Malicious file detection method, device, equipment and readable storage medium

Abstract

The present application discloses a malicious file detection method, device, equipment and readable storage medium. The malicious file detection method, device, equipment and readable storage medium, the server determines the web working directory of the web component, and scans the web working directory to obtain the first file to be detected. Automatically obtain the binary file of the running process, perform malicious binary file detection on the binary file, and can find the malicious binary file on the server. After that, perform malicious webshell detection on the first file to be detected, perform malicious binary file detection on the binary file, and the webshell detection and malicious binary detection are performed in parallel. With this solution, there is no need to specify a scan directory, but automatically obtain the web working directory of the web component, can find malicious webshell files and malicious binary files on the server, generate alarms in time, prevent the damage from expanding, and improve the security of the server.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a malicious file detection method, device, equipment and readable storage medium. Background Art

[0002] With the rapid development of Internet technology, the network environment is becoming increasingly complex. After hackers invade a website server, they deploy malicious files on the website server to perform malicious operations such as deleting or modifying data on the website server.

[0003] In order to prevent hackers from using malicious files to perform malicious operations on website servers, it is necessary to detect malicious files from the massive files on the website server and process them. In the common malicious file detection process, the user generates a configuration file based on the specified directory and sends the configuration file to the detection system, which scans the files in the specified directory to detect malicious files.

[0004] The above malicious file detection method scans the specified directory, lacks pertinence, cannot detect malicious files in time, and has poor security. Summary of the invention

[0005] The embodiments of the present application provide a malicious file detection method, apparatus, device and readable storage medium, which can detect malicious files in a timely manner and improve the security of the website server by automatically searching for files to be detected and performing detection.

[0006] In a first aspect, an embodiment of the present application provides a malicious file detection method, comprising:

[0007] Determine the web working directory of the web component;

[0008] Scan the web working directory to obtain a first file to be detected, and perform malicious webshell file detection on the first file to be detected;

[0009] Obtain a second file to be detected, and perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process, and the malicious webshell file detection and the malicious binary file detection are performed in parallel.

[0010] In a second aspect, an embodiment of the present application provides a malicious file detection device, including:

[0011] a malicious webshell file detection module, configured to scan the web working directory to obtain a first file to be detected, and perform malicious webshell file detection on the first file to be detected;

[0012] A malicious binary file detection module is used to obtain a second file to be detected and perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process, and the malicious webshell file detection and the malicious binary file detection are performed in parallel.

[0013] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the electronic device implements the method described in the first aspect or various possible implementation methods of the first aspect.

[0014] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement the method described in the first aspect or various possible implementation methods of the first aspect.

[0015] The malicious file detection method, device, equipment and readable storage medium provided by the embodiments of the present application, the server determines the web working directory of the web component, and scans the web working directory to obtain the first file to be detected. At the same time, there is no need to specify the scan directory, but automatically obtains the binary file of the running process, performs malicious binary file detection on the binary file, and can find malicious binary files on the server. After that, malicious webshell detection is performed on the first file to be detected, and malicious binary file detection is performed on the binary file, and webshell detection and malicious binary detection are performed in parallel. With this solution, there is no need to specify the scan directory, but automatically obtains the web working directory of the web component, and can find malicious webshell files and malicious binary files on the server, and generate alarms in time to prevent the damage from expanding, thereby improving the security of the server. At the same time. Malicious webshell file detection and malicious binary file detection are performed in parallel, and the detection efficiency is high. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 It is a schematic diagram of the implementation environment of the malicious file detection method provided in the embodiment of the present application;

[0018] Figure 2 is a flow chart of a malicious file detection method provided by an embodiment of the present application;

[0019] Figure 3 It is an overall architecture diagram of a malicious file detection device for implementing a malicious file detection method provided in an embodiment of the present application;

[0020] Figure 4 It is a flowchart of detecting malicious webshell files in the malicious file detection method provided in an embodiment of the present application;

[0021] Figure 5 It is a flowchart of detecting malicious binary files in the malicious file detection method provided in an embodiment of the present application;

[0022] Figure 6 A schematic diagram of a malicious file detection device provided in an embodiment of the present application;

[0023] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0025] With the rapid development of the Internet industry, network security issues have become more serious. The growth rate of malicious files is exponential, which seriously endangers network security. In the existing malicious file detection method, the server scans the specified directory according to the configuration. The scanning range lacks pertinence and the CPU resource usage is high, which affects other services of the server.

[0026] Therefore, how to scan malicious files from massive files accurately, efficiently and without affecting business has become an urgent problem to be solved.

[0027] Based on this, the embodiments of the present application provide a malicious file detection method, device, equipment and readable storage medium, which can detect malicious files in a timely manner and improve the security of the website server by automatically searching for files to be detected and performing detection.

[0028] Figure 1 This is a schematic diagram of the implementation environment of the malicious file detection method provided in the embodiment of the present application. Figure 1 , the implementation environment includes a server 11 and a cloud platform 12. The server 11 has huge computing power, storage capacity, etc., and can provide services to terminal devices. The server 11 can be hardware or software. When the server 11 is hardware, the server 11 is a single server or a distributed server cluster composed of multiple servers. When the server 11 is software, it can be multiple software modules or a single software module, etc., which is not limited by the embodiments of the present application.

[0029] The cloud platform 12 establishes a network connection with each server 11. The cloud platform 12 is located in a cloud environment, which is an entity that uses basic resources to provide cloud services to users in a cloud computing model. The cloud platform 12 has a large number of basic resources, including computing resources, storage resources or network resources.

[0030] A large number of files are stored on the server 11, and a malicious file detection device is installed on the server 11. The malicious file detection device discovers and obtains the web working directory of the web component of the server 11, and scans the web working directory to obtain the first file to be detected. The malicious file detection device also discovers and scans the binary files and dynamic link libraries of the processes running on the server 11 to obtain the second file to be detected. Malicious webshell file detection is performed on the first file to be detected, and / or malicious binary file detection is performed on the second file to be detected. During the malicious webshell file detection and malicious binary file detection process, the malicious file detection device detects the files to be detected (including the first file to be detected and the second file to be detected) locally. If it is still impossible to confirm whether the file to be detected is a malicious file through local detection, the file to be detected or the features of the file to be detected are sent to the cloud platform, and the cloud platform performs further detection on the file to be detected.

[0031] Below, based on Figure 1 The architecture shown in the figure is used to describe in detail the malicious file detection method described in the embodiment of the present application. Figure 2 .

