Script detection method, apparatus and computer program product

Abstract

The embodiments of the present disclosure disclose a script detection method, device and computer program product, the method comprising: executing a detected script; detecting creation and calling information of a function in the execution process of the detected script; after the execution of the detected script is completed, determining a function that is created but not called based on the creation and calling information of the function; calling the function that is not called, so as to determine whether the detected script is a malicious script based on the execution behavior of the detected script. The technical solution can ensure that all functions in the detected script will be called and executed, can more comprehensively detect the entire script, and can prevent the function containing malicious code hidden in the detected script from bypassing the script detection.

Description

Technical Field

[0001] This disclosure relates to the field of security technology, specifically to a script detection method, apparatus, and computer program product. Background Technology

[0002] A script is an executable file written in a specific descriptive language according to a certain format. More specifically, a script is a program that does not require compilation and is interpreted and executed at runtime. In the black and gray market, hackers can compromise the security of server systems by executing malicious scripts, such as downloading and installing Trojan viruses, monitoring user data, and seizing system resources, resulting in poor server system security.

[0003] Therefore, server systems typically perform script checks before execution. However, due to the flexibility of scripting languages, hackers can construct malicious code and hide it within certain functions of the script. Furthermore, during dynamic script detection, the execution of functions containing this malicious code is prevented, thus hindering the dynamic detection from identifying the behavioral characteristics of the malicious code within the script.

[0004] To address the aforementioned issues, a solution is needed to detect scripts containing such malicious code and improve the accuracy of malicious script detection. Summary of the Invention

[0005] This disclosure provides a script detection method, apparatus, and computer program product.

[0006] In a first aspect, this disclosure provides a script detection method, which includes:

[0007] Execute the script being detected;

[0008] Detect the creation and calling information of functions during the execution of the script being tested;

[0009] After the script being detected has been executed, functions that have not been called since their creation are identified based on the function creation and calling information.

[0010] The function that has not been called before is invoked in order to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

[0011] Furthermore, the detection of function creation and invocation information during the execution of the script being detected includes:

[0012] After detecting that the script being monitored has created a new function during its execution, the information of the newly created function is added to the list of uncalled functions;

[0013] Once a function in the list of uncalled functions is detected to be called, the information of the called function is removed from the list of uncalled functions.

[0014] Furthermore, the method also includes:

[0015] After detecting that the detected script has created a new function during its execution, the reference count of the newly created function in the execution environment of the detected script is increased.

[0016] Furthermore, calling functions that have not been called before, in order to determine whether the detected script is a malicious script based on its execution behavior, includes:

[0017] Build the function parameters corresponding to functions that have not been called after creation;

[0018] The function that was not called after creation is invoked based on all the constructed function parameters in the execution environment of the script being detected.

[0019] Furthermore, the function parameters corresponding to the functions that are not called after the construction is completed include:

[0020] The number and data type of the function parameters corresponding to the functions that have not been called after creation are determined based on the declaration information of the functions that have not been called after creation;

[0021] The function parameters are constructed based on the number of function parameters and the default values ​​corresponding to their data types.

[0022] Furthermore, the method also includes:

[0023] Detect the execution behavior of functions in the script being tested during execution;

[0024] The script being detected is determined to be malicious based on the execution behavior.

[0025] Furthermore, the detection of function creation and invocation information during the execution of the script being detected includes:

[0026] By modifying the interpreter that runs the script being tested, the interpreter can detect the creation and calling information of the functions during the execution of the script being tested.

[0027] Secondly, this disclosure provides a script detection method, which includes:

[0028] Obtain the script to be detected;

[0029] A pre-deployed script detection interface is invoked to detect the script being detected. The script detection interface executes the script being detected in a virtual machine environment and detects the creation and calling information of functions during the execution of the script being detected. After the script being detected is executed, functions that have been created but not called are identified based on the creation and calling information, and functions that have not been called are called, so as to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

[0030] Output the detection results of the script being detected.

[0031] Thirdly, this disclosure provides a script detection device, which includes:

[0032] The execution module is configured to execute the script being monitored.

[0033] The first detection module is configured to detect the creation and calling information of functions during the execution of the script being detected;

[0034] The first determining module is configured to determine, after the execution of the script being detected is completed, functions that have not been called after creation based on the function creation and calling information;

[0035] The first calling module is configured to call the function that has not been called before, so as to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

[0036] The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function.

[0037] In one possible design, the above-described device includes a memory and a processor. The memory stores one or more computer instructions that support the device in performing the corresponding methods described above, and the processor is configured to execute the computer instructions stored in the memory. The device may also include a communication interface for communicating with other devices or communication networks.

[0038] Fourthly, embodiments of this disclosure provide an electronic device including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the method described in any of the above aspects.

[0039] Fifthly, embodiments of this disclosure provide a computer-readable storage medium for storing computer instructions used by any of the above-described devices, which, when executed by a processor, are used to implement the methods described in any of the above aspects.

[0040] In a sixth aspect, embodiments of this disclosure provide a computer program product comprising computer instructions which, when executed by a processor, are used to implement the methods described in any of the preceding aspects.

[0041] The technical solutions provided in this disclosure can include the following beneficial effects:

[0042] This disclosure addresses the dynamic detection process of malicious scripts. During the execution of the script being detected, it examines the created functions and their call information. After the script finishes execution, it determines whether any functions within the script have not been called before, based on the created functions and their call information, and calls any uncalled functions at least once. This allows for the determination of whether the script is malicious based on the execution behavior of each function. This disclosure ensures that all functions in the script being detected are called and executed, enabling a more comprehensive detection of the entire script and preventing the script from hiding functions containing malicious code to bypass script detection.

[0043] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0044] Other features, objects, and advantages of this disclosure will become more apparent from the following detailed description of non-limiting embodiments, taken in conjunction with the accompanying drawings. In the drawings:

[0045] Figure 1 A flowchart illustrating a script detection method according to an embodiment of the present disclosure is shown;

[0046] Figure 2 A schematic diagram illustrating the implementation process of script detection according to one embodiment of this disclosure is shown;

[0047] Figure 3 A flowchart illustrating a script detection method according to another embodiment of the present disclosure is shown;

[0048] Figure 4 This diagram illustrates an application scenario of script detection according to one embodiment of the present disclosure.

[0049] Figure 5 A structural block diagram of a script detection apparatus according to an embodiment of the present disclosure is shown;

[0050] Figure 6 A structural block diagram of a script detection apparatus according to another embodiment of the present disclosure is shown;

[0051] Figure 7 This is a schematic diagram of the structure of an electronic device suitable for implementing the script detection method according to embodiments of the present disclosure. Detailed Implementation

[0052] In the following, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings to enable those skilled in the art to readily implement them. Furthermore, for clarity, portions unrelated to the description of the exemplary embodiments have been omitted from the drawings.

