result or the second detection result of the PHP script is obtained based on the WebShell detection method shown in steps S401 to S403.

[0107] In some embodiments, the file to be detected is determined to be a WebShell if the second confidence level is not less than a second preset value. This method enables rapid identification of some WebShells, reducing the risk of web server corruption.

[0108] In some embodiments, the second semantic detection model includes a source code detection model based on Text CNN and a feature detection model based on a binary classification network. Step S502 above includes the following steps:

[0109] Step S502-1: Use the source code detection model to perform semantic recognition on part or all of the source code of the file to be detected, and obtain the fourth detection result.

[0110] Step S502-2: Use the feature detection model to classify the normalized static features and obtain the fifth detection result.

[0111] Step S502-3: Combine the fourth and fifth detection results to obtain the third detection result of the document to be detected.

[0112] By employing a second semantic detection model composed of a source code detection model based on Text CNN and a feature detection model based on a binary classification network, the classification features of the second semantic detection model are obtained based on the semantic features of the source code and the normalized static features of the source code, thereby improving the discrimination ability of the second semantic detection model.

[0113] In steps S502-3 above, the fourth and fifth detection results can both be normalized classification feature maps. The merging of classification feature maps is also called feature fusion. The fusion method can be the concat method or the add method, which is not limited in this embodiment.

[0114] In some embodiments, when the training samples used to train the second semantic detection model have undergone code cleaning, the source code of the file to be detected can also be cleaned before step S501 to remove invalid characters and reduce noise interference. Code cleaning can reduce noise interference in static features and improve the discriminative ability of the second semantic detection model.

[0115] The training of the aforementioned deep learning-based second semantic detection model includes steps such as data preparation, data cleaning and data feature extraction, model construction, and model optimization, which are described below.

[0116] Step 1: Data preparation.

[0117] In this embodiment, the positive sample data comes from WebShell collection projects on GitHub and well-known open-source CMS systems, including 10 large-scale and well-known WebShell open-source projects such as php-WebShell, collecting a total of 6328 PHP WebShell files; the negative samples are collected from 6 open-source projects such as php-begin, collecting a total of 7512 normal PHP files. The positive and negative samples have a strong balance, overcoming the problem of drifting to large sample test cases during training.

[0118] Step 2: Data cleaning and data feature extraction.

[0119] Data cleaning removes invalid characters such as comments from the dataset files. Features such as file length and file entropy (file complexity) are extracted and normalized, mapping the range to [-1, 1]. The dataset files are then labeled and randomly shuffled.

[0120] Step 3: Model building.

[0121] A binary classification network is built using TextCNN as the main network and extracting file features strongly correlated with WebShell, such as file length and file entropy. The two networks are combined as a preliminary file detection model. The TextCNN model takes the first 1337 cleaned source code words as input and outputs the probability of identifying a file as a WebShell. The binary classification network takes normalized file length and file entropy features as input and outputs the probability of identifying a WebShell file. The outputs of the two models are then combined to obtain the final WebShell recognition probability.

[0122] Step 4: Model optimization.

[0123] Based on the established network model structure, data training is performed using supervised learning, and the model is trained using the deep learning model optimization framework Keras to obtain the second semantic detection model.

[0124] A combined model was obtained by constructing and training a first semantic detection model, a second semantic detection model, and a WebShell detection model based on traffic data using the aforementioned network structure and parameters. The combined model was tested on a set of 3286 collected test samples, verifying a WebShell detection rate exceeding 99.75%. The combined model did not show a significant decrease in detection rate for WebShell files using obfuscation and encryption. Furthermore, the combined model also demonstrated a high detection rate for unknown WebShell characteristics.

[0125] At least one of the WebShell detection methods provided in this embodiment collects training data for model training by analyzing the features of WebShell files from multiple perspectives. Then, based on the characteristics of each dataset, different network detection models are constructed. Finally, multiple detection models are combined and overlaid to detect and eliminate WebShells from all angles. This embodiment solves the problems of low detection rate, poor applicability to various scenarios, and high cost of manual rule maintenance in traditional methods. By fully utilizing the differences in feature datasets of various files, it enhances the model's deeper semantic knowledge learning of feature knowledge, thereby improving detection performance.