[0032] Figure 2 : is a flow chart of a malicious file detection method provided by an embodiment of the present application. The execution subject of this embodiment is a malicious file detection device on a server. Unless otherwise specified below, the actions performed by the server are all performed by the malicious file detection device integrated on the server. This embodiment includes:

[0033] 201. Determine the web working directory of the web component.

[0034] Exemplarily, the web component is, for example, a tomcat component, an nginx component, a lighttpd component, an apache component, etc. After the server determines the web component, it automatically obtains the web working directory of the running web component according to the configuration file of the web component.

[0035] 202. Scan the web working directory to obtain a first file to be detected.

[0036] The server scans the web working directory to obtain the first file to be detected. When the web working directory includes multiple levels of directories, each level of directory is scanned to obtain the first file to be detected.

[0037] 203. Perform malicious webshell file detection on the first file to be detected.

[0038] The server performs malicious webshell file detection on the first file to be detected locally, or the server sends the first file to be detected or the features of the first file to be detected to the cloud platform, and the cloud platform performs malicious webshell detection on the first file to be detected; or the server and the cloud platform perform double detection on the first file to be detected.

[0039] 204. Obtain a second file to be detected.

[0040] Generally, malicious files include malicious webshell files and malicious binary files. After hackers invade a server, they deploy malicious webshell files on the server and use them to tamper with or delete data on the server. Alternatively, the server downloads malicious files from a malicious website and executes them. The process generated by the server executing the malicious files is called a malicious process, and such malicious files are called malicious binary files or malicious executable files. For example, hackers can cause the server to download malicious executable files by tampering with scheduled tasks or attacking the server's database.

[0041] Exemplarily, the server automatically obtains the binary file of the running process. If a process is running, even if the binary file of the process has been deleted, the binary file still exists in the memory. Therefore, the server can obtain the binary file of the running process.

[0042] 205. Perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process, and the malicious webshell file detection and the malicious binary file detection are performed in parallel.

[0043] During the parallel execution, the server scans files including: user-specified files, user-specified directories, web working directories of mainstream web components, binary files and dynamic link libraries of running processes, and some default directories that attackers often use to store malicious files. Moreover, the server can scan files with target suffixes or filter out files with certain suffixes based on the suffixes specified by the user, making malicious file detection more targeted and reducing overhead.

[0044] In addition, the above-mentioned malicious webshell file detection and malicious binary file detection can be performed successively or in parallel, that is, malicious webshell file detection and malicious binary file detection are performed simultaneously.

[0045] The malicious file detection method provided by the embodiment of the present application is that the server determines the web working directory of the web component, and scans the web working directory to obtain the first file to be detected. At the same time, there is no need to specify the scanning directory, but the binary file of the running process is automatically obtained, and the binary file is detected as a malicious binary file, so that the malicious binary file on the server can be found. After that, malicious webshell detection is performed on the first file to be detected, and malicious binary file detection is performed on the binary file, and the webshell detection and malicious binary detection are performed in parallel. With this solution, there is no need to specify the scanning directory, but the web working directory of the web component is automatically obtained, and malicious webshell files and malicious binary files on the server can be found, and an alarm is generated in time to prevent the damage from expanding and improve the security of the server. At the same time, malicious webshell file detection and malicious binary file detection are performed in parallel, and the detection efficiency is high.

[0046] Optionally, in the above embodiment, the first file to be detected also includes files in a specified directory or specified files, and the operation and maintenance personnel send the specified directory to the server in the form of a configuration file, and the server determines the specified directory according to the configuration file and scans the specified directory. This solution is used to detect malicious webshell files in the user-specified directory.

[0047] The second set of files to be detected also includes files in the default directory and dynamic link libraries that the running process depends on. Among them, the default directory is usually used by hackers to store malicious files, such as / tmp, / dev / shm, / usr / bin, etc. The server automatically traverses the files in the default directory, and automatically obtains the binary files of the running process and the dynamic link libraries that the running process depends on, such as .so libraries, so as to detect malicious binary files on the server.

[0048] Optionally, in the above embodiment, when the server obtains the first file to be detected, the server obtains a file that matches the target suffix from the files in the web working directory, and uses the file that matches the target suffix as the first file to be detected.

[0049] For example, the user can specify a target suffix or preset a target suffix, and the server determines the files with the preset target suffix from the files in the web working directory, and uses these files as the first files to be detected. Alternatively, the user specifies the suffix to be filtered out, and the files with the specified suffix are filtered out from the files in the web working directory, and the remaining files are used as the first files to be detected.

[0050] Similarly, when the server obtains the second file to be detected, the server obtains the file that matches the target suffix from the binary file of the running process, and uses the file that matches the target suffix as the second file to be detected.

[0051] Exemplarily, the user can specify a target suffix or preset a target suffix, and the server determines files with a preset target suffix from the binary files of the running process, and uses these files as the second files to be detected. Alternatively, the user specifies the suffix to be filtered out, and the files with the specified suffix are filtered out from the binary files of the running process, and the remaining files are used as the second files to be detected.

[0052] This solution makes malicious file detection more targeted by only detecting files that match the target suffix, reducing CPU and other overhead.

[0053] Optionally, in the above embodiment, the server can monitor its own CPU usage. Taking the first file to be detected as an example, each time the server obtains the first file to be detected, there is an interval of a preset length between two adjacent acquisitions. That is to say, each time the first file to be detected is obtained, the server determines whether the time length from the last acquisition to the current acquisition reaches the preset length. If the time length from the last acquisition to the current acquisition reaches the preset length, the first file to be detected is obtained this time; otherwise, the first file to be detected is not obtained temporarily. Among them, the preset length of the time interval is, for example, a time interval at the microsecond level.

[0054] The web working directory of the web component is usually a multi-level directory, and there is a preset time between obtaining files under web working directories of different levels. The server determines whether the level of the web working directory to which the first file to be detected obtained last time belongs is the same as the level of the web working directory described by the first file to be detected obtained this time. If the levels of the two web directories are different, the first file to be detected this time is obtained after waiting for a preset time; if the levels of the two web directories are the same, after each first file to be detected is obtained, the next first file to be detected is obtained.