[0053] In this disclosure, it should be understood that terms such as “comprising” or “having” are intended to indicate the presence of features, figures, steps, behaviors, components, parts or combinations thereof disclosed in this specification, and do not preclude the possibility of the presence or addition of one or more other features, figures, steps, behaviors, components, parts or combinations thereof.

[0054] It should also be noted that, unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other. This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0055] The details of the embodiments of this disclosure are described in detail below through specific examples.

[0056] Figure 1 A flowchart illustrating a script detection method according to an embodiment of this disclosure is shown. Figure 1 As shown, the script detection method includes the following steps:

[0057] In step S101, the script to be detected is executed;

[0058] In step S102, the creation and calling information of functions during the execution of the script being detected is detected;

[0059] In step S103, after the detected script is executed, functions that have not been called after creation are determined based on the function creation and calling information;

[0060] In step S104, the function that has not been called before is invoked in order to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

[0061] In this embodiment, the script is an interpretable and executable program, and the script being detected is used to detect whether it contains malicious code. To detect whether the script contains malicious code, this embodiment can execute the script in a virtual machine environment. This virtual machine environment can be deployed on a server, therefore, the script detection method can be executed on the server.

[0062] The script being tested can be interpreted and executed by a script interpreter in a virtual machine environment. The script interpreter can execute the script statements in the script being tested line by line, and during the execution of the script statements, it can detect whether there are function creation and / or function call instructions. If function creation and / or function call instructions are found, the creation information and function call information of the function can be recorded.

[0063] In some embodiments, function creation and invocation information may include function creation information and invocation information; function creation information may include, but is not limited to, the identifier of the created function, function parameter information, function creation time, function reference count, and the object referencing the function; function parameter information may include, but is not limited to, the number of parameters and the data type of each parameter. Function invocation information may include, but is not limited to, the identifier of the called function, function invocation time, the object calling the function, and whether the function was successfully invoked.

[0064] In this embodiment of the disclosure, the purpose of executing the script to be detected is to dynamically detect whether the script to be detected contains malicious code. Therefore, during the process of the interpreter interpreting and executing the script to be detected line by line, it is also possible to determine whether the script to be detected is a malicious script based on the execution behavior of each script statement.

[0065] In some embodiments, if malicious code is found in the detected script, the detected script can be considered a malicious script; if no malicious code is detected in the detected script, the detected script can be considered not a malicious script.

[0066] In some embodiments, a malicious script refers to any script added to, modified, or deleted from a software system with the purpose of causing harm or damaging system functionality. For example, traditional malicious scripts may include viruses, worms, Trojan horses, and attack scripts. Newer malicious scripts include, for example, Java attack applets and dangerous ActiveX controls. The determination of which scripts exhibit malicious behavior can refer to existing technologies or be based on the actual application scenario; this disclosure does not impose any limitations on this.

[0067] As described in the background section, some functions exist in the script. When the script is executed according to normal logic, it can be prevented from being executed, so it is impossible to dynamically detect whether there is malicious code in the function based on the execution behavior of the function.

[0068] The following example illustrates this situation:

[0069] 1. The function name or parameters passed to the script are passed from outside. The script will execute the function name or parameters specified by the parameters. Therefore, the correct parameters used to activate the malicious function cannot be obtained during dynamic detection. As a result, the function that guarantees malicious code is not triggered and executed, thus the presence of malicious code in the function cannot be detected.

[0070] 2. The script uses file fragmentation to hide functions containing malicious code in other files, and then imports these other files into the relevant functions of the currently executing script for execution, thus making it impossible to detect the presence of malicious code in the function through dynamic detection.

[0071] Currently, traditional dynamic detection techniques cannot detect malicious code in file-segmented scripts because it is difficult to aggregate all files for detection. Therefore, traditional dynamic detection methods usually perform single-file detection on script files. However, single-file detection may prevent the malicious behavior in other related files from being triggered, allowing such scripts to bypass script detection.

[0072] To address the aforementioned issues, this embodiment records function creation and invocation information during script execution. After script execution is complete, it determines, based on this creation and invocation information, whether all functions created during script execution have been called. If there are functions that have not been called throughout the process, these uncalled functions can be called, thereby enabling the determination of whether malicious code exists in the function based on its execution behavior.

[0073] In this way, during the dynamic detection of the script being detected, all functions created within the script will be invoked and executed. This avoids the problem mentioned above where some functions are not triggered during the detection process, thus bypassing script detection. In other words, in this embodiment, by detecting the creation and invocation of functions during the execution of the script, functions that were not invoked during the entire script execution are re-invoked and executed after the script has finished executing. This ensures that all functions involved in the script are executed at least once, thereby detecting their execution behavior and determining whether malicious code exists within the function based on this behavior. Finally, based on the execution behavior of all executed functions, it is determined whether the script being detected is malicious.

[0074] This disclosure addresses the dynamic detection process of malicious scripts. During the execution of the script being detected, it examines the created functions and their call information. After the script finishes execution, it determines whether any functions within the script have not been called before, based on the created functions and their call information, and calls any uncalled functions at least once. This allows for the determination of whether the script is malicious based on the execution behavior of each function. This disclosure ensures that all functions in the script being detected are called and executed, enabling a more comprehensive detection of the entire script and preventing the script from hiding functions containing malicious code to bypass script detection.

[0075] In an optional implementation of this embodiment, step S102, namely the step of detecting the creation and calling information of functions during the execution of the script being detected, further includes the following steps:

[0076] After detecting that the script being monitored has created a new function during its execution, the information of the newly created function is added to the list of uncalled functions;

[0077] Once a function in the list of uncalled functions is detected to be called, the information of the called function is removed from the list of uncalled functions.

[0078] In this optional implementation, if a function is newly created during the execution of the script being monitored, the creation information of that function can be recorded. For example, the name or other identifier of the newly created function can be added to the list of uncalled functions.

[0079] During the execution of the script being monitored, if any executed statement calls a function that has already been created, the function call information can be recorded. For example, the name or other identifier of the called function can be iterated through the list of uncalled functions. If the name or other identifier of the currently called function is in the list of uncalled functions, the information of the currently called function can be removed from the list. In this way, after the script being monitored completes execution, functions that have been created but not called can be identified, and these functions can then be called, preventing situations where script detection is bypassed because these functions are not called during normal execution.

[0080] In an optional implementation of this embodiment, the method further includes the following steps:

[0081] After detecting that the detected script has created a new function during its execution, the reference count of the newly created function in the execution environment of the detected script is increased.