[0126] This embodiment also provides an electronic device including a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute any of the WebShell detection methods provided in this embodiment.

[0127] This embodiment also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements any of the WebShell detection methods provided in this embodiment.

[0128] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0129] The above description is only a partial embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A WebShell detection method, characterized in that, include: Acquire traffic data that interacts with the file to be detected, the traffic data including data packet sequences; Extract the payload of each data packet in the data packet sequence and convert it into tensor data to obtain a tensor data sequence; The spatial features of each tensor data in the tensor data sequence are extracted using a trained convolutional neural network to obtain a first output feature map sequence that characterizes the spatial features of each data packet. The temporal features of the first output feature map sequence are extracted using the feature extraction kernel of a trained long short-term memory network to obtain a second output feature map that characterizes the spatiotemporal features of the traffic data. Based on the second output feature map, a first detection result of the traffic data is determined, and the first detection result is used to characterize whether the file to be detected is a WebShell; The data packets are stored as PCAP files using the PCAP data packet storage format. The header and data packets of the PCAP file are used to detect whether the data packets belong to the file to be detected. Apart from the timestamp information, the other information in the header and data packets is irrelevant to the behavior of the file to be detected. When performing WebShell detection, after obtaining the data packet sequence in the traffic data of the file to be detected based on the timestamp information, the information in the header and data packets that is irrelevant to the behavior of the file to be detected is considered noise in the subsequent WebShell detection based on spatiotemporal features. This noise is removed through data cleaning. The file to be detected is a PHP script; before acquiring traffic data, which includes packet sequences, the method further includes: The PHP extension plugin VLD was used to extract the Opcode of the PHP script. The Opcode is semantically detected using a first semantic detection model based on deep learning to obtain a second detection result for the PHP script, wherein the second detection result represents the first confidence level that the PHP script belongs to a WebShell; When the first confidence level is less than the first preset value, the first detection result of the PHP script is obtained based on the traffic data; If the first confidence level is not less than the first preset value, the PHP script is determined to be a WebShell; The method further includes: Extract the static features of the source code of the file to be detected, and normalize the static features; A second semantic detection model based on deep learning is used to perform source code semantic detection on normalized static features to obtain a third detection result of the file to be detected, wherein the third detection result represents the second confidence level that the file to be detected belongs to WebShell; When the second confidence level is less than the second preset value, the first detection result of the file to be detected is obtained based on the traffic data, and / or the second detection result of the file to be detected is obtained based on the Opcode.

2. The method according to claim 1, characterized in that, The spatial features of each tensor data in the tensor data sequence are extracted using a trained convolutional neural network to obtain a first output feature map sequence for characterizing the spatial features of each data packet, including: The spatial features of each tensor data in the tensor data sequence are extracted using a trained convolutional neural network to obtain a third output feature map sequence. The feature dimensions of each third output feature map in the third output feature map sequence are rearranged to obtain the first output feature map sequence, wherein the feature dimensions of each first output feature map in the first output feature map sequence are the same as the feature dimensions of the input feature maps of the trained long short-term memory network.

3. The method according to claim 1, characterized in that, Extract the payload of each data packet in the data packet sequence and convert it into tensor data to obtain a tensor data sequence including: For each data packet in the data packet sequence, the payload of the data packet is mapped to an eight-bit grayscale image with a preset width and height, and the eight-bit grayscale image is converted into two-dimensional tensor data, wherein each byte in the payload of the data packet is mapped to a pixel in the eight-bit grayscale image, and the grayscale value of the pixel is the value represented by the byte.

4. The method according to claim 1, characterized in that, The second semantic detection model includes a source code detection model based on Text CNN and a feature detection model based on a binary classification network; Using a deep learning-based second semantic detection model to perform source code semantic detection on normalized static features, the third detection result of the file to be detected includes: The source code detection model is used to perform semantic recognition on part or all of the source code of the file to be detected, and a fourth detection result is obtained. The feature detection model is used to classify the normalized static features to obtain the fifth detection result. The fourth and fifth detection results are combined to obtain the third detection result of the document to be detected.

5. The method according to claim 1, characterized in that, Before extracting the static features of the source code of the file to be detected, the method further includes: The source code of the file to be tested is cleaned to remove invalid characters.

6. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to run the computer program to perform the steps of the method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images