[0055] For example, if the first file to be detected acquired last time is located in the root directory, and if there is still a first file to be detected that has not been detected in the root directory, then the first file to be detected will continue to be acquired from the root directory this time, and there is no need to wait for a preset time between two consecutive acquisitions. If the first files to be detected in the root directory have all been detected and it is necessary to acquire the first files to be detected from the first-level directory, then the first files to be detected will be acquired from the first-level directory after waiting for a preset time. The first-level directory is the first-level directory under the root directory.

[0056] In addition, the server can also continuously detect the CPU usage. When the CPU usage exceeds the preset threshold, the scanning task is immediately dormant, so that the detection of malicious files has less impact on system performance.

[0057] Similarly, when the server acquires the second file to be detected, it is also necessary to consider the time interval between two adjacent acquisitions, or the time interval between two adjacent levels.

[0058] By adopting this solution, a preset time length is set between two adjacent acquisitions, or a preset time length is set between two adjacent hierarchical directories, which is equivalent to introducing hibernation. During the hibernation period, the files to be detected (including the first file to be detected and the second file to be detected) are not obtained, which reduces the CPU occupancy rate to a certain extent.

[0059] Figure 3 It is an overall architecture diagram of a malicious file detection device for implementing a malicious file detection method provided in an embodiment of the present application. The malicious file detection device is arranged on a server and includes a CPU monitoring module, a malicious file detection module and an alarm reporting module.

[0060] CPU monitoring module: responsible for monitoring the system CPU resource usage. When the resource usage exceeds the set threshold, the system will be hibernated or restarted in time, with little impact on system performance.

[0061] Malicious file detection module: includes malicious webshell file detection unit, malicious binary file detection unit and rpm verification information acquisition unit.

[0062] The verification information acquisition unit is used to periodically obtain rpm verification information and store a mapping relationship, which refers to the corresponding relationship between the file installed by the rpm package and the hash value of the file. Among them, the file installed by the rpm package can be a webshell file, a binary file, etc., which is not limited by the embodiment of the present application.

[0063] Malicious webshell file detection unit: used to regularly detect malicious webshell files on the server, automatically obtain the first file to be detected, perform a series of filtering and analysis on the first file to be detected, and perform a comprehensive analysis of malicious webshell files on the first file to be detected. Through comprehensive analysis, malicious webshell files are discovered. The comprehensive analysis includes scanning to obtain the first file to be detected, rpm verification information filtering, local result cache maintenance, first local detection, first background result cache maintenance, first background detection and other steps. Among them, the first background result cache maintenance and the first background detection are performed by Figure 1 The cloud platform in the illustrated architecture is executed, and the server sends the first file to be detected or the features of the first file to be detected to the cloud platform, which performs background detection.

[0064] The steps are explained below:

[0065] Get the first file to be detected: Automatically traverse the files in the web working directory and the user-specified directory to obtain the first file to be detected. During the traversal process, the user can specify the target suffix or the suffix to be filtered out. If the user does not specify, the default rule is used for filtering. Among them, the user-specified part is sent to the server in the form of a configuration file.

[0066] RPM verification information filtering: perform hash value comparison on the first file to be detected according to the verification information set. During the comparison process, the first hash value of the first file to be detected is determined from the verification information set, and the verification information set stores the hash values ​​of the files installed by the RPM package, that is, the verification information set stores the mapping relationship between the hash values ​​of each file obtained by the above-mentioned verification information acquisition unit and the file. Therefore, the server can query the verification information set according to the identifier of the first file to be detected, so as to obtain the first hash value of the first file to be detected. After the server obtains the first file to be detected each time, it also calculates the hash value of the first file to be detected according to a preset algorithm, so as to obtain a second hash value. Among them, the preset algorithm can be the md5 algorithm, the sha256 algorithm, etc., and the first hash value and the second hash value can be MD5, sha256, etc.

[0067] Afterwards, the server determines whether the second hash value of the first file to be detected is consistent with the first hash value. When the first hash value and the second hash value are consistent, it means that the first file to be detected is safe, that is, the first file to be detected is not a malicious webshell file. When the first hash value and the second hash value are inconsistent, the first local detection is performed.

[0068] This solution uses rpm verification information to exclude malicious files, making malicious file detection faster.

[0069] Local result cache maintenance: A local cache is pre-allocated for storing the local detection result of the first file to be detected. The local detection result of the first file to be detected is referred to as the first local result below. After the first local detection is performed on each first file to be detected, the first local result needs to be stored in the local cache. The first local result includes the md5, file path, result (safe or unsafe), virus name, virus threat level, time of scanning the first file to be detected, etc. of the first file to be detected. Before performing the first local detection on the first file to be detected, it is necessary to query the local cache. If the first local result of the first file to be detected exists in the local cache, there is no need to perform the first local detection, and only the first local result is updated, such as updating the time of scanning the first file to be detected. If the first local result does not exist in the local cache, it is necessary to perform the first local detection. With this solution, the first local detection is performed on the first file to be detected only when the first local result does not exist in the local cache, thereby achieving the purpose of reducing the detection overhead.

[0070] First local detection: using Perl Compatible Regular Expressions (PCRE) and ssdeep fuzzy hash matching. During the matching process, the file name, suffix or content features of the first file to be detected can be matched.

[0071] First background result cache maintenance: pre-allocate a background cache for storing the background detection result of the first file to be detected. The background detection result of the first file to be detected is referred to as the first background result below. After the cloud platform performs background detection on each first file to be detected, the first background result needs to be stored in the background cache. Before performing background detection on the first file to be detected each time, the background cache is queried first. If the first background result does not exist in the background cache, a background check is performed on the first file to be detected. If the first background result exists in the background cache, there is no need to perform background detection on the first file to be detected, but only the first background result is updated.

[0072] First background detection: Use AI algorithm recognition and Webshell backdoor detection to perform the first background detection on the first file to be detected. Among them, Webshell backdoor detection is a comprehensive web killing tool that can analyze the characteristics and behaviors of the first file to be detected, thereby analyzing more hidden webshell backdoor behaviors.

[0073] Malicious binary file detection unit: used to regularly detect malicious binary files on the server, automatically obtain the second file to be detected, perform a series of filtering and analysis on the second file to be detected, and perform a total analysis of malicious binary files on the second file to be detected. Through comprehensive analysis, malicious binary files are discovered. The comprehensive analysis includes scanning to obtain the second file to be detected, rpm verification information filtering, local result cache maintenance, second local detection, second background result cache maintenance, background detection and other steps. Among them, the second background result cache maintenance and the second background detection are performed by Figure 1 The cloud platform in the illustrated architecture executes, and the server sends the second file to be detected or the features of the second file to be detected to the cloud platform, which performs background detection.