[0082] In this optional implementation, if a new function is created during the execution of the script being monitored, its reference count in the execution environment is incremented. This way, after the script finishes execution, if the function has not been called, its reference count is not zero, and therefore the object corresponding to the function will not be released. This allows the function to be called later by constructing its parameters, thus triggering its execution. Otherwise, if the reference count is not incremented when the function is created, the object corresponding to the function may be released after the other objects that created the function have ended their lifetimes. This would prevent the function from being executed normally by calling its corresponding object after the script finishes execution.

[0083] In an optional implementation of this embodiment, step S104, which involves calling the previously uncalled function to determine whether the detected script is malicious based on its execution behavior, further includes the following steps:

[0084] Build the function parameters corresponding to functions that have not been called after creation;

[0085] The function that was not called after creation is invoked based on all the constructed function parameters in the execution environment of the script being detected.

[0086] In this optional implementation, as described above, during the execution of the script being detected, the creation and calling information of the created functions can be recorded. Based on this creation and calling information, it can be determined which functions were created but not called after the script being detected was executed. For functions that were created but not called, this embodiment of the disclosure can construct function parameters corresponding to the functions that were created but not called, and then call the functions that were created but not called based on the constructed function parameters, so as to trigger the execution of the functions.

[0087] In some embodiments, the function parameters corresponding to functions that have been created but not yet called can be the parameters required to execute the function, and their number and data types can be consistent with those when the function was created. Therefore, when creating the function, the number of parameters required by the object calling the function and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of parameters and the data type of each parameter. For example, if a function C(x) that has been created but not yet called has one parameter of type string, an empty string can be constructed as the function parameter, and the function C can be called. In this way, the execution of functions that have been created but not yet called can be triggered during the execution of the script being detected, thereby determining whether the function contains malicious code based on its execution behavior. Of course, it is understandable that determining whether a script being detected is malicious requires not only detecting the execution behavior of these functions that have been created but not yet called, but also detecting the execution behavior of functions executed during the normal execution of the script. If the execution behavior of any function matches a preset malicious behavior, the script being detected can be considered malicious.

[0088] In an optional implementation of this embodiment, the step of constructing the function parameters corresponding to functions that have not been called after creation further includes the following steps:

[0089] The number and data type of the function parameters corresponding to the functions that have not been called after creation are determined based on the declaration information of the functions that have not been called after creation;

[0090] The function parameters are constructed based on the number of function parameters and the default values ​​corresponding to their data types.

[0091] In this optional implementation, as described above, when creating the function, the number of parameters required to call the function object and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of function parameters and the data type of each parameter. In some embodiments, default values ​​for each data type of parameter can be pre-set. When constructing the function parameters, the default value of each parameter can be determined as the parameter value for calling the function that has not been called since its creation, thereby constructing the function parameters for calling the function that has not been called since its creation. In this way, the execution of the function that has not been called since its creation can be triggered during the execution of the script being detected, thereby enabling the determination of whether the function contains malicious code based on its execution behavior.

[0092] In an optional implementation of this embodiment, the method further includes the following steps:

[0093] Detect the execution behavior of functions in the script being tested during execution;

[0094] The script being detected is determined to be malicious based on the execution behavior.

[0095] In this optional implementation, the execution process of functions in the script being tested can be monitored to determine the function's execution behavior. If the execution behavior of a function triggers a pre-defined malicious behavior, the function's execution behavior can be considered malicious, thus identifying the script being tested as malicious. If, from the start to the end of execution, no function execution behavior triggers a pre-defined malicious behavior in the script being tested; and if the script contains a function that has been created but not yet called, and then calls that function through function parameters, and the execution process of that uncalled function does not trigger malicious behavior, then the script being tested can be identified as not malicious. The pre-defined malicious behavior can refer to existing technologies or be predefined based on actual application scenarios. For example, in some application scenarios, if the execution behavior of a function involves calling system commands, then the execution behavior can be considered to involve a pre-defined malicious behavior, indicating the presence of malicious code in the function. This approach enables comprehensive detection of the script being tested, improving the detection capabilities of malicious detection programs.

[0096] In an optional implementation of this embodiment, step S102, namely the step of detecting the creation and calling information of functions during the execution of the script being detected, further includes the following steps:

[0097] By modifying the interpreter that runs the script being tested, the interpreter can detect the creation and calling information of the functions during the execution of the script being tested.

[0098] In this optional implementation, to detect function creation and calling information during the execution of the script being tested, the interpreter executing the script can be modified so that, when interpreting and executing script statements, it can record function creation and / or function calling information if the corresponding execution instructions contain function creation and / or function calling instructions. For example, the interpreter can interpret script statements into execution instructions (such as opcodes), thereby determining whether there are instructions related to function creation and function calling based on the execution instructions, and thus recording the function creation and calling information.

[0099] In other embodiments, the interpreter executing the script being tested can be modified to find functions that have been created but not called after the script has finished executing. Based on the function's declaration information, the corresponding function parameters can be constructed, and the function can be called and executed based on the function parameters.

[0100] Figure 2 This diagram illustrates the implementation flow of script detection according to one embodiment of the present disclosure. Figure 2 As shown, a batch of script samples to be tested are collected. A virtual machine environment is established on the server, and a corresponding script interpreter is deployed within the virtual machine environment. The script interpreter is modified to detect whether the interpreted script statements contain instructions for creating and calling functions. The script samples are imported into the script interpreter for execution. The script interpreter interprets the script statements in the sample into execution instructions and checks whether these instructions contain instructions for creating functions, such as instructions for creating ordinary functions, class member functions, closure functions, lambda functions, etc. If the script interpreter detects that the current execution instructions include instructions for creating functions, it adds the creation information of that function to the list of uncalled functions and increments the function's reference count to prevent the corresponding object from being released if the function is not called. Then it returns and waits to interpret and execute the next script statement.

[0101] If the execution instruction does not contain a function creation instruction, it can also check whether the execution instruction contains an instruction to run a function. If it does contain an instruction to run a function, the script interpreter removes the function information from the list of uncalled functions in the function execution instruction, then returns and waits to interpret and execute the next script statement.

[0102] If the execution instructions do not contain any function creation instructions, it can also determine whether the script sample has finished running. If it has finished running, it checks whether the list of uncalled functions is empty. If the list of uncalled functions is not empty, it means that there are functions created but not called during the execution of the script sample. At this time, the script interpreter constructs the function parameters of the uncalled function based on the pre-set settings and attempts to call the uncalled function. It should be noted that after calling the uncalled function, the information of the function can be removed from the list of uncalled functions and returned, until the list of uncalled functions is empty.