[0074] The steps are explained below:

[0075] Obtain the first file to be detected: automatically traverse the default directory to obtain the second file to be detected, the default directory is, for example, a directory where attackers often store malicious binary files, such as / tmp, / dev / shm, / usr / bin, etc. Alternatively, automatically obtain the binary file of the running process, including the case where it has been deleted. Alternatively, automatically obtain the dynamic link library that the running process depends on to obtain the second file to be detected.

[0076] RPM verification information filtering: perform hash value comparison on the second file to be detected according to the verification information set. During the comparison process, the second hash value of the second file to be detected is determined from the verification information set, and the verification information set stores the hash values ​​of the files installed by the RPM package, that is, the verification information set stores the mapping relationship between the hash values ​​of each file obtained by the above-mentioned verification information acquisition unit and the file. Therefore, the server can query the verification information set according to the identifier of the second file to be detected, so as to obtain the first hash value of the second file to be detected. After the server obtains the second file to be detected each time, it also calculates the hash value of the second file to be detected according to the preset algorithm, so as to obtain a second hash value. Among them, the preset algorithm can be the md5 algorithm, the sha256 algorithm, etc., and the second hash value and the second hash value can be MD5, sha256, etc.

[0077] Afterwards, the server determines whether the first hash value and the second hash value of the second file to be detected are consistent. When the first hash value and the second hash value are consistent, it means that the second file to be detected is safe, that is, the second file to be detected is not a malicious binary file. When the first hash value and the second hash value are inconsistent, a second local detection is performed.

[0078] Local result cache maintenance: A local cache is pre-allocated for storing the local detection result of the second file to be detected, and the local detection result of the second file to be detected is referred to as the second local result below. After the second local detection is performed on each second file to be detected, the second local result needs to be stored in the local cache. The second local result includes the md5, file path, result (safe or unsafe), virus name, virus threat level, yara rule update time, time of scanning the second file to be detected, etc. of the second file to be detected. Before performing the second local detection on the second file to be detected, it is necessary to query the local cache and determine whether the yara rule is updated. If there is a second local result of the second file to be detected in the local cache, it is further determined whether the yara rule is updated. If the yara rule is not updated, there is no need to perform the second local detection, and only the second local result is updated, such as updating the time of scanning the second file to be detected. If the yara rule is updated, it is necessary to perform the second local detection and store the second local result in the local cache.

[0079] If the second local result does not exist in the local cache, the second local detection needs to be performed. With this solution, the second local detection is performed on the second to-be-detected file only when the second local result does not exist in the local cache, thereby achieving the purpose of reducing detection overhead.

[0080] Second, local detection: Yara rules are used for feature matching. Yara rules include local default rules and configuration rules. The rules cover some malware, DDoS tools, mining programs, port forwarding tools, suspicious behaviors, Common Vulnerabilities & Exposures (CVE) vulnerabilities, etc.

[0081] Second background result cache maintenance: pre-allocate a background cache for storing the background detection results of the second file to be detected. The background detection results of the second file to be detected are referred to as the second background results below. After the cloud platform performs the second background detection on each second file to be detected, the second background result needs to be stored in the background cache. Before performing the second background detection on the second file to be detected each time, the background cache is queried first. If the second background result does not exist in the background cache, the second background check is performed on the second file to be detected. If the second background result exists in the background cache, there is no need to perform the second background detection on the second file to be detected, but only update the second background result.

[0082] Second background detection: Perform second background detection on the second file to be detected by using virus database hash value matching and suspicious file analysis. The suspicious file analysis service analyzes the characteristics and behaviors of the second file to be detected based on various well-known anti-virus engines to determine whether the second file to be detected is a virus, worm, target or other malicious software.

[0083] Alarm reporting module: responsible for alarm splicing, including virus name, file path, file md5, process related information, etc., and reporting to the web front end for display. For example, the server sends the name of the detected malicious webshell file or malicious binary file, the virus name, etc. to the terminal device of the operation and maintenance personnel, and displays the relevant information of the malicious file on the terminal device.

[0084] Figure 4 This is a flow chart of detecting malicious webshell files in the malicious file detection method provided in the embodiment of the present application. This embodiment includes:

[0085] 401. Obtain a first file to be detected.

[0086] In the embodiment of the present application, the first file to be detected can be a user-specified file, a file in a user-specified directory, a file in a web working directory of a web component, etc. Web components are, for example, tomcat components, nginx components, lighttpd components, and apache components, etc., which are not limited in the embodiment of the present application.

[0087] During the malicious webshell file detection process, the server automatically obtains the user-specified file, automatically traverses the user-specified directory, and automatically obtains the web working directory of the running web component to obtain the first file to be detected. The user can specify the target suffix, obtain the specified file that meets the target suffix, obtain the file that meets the target suffix from the user-specified directory, and obtain the file that meets the target suffix from the web working directory of the web component. The target suffix is, for example, some sensitive suffixes, such as .php, .jsp, etc. The first file to be detected that meets the target suffix is ​​detected for malicious webshell files, making the detection more targeted.

[0088] Alternatively, the user may also specify the suffix of the file to be filtered out, filter out the files with the specified suffix from the files in the specified directory or the web working directory of the web component, and use the remaining files as the first files to be detected.

[0089] If the user does not specify the suffix of the files to be filtered out, the files with the default suffix will be filtered out. For example, if the suffix of the files to be filtered out by default is .jpeg, then the files with the suffix .jpeg in the specified directory or web working directory will be filtered out.

[0090] In order to prevent the detection of malicious webshell files from occupying most of the CPU, memory, etc. and thus affecting other services on the server, the maximum traversal depth can be set and dormancy can be introduced. For example, the time between two consecutive acquisitions of the first file to be detected exceeds the preset time. For another example, in the process of acquiring the first file to be detected twice, if the two first files to be detected are located in adjacent directory levels, there is a certain preset time between the two acquisitions. Within the preset time, the server no longer acquires the first file to be detected, thereby preventing the malicious webshell file detection from occupying too much memory or CPU.

[0091] In the above embodiment, when the first file to be detected is a file specified by the user or a file in a directory specified by the user, the specified file or the specified directory is sent to the server in the form of a configuration file.

[0092] 402. Determine a first Hash value and a second Hash value for a first file to be detected.

[0093] After the server obtains the first file to be detected each time, it performs rpm filtering on the first file to be detected. During the filtering process, the server determines two hash values ​​for each first file to be detected, namely the first hash value and the second hash value. The first hash value is the hash value obtained when the file to be detected is installed in the rpm package mode. The first hash value can also be referred to as the hash value dumped by rpm. The second hash value is the hash value calculated according to the preset algorithm during the malicious webshell file detection process. The first hash value and the second hash value can be message digest algorithms (message-digest algorithm 5) md5, sha256, etc., which are not limited by the embodiments of the present application.

[0094] 403. Determine whether the first hash value and the second hash value are consistent. If the first hash value and the second hash value are consistent, it is considered that the first file to be detected is a safe file, that is, the first file to be detected is not a malicious webshell file. If the first hash value and the second hash value are inconsistent, execute step 404 for further detection.

[0095] In the embodiment of the present application, the process of comparing the first hash value and the second hash value is also referred to as the rpm verification process.

[0096] 404. Determine whether there is a first local result in the local cache. If there is no first local result in the local cache, execute step 405; if there is a first local result in the local cache, execute step 406.

[0097] When the first hash value and the second hash value are inconsistent, it means that the first file to be detected has failed the rpm verification. Before performing the first local detection, the local cache is queried first. If the first local result exists in the local cache, there is no need to perform the first local detection. Only when the first local result does not exist in the local cache, the first local detection is performed on the first file to be detected. In this way, the efficiency of malicious webshell file detection can be improved.

[0098] The first local result of the first file to be detected is stored in the local cache, and the local cache uses a sqlite3 database or other methods to store each first local result. After the server performs the first local detection on a first file to be detected, the first local result is obtained, and the first local result includes the md5 of the first file to be detected, the file path, the result (safe or unsafe, that is, whether it is a malicious binary file), the virus name, the virus threat level, the time information of scanning the first file to be detected, etc. Among them, md5 is the key to determine the consistency of the file, that is, when the server determines whether the first local result exists in the local cache, it queries the local cache according to the md5 of the first file to be detected. If the md5 of the first file to be detected exists in the local cache, it means that the server has detected whether the first file to be detected is a malicious webshell file before this detection. If the md5 of the first file to be detected does not exist in the local cache, it means that the server has not performed a webshell detection on the first file to be detected before this detection.

[0099] 405. Perform a first local detection on the first file to be detected.

[0100] In an embodiment of the present application, when the first local result of the first file to be detected does not exist in the local cache, the first local detection is performed on the first file to be detected. During the first local detection process, the server determines whether the characteristics of the first file to be detected match the characteristics of the malicious webshell file to obtain the first local result. If the first local result indicates that the characteristics of the first file to be detected do not match the characteristics of the malicious webshell file, the first file to be detected is sent to the cloud platform so that the cloud platform performs a first background detection on the first file to be detected to obtain a first background result, the first local detection includes at least one of pcre feature matching and ssdeep feature matching, and the first background detection includes any one of AI algorithm recognition and WEBSHELL backdoor detection.

[0101] 406. Update local cache.

[0102] Exemplarily, for each first file to be detected, if it is determined in step 404 that the first local result does not exist in the local cache, step 405 is executed to obtain the first local result, and the first local result is stored in the local cache; if it is determined in step 404 that the first local result exists in the local cache, the scanning time in the first local result is updated to prevent the first local result from being cleared.

[0103] 407. Clean up the local cache regularly.

[0104] Exemplarily, the server sets a cache timeout period, and regularly clears out timed first local results according to the scan time in the first local results. The timed first local results are first local results that have not been used for a long time.

[0105] By adopting this solution, malicious webshell files can be detected in time through local feature matching.

[0106] At this point, the server has completed the first local detection. For each first file to be detected, if the first local result does not exist in the local cache, and the first local result obtained by performing the first local detection on the first file to be detected indicates that the first file to be detected is a malicious webshell file, an alarm is generated. If the first local result does not exist in the local cache, but the first local result obtained by performing the first local detection on the first file to be detected indicates that the first file to be detected is not a malicious webshell file, the first background detection is entered.

[0107] Moreover, for each first file to be detected, if the first local result exists in the local cache, and the first local result indicates that the first file to be detected is a malicious webshell file, an alarm is generated. If the first local result exists in the local cache, but the first local result indicates that the first file to be detected is not a malicious webshell file, the first background detection is entered. With this solution, before each first local detection, the local cache is first queried to see if the first local result exists, so that the detection speed is faster.

[0108] 408. Determine whether the first file to be detected is a malicious webshell file according to the first local result. If the first local result indicates that the first file to be detected is a malicious webshell file, execute step 414; if the first local result indicates that the first file to be detected is not a malicious webshell file, execute step 409.

[0109] 409. Send the first file to be detected to the cloud platform.

[0110] Exemplarily, there is an interface between the server and the cloud platform, and the server sends the first file to be detected or the feature of the first file to be detected to the cloud platform through the interface, so that the cloud platform performs a first background detection on the first file to be detected to obtain a first background result. For clarity, the following description is based on the example of the server sending the first file to be detected to the cloud platform.

[0111] 410. Determine whether there is a first background result in the background cache. If there is no first background result in the background cache, execute step 411; if there is a first background result in the background cache, execute step 412.

[0112] The cloud platform has a background cache specifically used to store the first background result. After the cloud platform receives the first file to be detected, it queries the background cache based on the md5 of the first file to be detected. If the md5 of the first file to be detected exists in the background cache, it means that the cloud platform has detected whether the first file to be detected is a malicious webshell file before this background detection. If the md5 of the first file to be detected does not exist in the background cache, it means that the cloud platform has not performed a webshell detection on the first file to be detected before this background detection. With this solution, before each first background detection, it is first queried whether there is a first local result in the background cache, which makes the detection speed faster.

[0113] 411. Perform a first background detection on the first file to be detected to obtain a first background result.

[0114] In this step, the cloud platform performs a first post-detection on the first file to be detected to obtain a first background result, and the first background detection includes any one of AI algorithm recognition and WEBSHELL backdoor detection. For example, the cloud platform first performs AI algorithm recognition on the first file to be detected, and then performs WEBSHELL backdoor detection.

[0115] The cloud platform can simultaneously receive first files to be detected sent by multiple servers, obtain multiple queues based on the first files to be detected, and analyze the first files to be detected submitted by multiple servers in parallel through queue optimization scheduling. While determining whether each first file to be detected is a malicious webshell file, parallel analysis can improve the efficiency of malicious webshell file detection.