[0103] Figure 3 A flowchart illustrating a script detection method according to an embodiment of this disclosure is shown. Figure 3 As shown, the script detection method includes the following steps:

[0104] In step S301, the script to be detected is obtained;

[0105] In step S302, a pre-deployed script detection interface is invoked to detect the script being detected. This script detection interface executes the script being detected in a virtual machine environment and detects the creation and calling information of functions during the script's execution. After the script is executed, based on the function creation and calling information, functions that have not been called after creation are identified, and functions that have not been called are invoked, so as to determine whether the script being detected is a malicious script based on its execution behavior.

[0106] In step S303, the detection result of the script being detected is output.

[0107] In this embodiment, the method can be executed in the cloud. The script detection interface can be pre-deployed in the cloud. This script detection interface can be a SaaS (Software-as-a-Service) interface. The requester can obtain the right to use the script detection interface in advance and can call the script detection interface to detect the sample when needed. This script detection interface implements the script detection method proposed in this embodiment.

[0108] In this embodiment, the requester can upload multiple scripts that need to be detected to the cloud, and the script detection interface deployed in the cloud will detect these multiple scripts and output the detection results for each script. These detection results can be returned to the requester.

[0109] The script detection interface can be pre-deployed on a cloud server, and a virtual machine environment suitable for running the script to be detected can be deployed on the cloud server. Then, a script interpreter that can interpret and execute the script to be detected can be started in the virtual machine environment.

[0110] Understandably, the scripts uploaded by the requester can be of various types, applicable to different environments, and may require different script interpreters for execution. Therefore, the script detection interface can categorize the uploaded scripts, while cloud servers can pre-deploy virtual machine environments running various script types, along with script interpreters that interpret and execute different script types within those environments.

[0111] The script detection interface deployed on the cloud server selects an appropriate virtual machine environment and script interpreter to interpret and execute the script based on its type. Various types of script interpreters deployed on the cloud server can be pre-modified to detect instructions for creating and running functions during the script's execution, thereby recording information about these functions. Furthermore, the script interpreter can be modified after the script finishes execution to detect whether any functions were created but not called during the script's execution. If such functions exist, the script interpreter can construct the necessary function parameters based on pre-defined rules and then call the function based on these parameters, thus enabling its execution.

[0112] A script detection module can also be pre-deployed on the cloud server. During the process of detecting the script being detected, the script detection interface can also start the script detection module so that during the execution of the script being detected by the script interpreter, the execution behavior of the functions run by the script being detected can be detected. Based on the execution behavior, it can be determined whether there are functions containing malicious code in the script being detected. If there are functions containing malicious code, the script being detected can be identified as a malicious script.

[0113] After all the scripts being tested have been executed, the script testing interface can return the testing results of all the scripts to the requester based on the results obtained by the script testing module.

[0114] The implementation details of script detection in the embodiments of this disclosure are described in detail below.

[0115] In this embodiment, the script is an interpretable and executable program, and the script being detected is used to detect whether it contains malicious code. To detect whether the script contains malicious code, this embodiment can execute the script in a virtual machine environment. This virtual machine environment can be deployed on a server, therefore, the script detection method can be executed on the server.

[0116] The script being tested can be interpreted and executed by a script interpreter in a virtual machine environment. The script interpreter can execute the script statements in the script being tested line by line, and during the execution of the script statements, it can detect whether there are function creation and / or function call instructions. If function creation and / or function call instructions are found, the creation information and function call information of the function can be recorded.

[0117] In some embodiments, function creation and invocation information may include function creation information and invocation information; function creation information may include, but is not limited to, the identifier of the created function, function parameter information, function creation time, function reference count, and the object referencing the function; function parameter information may include, but is not limited to, the number of parameters and the data type of each parameter. Function invocation information may include, but is not limited to, the identifier of the called function, function invocation time, the object calling the function, and whether the function was successfully invoked.

[0118] In this embodiment of the disclosure, the purpose of executing the script to be detected is to dynamically detect whether the script to be detected contains malicious code. Therefore, during the process of the interpreter interpreting and executing the script to be detected line by line, it is also possible to determine whether the script to be detected is a malicious script based on the execution behavior of each script statement.

[0119] In some embodiments, if malicious code is found in the detected script, the detected script can be considered a malicious script; if no malicious code is detected in the detected script, the detected script can be considered not a malicious script.

[0120] In some embodiments, a malicious script refers to any script added to, modified, or deleted from a software system with the purpose of causing harm or damaging system functionality. For example, traditional malicious scripts may include viruses, worms, Trojan horses, and attack scripts. Newer malicious scripts include, for example, Java attack applets and dangerous ActiveX controls. The determination of which scripts exhibit malicious behavior can refer to existing technologies or be based on the actual application scenario; this disclosure does not impose any limitations on this.

[0121] As described in the background section, some functions exist in the script. When the script is executed according to normal logic, it can be prevented from being executed, so it is impossible to dynamically detect whether there is malicious code in the function based on the execution behavior of the function.

[0122] The following example illustrates this situation:

[0123] 1. The function name or parameters passed to the script are passed from outside. The script will execute the function name or parameters specified by the parameters. Therefore, the correct parameters used to activate the malicious function cannot be obtained during dynamic detection. As a result, the function that guarantees malicious code is not triggered and executed, thus the presence of malicious code in the function cannot be detected.

[0124] 2. The script uses file fragmentation to hide functions containing malicious code in other files, and then imports these other files into the relevant functions of the currently executing script for execution, thus making it impossible to detect the presence of malicious code in the function through dynamic detection.

[0125] Currently, traditional dynamic detection techniques cannot detect malicious code in file-segmented scripts because it is difficult to aggregate all files for detection. Therefore, traditional dynamic detection methods usually perform single-file detection on script files. However, single-file detection may prevent the malicious behavior in other related files from being triggered, allowing such scripts to bypass script detection.

[0126] To address the aforementioned issues, this embodiment records function creation and invocation information during script execution. After script execution is complete, it determines, based on this creation and invocation information, whether all functions created during script execution have been called. If there are functions that have not been called throughout the process, these uncalled functions can be called, thereby enabling the determination of whether malicious code exists in the function based on its execution behavior.

[0127] In this way, during the dynamic detection of the script being detected, all functions created within the script will be invoked and executed. This avoids the problem mentioned above where some functions are not triggered during the detection process, thus bypassing script detection. In other words, in this embodiment, by detecting the creation and invocation of functions during the execution of the script, functions that were not invoked during the entire script execution are re-invoked and executed after the script has finished executing. This ensures that all functions involved in the script are executed at least once, thereby detecting their execution behavior and determining whether malicious code exists within the function based on this behavior. Finally, based on the execution behavior of all executed functions, it is determined whether the script being detected is malicious.