[0116] 412. Update background cache.

[0117] Exemplarily, for each first file to be detected, if it is determined in step 410 that the first background result does not exist in the background cache, step 411 is executed to obtain the first background result, and the first background result is stored in the background cache; if it is determined in step 410 that the first background result exists in the background cache, the scanning time in the first background result is updated to prevent the first background result from being cleared.

[0118] 413. Send the first background result to the server.

[0119] Exemplarily, the cloud platform returns the first background result to the server through the cloud query interface.

[0120] 414. Determine whether the first file to be detected is a malicious webshell file according to the first background result. If the first background result indicates that the first file to be detected is a malicious webshell file, execute step 415; if the first background result indicates that the first file to be detected is not a malicious webshell file, execute back to step 401, continue to obtain a new first file to be detected and perform malicious webshell file detection.

[0121] 415. Generate alarm information, send it to the web front-end interface and display it.

[0122] The warning information includes the virus name, the identifier (name) of the first file to be detected, the file path, MD5, and web component related information.

[0123] By adopting this solution, malicious webshell files can be accurately identified by performing a multi-dimensional comprehensive analysis such as a first local detection and a first background detection on the first file to be detected.

[0124] Figure 5 This is a flow chart of detecting malicious binary files in a malicious file detection method provided in an embodiment of the present application. This embodiment includes:

[0125] 501. Obtain a second file to be detected.

[0126] In the embodiment of the present application, the second file to be detected may be a file in a default directory, a binary file of a running process, or a dynamic link library that a running process depends on, etc. The default directory refers to a directory used by an attacker to store malicious binary files, such as / tmp, / dev / shm, / usr / bin, etc. Among them, the binary file of the running process includes a deleted binary file, because: if a process is executing, even if the binary file of the process has been deleted, the binary file still exists in the memory.

[0127] In order to prevent the detection of malicious binary files from occupying most of the CPU, memory, etc. and thus affecting other services on the server, the maximum traversal depth can be set and dormancy can be introduced. For example, the time between two consecutive acquisitions of the second file to be detected exceeds the preset time. For another example, in the process of acquiring the second file to be detected twice, if the two second files to be detected are located in adjacent directory levels, there is a certain preset time between the two acquisitions. Within the preset time, the server no longer acquires the second file to be detected, thereby preventing the detection of malicious binary files from occupying too much memory or CPU.

[0128] 502. Determine a first Hash value and a second Hash value for a second file to be detected.

[0129] For details, please refer to the above Figure 4 The description of step 402 is not repeated here.

[0130] 503. Determine whether the first hash value and the second hash value are consistent. If the first hash value and the second hash value are consistent, it is considered that the second file to be detected is a safe file, that is, the second file to be detected is not a malicious binary file. If the first hash value and the second hash value are inconsistent, execute step 505 for further detection.

[0131] In the embodiment of the present application, the process of comparing the first hash value and the second hash value is also referred to as the rpm verification process.

[0132] 504. Determine whether there is a second local result in the local cache. If there is no second local result in the local cache, execute step 505; if there is a second local result in the local cache, execute step 506.

[0133] When the first hash value and the second hash value are inconsistent, it means that the second file to be detected fails to pass the rpm check. Before performing the second local detection, the local cache is queried first. If the second local result exists in the local cache, there is no need to perform the second local detection. Only when the second local result does not exist in the local cache, the second local detection is performed on the second file to be detected. In this way, the efficiency of malicious binary file detection can be improved.

[0134] The second local result of the second file to be detected is stored in the local cache, and the local cache uses a sqlite3 database or other methods to store each second local result. After the server performs the second local detection on a second file to be detected, the second local result is obtained, and the second local result includes the md5 of the second file to be detected, the file path, the result (safe or unsafe, that is, whether it is a malicious binary file), the virus name, the virus threat level, the time information of scanning the second file to be detected, the yara rule update time, etc. Among them, when the yara rule is updated, the yara rule update time is updated synchronously. md5 is the key to determine the consistency of the file, that is, when the server determines whether there is a second local result in the local cache, it queries the local cache according to the md5 of the second file to be detected. If the md5 of the second file to be detected exists in the local cache, it means that the server has detected whether the second file to be detected is a malicious binary file before this detection. If the md5 of the second file to be detected does not exist in the local cache, it means that the server has not performed binary detection on the second file to be detected before this detection.

[0135] 505 . Perform a second local detection on the second file to be detected, and then execute step 507 .

[0136] In the embodiment of the present application, when the second local result of the second file to be detected does not exist in the local cache, the second local detection is performed on the second file to be detected. During the second local detection process, the server uses yara rules to detect the second file to be detected. The yara rules include local default rules and rules issued by the configuration. The rules cover some malware, Dods tools, mining programs, port forwarding tools, upx shell features, suspicious behaviors, CVE vulnerabilities, etc.

[0137] 506. Determine whether the Yara rule is updated. If the Yara rule is updated, execute step 505; if the Yara rule is not updated, execute step 507.

[0138] Exemplarily, the server determines whether the Yara rule update time in the second local result is consistent with the current Yara rule update time. If the two rule update times are inconsistent, it means that the Yara rule has been updated, and the server executes step 505; if the two rule update times are consistent, it means that the Yara rule has not been updated, and the server executes step 507.

[0139] 507. Update local cache.

[0140] Exemplarily, for each second file to be detected, if it is determined in step 504 that the second local result does not exist in the local cache, step 505 is executed to obtain the second local result, and the second local result is stored in the local cache; if it is determined in step 504 that the second local result exists in the local cache, step 506 is executed. After executing step 506, if the second local detection needs to be performed, the process returns to step 505; if the second local detection does not need to be performed, the scanning time in the second local result is updated to prevent the second local result from being cleared.

[0141] 508. Clean the local cache regularly.

[0142] Exemplarily, the server sets a cache timeout period, and regularly clears out the timed second local results according to the scan time in the second local results. The timed second local results are second local results that have not been used for a long time.

[0143] By adopting this solution, malicious binary files can be detected in time by detecting the second file to be detected locally.

[0144] At this point, the server has completed the second local detection. For each second file to be detected, if the second local result does not exist in the local cache, and the second local result obtained by performing the second local detection on the second file to be detected indicates that the second file to be detected is a malicious binary file, an alarm is generated. If the second local result does not exist in the local cache, but the second local result obtained by performing the second local detection on the second file to be detected indicates that the second file to be detected is not a malicious binary file, then the background detection is entered.

[0145] Moreover, for each second file to be detected, if the second local result exists in the local cache and the Yara rule has not been updated, if the second local result indicates that the second file to be detected is a malicious binary file, an alarm is generated. If the second local result exists in the local cache, but the Yara rule is updated, the second local detection is re-executed on the second file to be detected to obtain the second local result.

[0146] 509. Determine whether the second file to be detected is a malicious binary file according to the second local result. If the second local result indicates that the second file to be detected is a malicious binary file, execute step 515; if the second local result indicates that the second file to be detected is not a malicious binary file, execute step 510.

[0147] 510. Send the second file to be detected to the cloud platform.

[0148] Exemplarily, there is an interface between the server and the cloud platform, and the server sends the second file to be detected or the features of the second file to be detected to the cloud platform through the interface, so that the cloud platform performs a second background detection on the second file to be detected to obtain a second background result. For clarity, the following description is based on the example of the server sending the second file to be detected to the cloud platform.

[0149] 511. Determine whether there is a second background result in the background cache. If there is no second background result in the background cache, execute step 512; if there is a second background result in the background cache, execute step 513.

[0150] The cloud platform has a background cache specifically used to store the second background results. After receiving the second file to be detected, the cloud platform queries the background cache based on the md5 of the second file to be detected. If the md5 of the second file to be detected exists in the background cache, it means that the cloud platform has detected whether the second file to be detected is a malicious binary file before the second background detection. If the md5 of the second file to be detected does not exist in the background cache, it means that the cloud platform has not performed a second background detection on the second file to be detected before the current background detection.

[0151] 512. Perform a second background detection on the second file to be detected to obtain a second background result.

[0152] In this step, the cloud platform performs a second background detection on the second file to be detected to obtain a second background result, and the second background detection includes any one of virus library hash value matching, suspicious file analysis, etc. For example, the cloud platform first performs a virus library hash value matching on the second file to be detected, and then performs suspicious file analysis.

[0153] The cloud platform can simultaneously receive second files to be detected sent by multiple servers, obtain multiple queues based on these second files to be detected, and analyze the second files to be detected submitted by multiple servers in parallel through queue optimization scheduling, so as to determine whether each second file to be detected is a malicious binary file.

[0154] 513. Update background cache.

[0155] Exemplarily, for each second file to be detected, if it is determined in step 511 that there is no second background result in the background cache, step 512 is executed to obtain the second background result, and the second background result is stored in the background cache; if it is determined in step 511 that there is a second background result in the background cache, the scanning time in the second background result is updated to prevent the second background result from being cleared.

[0156] 514. Send the second background result to the server.

[0157] Exemplarily, the cloud platform returns the second background result to the server through the cloud query interface.

[0158] 515. Determine whether the second file to be detected is a malicious binary file based on the second background result. If the second background result indicates that the second file to be detected is a malicious binary file, execute step 516; if the second background result indicates that the second file to be detected is not a malicious binary file, execute back to step 501, continue to obtain a new second file to be detected and perform malicious binary file detection.

[0159] 516. Generate alarm information, send it to the web front-end interface and display it.

[0160] The warning information includes the virus name, the identifier (name) of the second file to be detected, the file path, MD5, and web component related information.

[0161] By adopting this solution, malicious binary files can be accurately identified by performing a multi-dimensional comprehensive analysis such as a second local detection and a second background detection on the second file to be detected.

[0162] The following is an embodiment of the device of the present application, which can be used to execute the embodiment of the method of the present application. For details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the method of the present application.

[0163] Figure 6 A schematic diagram of a malicious file detection device provided in an embodiment of the present application. The malicious file detection device 600 includes: a malicious webshell file detection module 61 and a malicious binary file detection module 62.

[0164] A malicious webshell file detection module 61 is used to determine a web working directory of a web component, scan the web working directory to obtain a first file to be detected, and perform malicious webshell file detection on the first file to be detected;

[0165] The malicious binary file detection module 62 is used to obtain a second file to be detected and perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process, and the malicious webshell file detection and the malicious binary file detection are performed in parallel.

[0166] In a feasible implementation, the first files to be detected also include files in a specified directory or specified files; the second files to be detected also include files in a dynamic link library or a default directory that the running process depends on, and the default directory is a directory used by hackers to store malicious binary files.

[0167] In a feasible implementation, the malicious file detection device 600 further includes: a transceiver module 63, when the malicious webshell file detection module 61 performs malicious webshell file detection on the first file to be detected, it is used to perform a first local detection on the first file to be detected according to the characteristics of the first file to be detected and the characteristics of the malicious webshell file to obtain a first local result, wherein the first local detection includes at least one of pcre feature matching and ssdeep feature matching;

[0168] The transceiver module 63 is used to send the first file to be detected to the cloud platform if the first local result indicates that the first file to be detected is not a malicious webshell file, so that the cloud platform performs a first background detection on the first file to be detected to obtain a first background result, wherein the first background detection includes any one of AI algorithm recognition and Webshell backdoor detection.

[0169] In a feasible implementation, the transceiver module 63 is further used to receive the first background result from the cloud platform;

[0170] The malicious webshell file detection module 61 is further configured to determine whether the first file to be detected is a malicious webshell file according to the first background result.

[0171] In a feasible implementation, when the detection 61 determines whether the first file to be detected is a malicious webshell file based on the first background result to determine whether the characteristics of the first file to be detected match the characteristics of the malicious webshell file to obtain a first local result, it is used to determine the first hash value of the first file to be detected from a verification information set, and the verification information set stores the hash values ​​of files installed in the rpm package mode; determine whether the second hash value of the first file to be detected is consistent with the first hash value, and the second hash value is calculated according to a preset algorithm; when the first hash value and the second hash value are inconsistent, determine whether the characteristics of the first file to be detected match the characteristics of the malicious webshell file to obtain a first local result.

[0172] In a feasible implementation, before the malicious webshell file detection module 61 determines whether the feature of the first file to be detected matches the feature of the malicious webshell file to obtain the first local result, it is also used to determine whether the first local result does not exist in the local cache.

[0173] In a feasible implementation, when the malicious binary file detection module 62 performs malicious binary file detection on the second file to be detected, it is used to perform a second local detection on the second file to be detected to obtain a second local result, and the second local detection includes yara rule matching;

[0174] The transceiver module 63 is used to send the second file to be detected to the cloud platform if the second local result indicates that the second file to be detected is not a malicious binary file, so that the cloud platform performs a second background detection on the second file to be detected to obtain a second background result, and the second local detection includes at least one of virus library hash value matching and suspicious file analysis.