[0128] This disclosure addresses the dynamic detection process of malicious scripts. During the execution of the script being detected, it examines the created functions and their call information. After the script finishes execution, it determines whether any functions within the script have not been called before, based on the created functions and their call information, and calls any uncalled functions at least once. This allows for the determination of whether the script is malicious based on the execution behavior of each function. This disclosure ensures that all functions in the script being detected are called and executed, enabling a more comprehensive detection of the entire script and preventing the script from hiding functions containing malicious code to bypass script detection.

[0129] In an optional implementation of this embodiment, the step of detecting the creation and calling information of functions during the execution of the script being detected further includes the following steps:

[0130] After detecting that the script being monitored has created a new function during its execution, the information of the newly created function is added to the list of uncalled functions;

[0131] Once a function in the list of uncalled functions is detected to be called, the information of the called function is removed from the list of uncalled functions.

[0132] In this optional implementation, if a function is newly created during the execution of the script being monitored, the creation information of that function can be recorded. For example, the name or other identifier of the newly created function can be added to the list of uncalled functions.

[0133] During the execution of the script being monitored, if any executed statement calls a function that has already been created, the function call information can be recorded. For example, the name or other identifier of the called function can be iterated through the list of uncalled functions. If the name or other identifier of the currently called function is in the list of uncalled functions, the information of the currently called function can be removed from the list. In this way, after the script being monitored completes execution, functions that have been created but not called can be identified, and these functions can then be called, preventing situations where script detection is bypassed because these functions are not called during normal execution.

[0134] In an optional implementation of this embodiment, the script detection interface further performs the following operations:

[0135] After detecting that the detected script has created a new function during its execution, the reference count of the newly created function in the execution environment of the detected script is increased.

[0136] In this optional implementation, if a new function is created during the execution of the script being monitored, its reference count in the execution environment is incremented. This way, after the script finishes execution, if the function has not been called, its reference count is not zero, and therefore the object corresponding to the function will not be released. This allows the function to be called later by constructing its parameters, thus triggering its execution. Otherwise, if the reference count is not incremented when the function is created, the object corresponding to the function may be released after the other objects that created the function have ended their lifetimes. This would prevent the function from being executed normally by calling its corresponding object after the script finishes execution.

[0137] In an optional implementation of this embodiment, the step of calling a function that has not been called before, so as to determine whether the detected script is a malicious script based on the execution behavior of the detected script, further includes the following steps:

[0138] Build the function parameters corresponding to functions that have not been called after creation;

[0139] The function that was not called after creation is invoked based on all the constructed function parameters in the execution environment of the script being detected.

[0140] In this optional implementation, as described above, during the execution of the script being detected, the creation and calling information of the created functions can be recorded. Based on this creation and calling information, it can be determined which functions were created but not called after the script being detected was executed. For functions that were created but not called, this embodiment of the disclosure can construct function parameters corresponding to the functions that were created but not called, and then call the functions that were created but not called based on the constructed function parameters, so as to trigger the execution of the functions.

[0141] In some embodiments, the function parameters corresponding to functions that have been created but not yet called can be the parameters required to execute the function, and their number and data types can be consistent with those when the function was created. Therefore, when creating the function, the number of parameters required by the object calling the function and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of parameters and the data type of each parameter. For example, if a function C(x) that has been created but not yet called has one parameter of type string, an empty string can be constructed as the function parameter, and the function C can be called. In this way, the execution of functions that have been created but not yet called can be triggered during the execution of the script being detected, thereby determining whether the function contains malicious code based on its execution behavior. Of course, it is understandable that determining whether a script being detected is malicious requires not only detecting the execution behavior of these functions that have been created but not yet called, but also detecting the execution behavior of functions executed during the normal execution of the script. If the execution behavior of any function matches a preset malicious behavior, the script being detected can be considered malicious.

[0142] In an optional implementation of this embodiment, the step of constructing the function parameters corresponding to functions that have not been called after creation further includes the following steps:

[0143] The number and data type of the function parameters corresponding to the functions that have not been called after creation are determined based on the declaration information of the functions that have not been called after creation;

[0144] The function parameters are constructed based on the number of function parameters and the default values ​​corresponding to their data types.

[0145] In this optional implementation, as described above, when creating the function, the number of parameters required to call the function object and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of function parameters and the data type of each parameter. In some embodiments, default values ​​for each data type of parameter can be pre-set. When constructing the function parameters, the default value of each parameter can be determined as the parameter value for calling the function that has not been called since its creation, thereby constructing the function parameters for calling the function that has not been called since its creation. In this way, the execution of the function that has not been called since its creation can be triggered during the execution of the script being detected, thereby enabling the determination of whether the function contains malicious code based on its execution behavior.

[0146] In an optional implementation of this embodiment, the script detection interface further performs the following operations:

[0147] Detect the execution behavior of functions in the script being tested during execution;

[0148] The script being detected is determined to be malicious based on the execution behavior.

[0149] In this optional implementation, the execution process of functions in the script being tested can be monitored to determine the function's execution behavior. If the execution behavior of a function triggers a pre-defined malicious behavior, the function's execution behavior can be considered malicious, thus identifying the script being tested as malicious. If, from the start to the end of execution, no function execution behavior triggers a pre-defined malicious behavior in the script being tested; and if the script contains a function that has been created but not yet called, and then calls that function through function parameters, and the execution process of that uncalled function does not trigger malicious behavior, then the script being tested can be identified as not malicious. The pre-defined malicious behavior can refer to existing technologies or be predefined based on actual application scenarios. For example, in some application scenarios, if the execution behavior of a function involves calling system commands, then the execution behavior can be considered to involve a pre-defined malicious behavior, indicating the presence of malicious code in the function. This approach enables comprehensive detection of the script being tested, improving the detection capabilities of malicious detection programs.

[0150] In an optional implementation of this embodiment, the step of detecting the creation and calling information of functions during the execution of the script being detected further includes the following steps:

[0151] By modifying the interpreter that runs the script being tested, the interpreter can detect the creation and calling information of the functions during the execution of the script being tested.

[0152] In this optional implementation, to detect function creation and calling information during the execution of the script being tested, the interpreter executing the script can be modified so that, when interpreting and executing script statements, it can record function creation and / or function calling information if the corresponding execution instructions contain function creation and / or function calling instructions. For example, the interpreter can interpret script statements into execution instructions (such as opcodes), thereby determining whether there are instructions related to function creation and function calling based on the execution instructions, and thus recording the function creation and calling information.

[0153] In other embodiments, the interpreter executing the script being tested can be modified to find functions that have been created but not called after the script has finished executing. Based on the function's declaration information, the corresponding function parameters can be constructed, and the function can be called and executed based on the function parameters.

[0154] Figure 4 This diagram illustrates an application scenario for script detection according to one embodiment of the present disclosure. For example... Figure 4 As shown, the first server collects script samples to be detected and sends them to the second server.

[0155] Personnel can write program code on a local device to modify an existing script interpreter. This program code adds the following functions to the script interpreter: 1. When interpreting and executing a script statement, check if the corresponding execution instructions include a function creation instruction. If so, add the created function's information to the list of uncalled functions. 2. When interpreting and executing a script statement, check if the corresponding execution instructions include a function call instruction. If so, remove the function's information from the list of uncalled functions. 3. After the script execution is complete, check if the list of uncalled functions is empty. If it is not empty, construct the function parameters for the uncalled function and attempt to call it.

[0156] The relevant personnel uploaded the program code that modified the script interpreter to the second server and ran it to modify the script interpreter on the second server. Furthermore, the relevant personnel could also deploy a virtual machine environment on the second server to run the script sample to be tested, and start the script interpreter within that virtual machine environment.

[0157] After receiving the script sample, the second server imports it into the script interpreter for interpretation and execution. The second server also detects the execution behavior of the functions run during the execution of the script sample. If the execution behavior involves preset malicious behavior, the script sample is identified as a malicious script and the detection result is output.

[0158] After all the script samples have been executed, the second server can return a list of information about the malicious scripts to the first server.

[0159] The following are embodiments of the apparatus disclosed herein, which can be used to execute the embodiments of the apparatus disclosed herein.

[0160] Figure 5 A structural block diagram of a script detection apparatus according to an embodiment of the present disclosure is shown. This apparatus can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 5 As shown, the script detection device includes:

[0161] Execution module 501 is configured to execute the script being detected;

[0162] The first detection module 502 is configured to detect the creation and calling information of functions during the execution of the script being detected;

[0163] The first determining module 503 is configured to determine, after the execution of the script being detected, functions that have not been called after creation based on the function creation and calling information;

[0164] The first calling module 504 is configured to call the function that has not been called before, so as to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

[0165] In this embodiment, a script is an interpretable and executable program, and the script being detected is used to detect whether it contains malicious code. To detect whether the script contains malicious code, this embodiment can execute the script in a virtual machine environment. This virtual machine environment can be deployed on a server, therefore the script detection device can be executed on the server.

[0166] The script being tested can be interpreted and executed by a script interpreter in a virtual machine environment. The script interpreter can execute the script statements in the script being tested line by line, and during the execution of the script statements, it can detect whether there are function creation and / or function call instructions. If function creation and / or function call instructions are found, the creation information and function call information of the function can be recorded.

[0167] In some embodiments, function creation and invocation information may include function creation information and invocation information; function creation information may include, but is not limited to, the identifier of the created function, function parameter information, function creation time, function reference count, and the object referencing the function; function parameter information may include, but is not limited to, the number of parameters and the data type of each parameter. Function invocation information may include, but is not limited to, the identifier of the called function, function invocation time, the object calling the function, and whether the function was successfully invoked.

[0168] In this embodiment of the disclosure, the purpose of executing the script to be detected is to dynamically detect whether the script to be detected contains malicious code. Therefore, during the process of the interpreter interpreting and executing the script to be detected line by line, it is also possible to determine whether the script to be detected is a malicious script based on the execution behavior of each script statement.

[0169] In some embodiments, if malicious code is found in the detected script, the detected script can be considered a malicious script; if no malicious code is detected in the detected script, the detected script can be considered not a malicious script.

[0170] In some embodiments, a malicious script refers to any script added to, modified, or deleted from a software system with the purpose of causing harm or damaging system functionality. For example, traditional malicious scripts may include viruses, worms, Trojan horses, and attack scripts. Newer malicious scripts include, for example, Java attack applets and dangerous ActiveX controls. The determination of which scripts exhibit malicious behavior can refer to existing technologies or be based on the actual application scenario; this disclosure does not impose any limitations on this.

[0171] As described in the background section, some functions exist in the script. When the script is executed according to normal logic, it can be prevented from being executed, so it is impossible to dynamically detect whether there is malicious code in the function based on the execution behavior of the function.

[0172] The following example illustrates this situation:

[0173] 1. The function name or parameters passed to the script are passed from outside. The script will execute the function name or parameters specified by the parameters. Therefore, the correct parameters used to activate the malicious function cannot be obtained during dynamic detection. As a result, the function that guarantees malicious code is not triggered and executed, thus the presence of malicious code in the function cannot be detected.

[0174] 2. The script uses file fragmentation to hide functions containing malicious code in other files, and then imports these other files into the relevant functions of the currently executing script for execution, thus making it impossible to detect the presence of malicious code in the function through dynamic detection.

[0175] Currently, traditional dynamic detection technologies cannot detect malicious code in file-segmented scripts because it is difficult to aggregate all files for detection. Therefore, traditional dynamic detection devices usually detect script files in a single-file manner. However, single-file detection will prevent the malicious behavior in other related files from being triggered, thus allowing such scripts to bypass script detection.

[0176] To address the aforementioned issues, this embodiment records function creation and invocation information during script execution. After script execution is complete, it determines, based on this creation and invocation information, whether all functions created during script execution have been called. If there are functions that have not been called throughout the process, these uncalled functions can be called, thereby enabling the determination of whether malicious code exists in the function based on its execution behavior.

[0177] In this way, during the dynamic detection of the script being detected, all functions created within the script will be invoked and executed. This avoids the problem mentioned above where some functions are not triggered during the detection process, thus bypassing script detection. In other words, in this embodiment, by detecting the creation and invocation of functions during the execution of the script, functions that were not invoked during the entire script execution are re-invoked and executed after the script has finished executing. This ensures that all functions involved in the script are executed at least once, thereby detecting their execution behavior and determining whether malicious code exists within the function based on this behavior. Finally, based on the execution behavior of all executed functions, it is determined whether the script being detected is malicious.

[0178] This disclosure addresses the dynamic detection process of malicious scripts. During the execution of the script being detected, it examines the created functions and their call information. After the script finishes execution, it determines whether any functions within the script have not been called before, based on the created functions and their call information, and calls any uncalled functions at least once. This allows for the determination of whether the script is malicious based on the execution behavior of each function. This disclosure ensures that all functions in the script being detected are called and executed, enabling a more comprehensive detection of the entire script and preventing the script from hiding functions containing malicious code to bypass script detection.