[0175] In a feasible implementation, the transceiver module 63 is further used to receive the second background result from the cloud platform;

[0176] The malicious binary file detection module 62 is further configured to determine whether the second file to be detected is a malicious binary file according to the second background result.

[0177] In a feasible implementation method, when the malicious webshell file detection module 61 scans the web working directory to obtain the first file to be detected, it is used to determine whether the time from the last acquisition to the current acquisition reaches a preset length. If the time from the last acquisition to the current acquisition reaches the preset length, the first file to be detected is obtained this time; or, it is determined whether the level of the web working directory to which the first file to be detected obtained last time belongs is the same as the level of the web working directory described by the first file to be detected obtained this time. If not, wait for the preset time and then obtain the first file to be detected this time.

[0178] In a feasible implementation, when the malicious webshell file detection module 61 scans the web working directory to obtain the first file to be detected, it is used to obtain a file that matches the target suffix from the files under the web working directory, and use the file that matches the target suffix as the first file to be detected.

[0179] The malicious file detection device provided in the embodiment of the present application can execute the actions of the server in the above embodiment. Its implementation principle and technical effect are similar and will not be repeated here.

[0180] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 7 As shown, the electronic device 700 is, for example, the above-mentioned server, and the electronic device 700 includes:

[0181] Processor 71 and memory 72;

[0182] The memory 72 stores computer instructions;

[0183] The processor 71 executes the computer instructions stored in the memory 72, so that the processor 71 executes the malicious file detection method implemented by the server as above.

[0184] The specific implementation process of the processor 71 can be found in the above-mentioned method embodiment. Its implementation principle and technical effects are similar, and will not be repeated here in this embodiment.

[0185] Optionally, the electronic device 700 further includes a communication component 73 , wherein the processor 71 , the memory 72 and the communication component 73 may be connected via a bus 74 .

[0186] An embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a processor, they are used to implement malicious file detection implemented by the server as above.

[0187] An embodiment of the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the malicious file detection implemented by the server as above.

[0188] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0189] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A malicious file detection method, characterized in that: include: Determine the web working directory of the web component running on the server; Scan the web working directory to obtain a first file to be detected, and perform malicious webshell file detection on the first file to be detected; Obtain a second file to be detected, and perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process on the server, and the malicious webshell file detection and the malicious binary file detection are performed in parallel; The performing malicious webshell file detection on the first file to be detected includes: Performing a first local detection on the first file to be detected according to the characteristics of the first file to be detected and the characteristics of the malicious webshell file to obtain a first local result; If the first local result indicates that the first file to be detected is not a malicious webshell file, the first file to be detected is sent to the cloud platform, so that the cloud platform performs a first background detection on the first file to be detected to obtain a first background result.

2. The method according to claim 1, characterized in that The first files to be detected also include files in a specified directory or specified files; The second files to be detected also include files in a dynamic link library or a default directory that the running process depends on, and the default directory is a directory used by hackers to store malicious binary files.

3. The method according to claim 1, characterized in that Also includes: Receiving the first background result from the cloud platform; Determine whether the first file to be detected is a malicious webshell file according to the first background result.

4. The method according to claim 1, characterized in that: The determining whether the feature of the first file to be detected matches the feature of the malicious webshell file to obtain a first local result includes: Determine a first Hash value of the first file to be detected from a verification information set, wherein the verification information set stores Hash values ​​of files installed in an RPM package manner; Determine whether a second Hash value of the first to-be-detected file is consistent with the first Hash value, where the second Hash value is calculated according to a preset algorithm; When the first Hash value and the second Hash value are inconsistent, it is determined whether a feature of the first file to be detected matches a feature of a malicious webshell file to obtain a first local result.

5. The method according to claim 1, characterized in that Before determining whether the feature of the first file to be detected matches the feature of the malicious webshell file to obtain the first local result, the method further includes: It is determined that the first local result does not exist in the local cache.

6. The method according to claim 1 or 2, characterized in that: The performing malicious binary file detection on the second file to be detected includes: Performing a second local detection on the second to-be-detected file to obtain a second local result, wherein the second local detection includes yara rule matching; If the second local result indicates that the second file to be detected is not a malicious binary file, the second file to be detected is sent to the cloud platform so that the cloud platform performs a second background detection on the second file to be detected to obtain a second background result, and the second local detection includes at least one of virus library hash value matching and suspicious file analysis.

7. The method according to claim 6, characterized in that Also includes: Receiving the second background result from the cloud platform; Determine whether the second file to be detected is a malicious binary file according to the second background result.

8. The method according to claim 1 or 2, characterized in that: Scanning the web working directory to obtain a first file to be detected includes: Determine whether the time from the last acquisition to the current acquisition reaches a preset length, and if the time from the last acquisition to the current acquisition reaches the preset length, the first file to be detected is acquired this time; or, Determine whether the level of the web working directory to which the first file to be detected obtained last time belongs is the same as the level of the web working directory described by the first file to be detected obtained this time. If not, wait for a preset time to obtain the first file to be detected this time.

9. The method according to claim 1 or 2, characterized in that: Scanning the web working directory to obtain a first file to be detected includes: A file matching the target suffix is ​​obtained from the files in the web working directory, and the file matching the target suffix is ​​used as the first file to be detected.

10. A malicious file detection device, characterized in that: include: A webshell file detection module, used to determine a web working directory of a web component running on the server, scan the web working directory to obtain a first file to be detected, and perform malicious webshell file detection on the first file to be detected; A malicious binary file detection module, used to obtain a second file to be detected, and perform malicious binary file detection on the second file to be detected; wherein the second file to be detected includes a binary file of a running process on the server, and the malicious webshell file detection and the malicious binary file detection are performed in parallel; When the webshell file detection module performs malicious webshell file detection on the first file to be detected, it is used to perform a first local detection on the first file to be detected according to the characteristics of the first file to be detected and the characteristics of the malicious webshell file to obtain a first local result; if the first local result indicates that the first file to be detected is not a malicious webshell file, the first file to be detected is sent to the cloud platform, so that the cloud platform performs a first background detection on the first file to be detected to obtain a first background result.

11. An electronic device comprising a processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the electronic device implements the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images