[0179] In an optional implementation of this embodiment, the first detection module includes:

[0180] A submodule is added and configured to add the information of the newly created function to the list of uncalled functions after it is detected that a new function has been created during the execution of the script being monitored.

[0181] The deletion submodule is configured to remove the information of the called function from the list of uncalled functions after detecting that a function in the list of uncalled functions has been called.

[0182] In this optional implementation, if a function is newly created during the execution of the script being monitored, the creation information of that function can be recorded. For example, the name or other identifier of the newly created function can be added to the list of uncalled functions.

[0183] During the execution of the script being monitored, if any executed statement calls a function that has already been created, the function call information can be recorded. For example, the name or other identifier of the called function can be iterated through the list of uncalled functions. If the name or other identifier of the currently called function is in the list of uncalled functions, the information of the currently called function can be removed from the list. In this way, after the script being monitored completes execution, functions that have been created but not called can be identified, and these functions can then be called, preventing situations where script detection is bypassed because these functions are not called during normal execution.

[0184] In an optional implementation of this embodiment, the apparatus further includes:

[0185] An additional module is configured to increment the reference count of the newly created function in the execution environment of the script being monitored after detecting that the script being monitored has created a new function during its execution.

[0186] In this optional implementation, if a new function is created during the execution of the script being monitored, its reference count in the execution environment is incremented. This way, after the script finishes execution, if the function has not been called, its reference count is not zero, and therefore the object corresponding to the function will not be released. This allows the function to be called later by constructing its parameters, thus triggering its execution. Otherwise, if the reference count is not incremented when the function is created, the object corresponding to the function may be released after the other objects that created the function have ended their lifetimes. This would prevent the function from being executed normally by calling its corresponding object after the script finishes execution.

[0187] In an optional implementation of this embodiment, the first calling module includes:

[0188] The first build submodule is configured to be the function parameters corresponding to functions that are not called after the build is created;

[0189] The calling submodule is configured to invoke the function that was not called after creation, based on all the function parameters built, in the execution environment of the script being detected.

[0190] In this optional implementation, as described above, during the execution of the script being detected, the creation and calling information of the created functions can be recorded. Based on this creation and calling information, it can be determined which functions were created but not called after the script being detected was executed. For functions that were created but not called, this embodiment of the disclosure can construct function parameters corresponding to the functions that were created but not called, and then call the functions that were created but not called based on the constructed function parameters, so as to trigger the execution of the functions.

[0191] In some embodiments, the function parameters corresponding to functions that have been created but not yet called can be the parameters required to execute the function, and their number and data types can be consistent with those when the function was created. Therefore, when creating the function, the number of parameters required by the object calling the function and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of parameters and the data type of each parameter. For example, if a function C(x) that has been created but not yet called has one parameter of type string, an empty string can be constructed as the function parameter, and the function C can be called. In this way, the execution of functions that have been created but not yet called can be triggered during the execution of the script being detected, thereby determining whether the function contains malicious code based on its execution behavior. Of course, it is understandable that determining whether a script being detected is malicious requires not only detecting the execution behavior of these functions that have been created but not yet called, but also detecting the execution behavior of functions executed during the normal execution of the script. If the execution behavior of any function matches a preset malicious behavior, the script being detected can be considered malicious.

[0192] In an optional implementation of this embodiment, the first construction submodule includes:

[0193] The determination submodule is configured to determine the number and data type of function parameters corresponding to the functions that have not been called after creation based on the declaration information of the functions that have not been called after creation;

[0194] The second construction submodule is configured to construct the function parameters based on the number of function parameters and the default values ​​corresponding to the data types of the parameters.

[0195] In this optional implementation, as described above, when creating the function, the number of parameters required to call the function object and the data type of each parameter can be recorded. When constructing the function parameters, the corresponding parameters can be constructed based on the number of function parameters and the data type of each parameter. In some embodiments, default values ​​for each data type of parameter can be pre-set. When constructing the function parameters, the default value of each parameter can be determined as the parameter value for calling the function that has not been called since its creation, thereby constructing the function parameters for calling the function that has not been called since its creation. In this way, the execution of the function that has not been called since its creation can be triggered during the execution of the script being detected, thereby enabling the determination of whether the function contains malicious code based on its execution behavior.

[0196] In an optional implementation of this embodiment, the apparatus further includes:

[0197] The second detection module is configured to detect the execution behavior of functions in the script being detected during execution.

[0198] The second determination module is configured to determine whether the detected script is a malicious script based on the execution behavior.

[0199] In this optional implementation, the execution process of functions in the script being tested can be monitored to determine the function's execution behavior. If the execution behavior of a function triggers a pre-defined malicious behavior, the function's execution behavior can be considered malicious, thus identifying the script being tested as malicious. If, from the start to the end of execution, no function execution behavior triggers a pre-defined malicious behavior in the script being tested; and if the script contains a function that has been created but not yet called, and then calls that function through function parameters, and the execution process of that uncalled function does not trigger malicious behavior, then the script being tested can be identified as not malicious. The pre-defined malicious behavior can refer to existing technologies or be predefined based on actual application scenarios. For example, in some application scenarios, if the execution behavior of a function involves calling system commands, then the execution behavior can be considered to involve a pre-defined malicious behavior, indicating the presence of malicious code in the function. This approach enables comprehensive detection of the script being tested, improving the detection capabilities of malicious detection programs.

[0200] In an optional implementation of this embodiment, the first detection module includes:

[0201] The modification submodule is configured to modify the interpreter running the script being tested so that the interpreter can detect the creation and calling information of the functions during the execution of the script being tested.

[0202] In this optional implementation, to detect function creation and calling information during the execution of the script being tested, the interpreter executing the script can be modified so that, when interpreting and executing script statements, it can record function creation and / or function calling information if the corresponding execution instructions contain function creation and / or function calling instructions. For example, the interpreter can interpret script statements into execution instructions (such as opcodes), thereby determining whether there are instructions related to function creation and function calling based on the execution instructions, and thus recording the function creation and calling information.

[0203] In other embodiments, the interpreter executing the script being tested can be modified to find functions that have been created but not called after the script has finished executing. Based on the function's declaration information, the corresponding function parameters can be constructed, and the function can be called and executed based on the function parameters.

[0204] Figure 6 A structural block diagram of a script detection apparatus according to another embodiment of the present disclosure is shown. This apparatus can be implemented as part or all of an electronic device through software, hardware, or a combination of both. Figure 6 As shown, the script detection device includes:

[0205] Module 601 is configured to acquire the script being detected.

[0206] The second calling module 602 is configured to call a pre-deployed script detection interface to detect the script being detected. The script detection interface executes the script being detected in a virtual machine environment and detects the creation and calling information of functions during the execution of the script. After the script being detected completes execution, it determines functions that have not been called since creation based on the function creation and calling information, and calls those functions that have not been called, so as to determine whether the script being detected is a malicious script based on its execution behavior.

[0207] Output module 603 is configured to output the detection results of the script being detected.

[0208] In this embodiment, the device can be executed in the cloud. The script detection interface can be pre-deployed in the cloud. This script detection interface can be a SaaS (Software-as-a-Service) interface. The requester can obtain the right to use the script detection interface in advance and can call the script detection interface to detect the sample when needed. This script detection interface implements the script detection device proposed in this embodiment.

[0209] In this embodiment, the requester can upload multiple scripts that need to be detected to the cloud, and the script detection interface deployed in the cloud will detect these multiple scripts and output the detection results for each script. These detection results can be returned to the requester.

[0210] The script detection interface can be pre-deployed on a cloud server, and a virtual machine environment suitable for running the script to be detected can be deployed on the cloud server. Then, a script interpreter that can interpret and execute the script to be detected can be started in the virtual machine environment.

[0211] Understandably, the scripts uploaded by the requester can be of various types, applicable to different environments, and may require different script interpreters for execution. Therefore, the script detection interface can categorize the uploaded scripts, while cloud servers can pre-deploy virtual machine environments running various script types, along with script interpreters that interpret and execute different script types within those environments.

[0212] The script detection interface deployed on the cloud server selects an appropriate virtual machine environment and script interpreter to interpret and execute the script based on its type. Various types of script interpreters deployed on the cloud server can be pre-modified to detect instructions for creating and running functions during the script's execution, thereby recording information about these functions. Furthermore, the script interpreter can be modified after the script finishes execution to detect whether any functions were created but not called during the script's execution. If such functions exist, the script interpreter can construct the necessary function parameters based on pre-defined rules and then call the function based on these parameters, thus enabling its execution.

[0213] A script detection module can also be pre-deployed on the cloud server. During the process of detecting the script being detected, the script detection interface can also start the script detection module so that during the execution of the script being detected by the script interpreter, the execution behavior of the functions run by the script being detected can be detected. Based on the execution behavior, it can be determined whether there are functions containing malicious code in the script being detected. If there are functions containing malicious code, the script being detected can be identified as a malicious script.

[0214] After all the scripts being tested have been executed, the script testing interface can return the testing results of all the scripts to the requester based on the results obtained by the script testing module.

[0215] The specific implementation details of the script detection can be found in the description above, and will not be repeated here.

[0216] Figure 7 This is a schematic diagram of the structure of an electronic device suitable for implementing the script detection method according to embodiments of the present disclosure.

[0217] like Figure 7 As shown, the electronic device 700 includes a processing unit 701, which can be implemented as a CPU, GPU, FPGA, NPU, or other processing unit. The processing unit 701 can execute various processes according to any of the methods described above in this disclosure, based on a program stored in the read-only memory (ROM) 702 or a program loaded from the storage portion 708 into the random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the electronic device 700. The processing unit 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0218] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0219] In particular, according to embodiments of this disclosure, any of the methods described above in the embodiments of this disclosure can be implemented as a computer software program. For example, embodiments of this disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing program code for performing any of the methods in the embodiments of this disclosure. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711.

[0220] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0221] The units or modules described in the embodiments of this disclosure can be implemented in software or hardware. The described units or modules can also be located in a processor, and the names of these units or modules do not necessarily constitute a limitation on the unit or module itself.

[0222] In another aspect, this disclosure also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the apparatus described in the above embodiments; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores one or more programs that are used by one or more processors to perform the methods described in this disclosure.

[0223] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

Claims

1. A script detection method, wherein, include: Execute the script being detected; After detecting that the script being monitored has created a new function during its execution, the information of the newly created function is added to the list of uncalled functions; After detecting that a function in the list of uncalled functions has been called, the information of the called function is removed from the list of uncalled functions; After the script being detected has been executed, functions that have not been called since their creation are identified based on the function creation and calling information. The function that has not been called before is invoked in order to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

2. The method according to claim 1, wherein, The method further includes: After detecting that the detected script has created a new function during its execution, the reference count of the newly created function in the execution environment of the detected script is increased.

3. The method according to claim 1 or 2, wherein, Calling functions that have not been called before, in order to determine whether the detected script is a malicious script based on the execution behavior of the detected script, includes: Build the function parameters corresponding to functions that have not been called after creation; The function that was not called after creation is invoked based on all the constructed function parameters in the execution environment of the script being detected.

4. The method according to claim 3, wherein, The function parameters corresponding to the functions that are not called after the construction is completed include: The number and data type of the function parameters corresponding to the functions that have not been called after creation are determined based on the declaration information of the functions that have not been called after creation; The function parameters are constructed based on the number of function parameters and the default values ​​corresponding to their data types.

5. The method according to any one of claims 1-2 and 4, wherein, The method further includes: Detect the execution behavior of functions in the script being tested during execution; The script being detected is determined to be malicious based on the execution behavior.

6. The method according to any one of claims 1-2 and 4, wherein, The detection process includes identifying the creation and invocation information of functions during the execution of the script being tested, including: By modifying the interpreter that runs the script being tested, the interpreter can detect the creation and calling information of the functions during the execution of the script being tested.

7. A script detection method, wherein, include: Obtain the script to be detected; A pre-deployed script detection interface is invoked to detect the script being detected. This interface executes the script in a virtual machine environment. Upon detecting that a new function has been created during the script's execution, the interface adds the newly created function to a list of uncalled functions. Upon detecting that a function in the uncalled function list has been called, the called function is removed from the list. After the script finishes execution, based on the function creation and calling information, functions that have not been called since creation are identified, and functions that have not been called are invoked, in order to determine whether the script is malicious based on its execution behavior. Output the detection results of the script being detected.

8. A script detection device, wherein, include: The execution module is configured to execute the script being monitored. The first detection module is configured to add the information of the newly created function to the list of uncalled functions after detecting that the detected script has created a new function during its execution. After detecting that a function in the list of uncalled functions has been called, the information of the called function is removed from the list of uncalled functions; The first determining module is configured to determine, after the execution of the script being detected is completed, functions that have not been called after creation based on the function creation and calling information; The first calling module is configured to call the function that has not been called before, so as to determine whether the script being detected is a malicious script based on the execution behavior of the script being detected.

9. A computer program product comprising computer instructions, wherein, When executed by a processor, the computer instructions implement the method described in any one of claims 1-7.

Images