Script detection method, device, equipment and storage medium

Abstract

The embodiments of the present application provide a script detection method, apparatus, device and storage medium, the method comprising: obtaining a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; determining a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes of the malicious code attribute graph; obtaining corresponding parent node information according to preprocessing of the malicious code attribute graph; the parent node information combines the connection information between the matching sequence and the malicious node; determining the next matching node pair according to the matching sequence and the parent node information, and adding it to the current state space; when the current state space meets a preset condition, determining that the malicious script matches the target script. The embodiments of the present application prune the state space based on the parent node information, reduce the matching content, and thus improve the script matching accuracy and detection efficiency.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of information security technology, and in particular, to a script detection method and device, an electronic device, and a storage medium. Background Art

[0002] With the continuous development of computer technology, people pay more and more attention to information security. Script detection is an important way to proactively prevent security incidents such as data leakage and data tampering. By detecting the scripts written by developers, abnormal scripts / malicious scripts can be found before being attacked, thus reducing losses.

[0003] Malicious script protection is an important aspect of host protection. In related technologies, malicious scripts are mainly detected statically. Common static detection methods mainly include similarity-based detection methods and machine learning-based detection methods. Specifically, similarity-based detection methods describe code segments abstractly through code representation and code segment level, and then use the representation of the code segment to be detected and the representation of known malicious scripts to judge their similarity. Common representations include text, metrics, tags, trees and graphs. Among them, graph-based representations contain semantic and grammatical information, which is the most comprehensive and the most accurate. Machine learning-based detection methods classify text by extracting attribute features of the code, thereby detecting malicious scripts. Common attribute features include system function call information, etc. The attribute feature extraction stage of machine learning-based detection methods relies on subjective experience and requires specific analysis of script vulnerabilities. In addition, the detection results are not intuitive enough and the false alarm rate is high.

[0004] In view of the problems existing in the above detection methods, it is urgent to propose a script detection method to improve the script matching accuracy, detection efficiency, and scalability of the detection method. Summary of the invention

[0005] The embodiment of the present application provides a script detection method based on subgraph matching to solve the problem of improving the accuracy, efficiency and scalability of script matching.

[0006] Correspondingly, an embodiment of the present application also provides a script detection device, an electronic device and a storage medium to ensure the implementation and application of the above method.

[0007] In order to solve the above problems, an embodiment of the present application discloses a script detection method, which includes:

[0008] Obtain a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and an edge connecting the target node, and the malicious code attribute graph includes a malicious node and an edge connecting the malicious node, wherein the node has corresponding node information and the edge has corresponding edge information;

[0009] Determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph;

[0010] Acquire corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node;

[0011] Determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space;

[0012] When the current state space meets a preset condition, it is determined that the malicious script matches the target script.

[0013] Optionally, the method further comprises:

[0014] Get the script to be tested;

[0015] The script is subjected to obfuscation conversion processing to obtain an obfuscated target script; the obfuscation conversion processing at least includes variable conversion, alias conversion, relative path conversion to absolute path and obfuscation semantic conversion.

[0016] Optionally, determining a matching sequence for the malicious code attribute graph includes:

[0017] Comparing the node mapping degrees of malicious nodes in the malicious code attribute graph;

[0018] If the node mapping degrees are the same, the node probabilities of the malicious nodes are compared; the node probabilities are generated according to the node information, the edge information, the node in-degree and the node out-degree;

[0019] If the node probabilities are the same, compare the node in-degree and node out-degree of the malicious node;

[0020] By comparison, all malicious nodes in the malicious code attribute graph are sequentially added to the matching sequence.

[0021] Optionally, the parent node of the malicious node is the adjacent node that appears earliest before the malicious node in the matching sequence, and determining the next matching node pair according to the matching sequence and the malicious parent node information includes:

[0022] Acquire a previous state space, wherein the previous state space includes a matched node pair, the matched node pair includes a previous matched node pair, and the previous matched node pair includes a previous matched malicious node and a previous matched target node;

[0023] Determine a next matching malicious node of the previous matching malicious node, where the next matching malicious node is the next malicious node corresponding to the previous matching malicious node in the matching sequence;

[0024] Determine a candidate matching target node of the previous matching target node; the candidate matching target node is a target node in the target code graph that is not in the previous state space and has the same node information as the next matching malicious node;

[0025] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is the successor node of its parent node, a node which is the successor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node;

[0026] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is a predecessor node of its parent node, a node which is a predecessor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node;

[0027] The next matching malicious node and the next matching target node are added to the previous state space as a next matching node pair to obtain a current state space.

[0028] Optionally, the method further comprises:

[0029] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is empty, a node whose node information matches is randomly selected from the candidate matching target nodes as the next matching target node.

[0030] Optionally, when the current state space satisfies a preset condition, determining that the malicious script matches the target script includes:

[0031] When the current state space satisfies the preset semantic information rule and the preset topological structure information, and the next matching malicious node in the current state space is the last malicious node in the matching sequence, it is determined that the malicious script matches the target script.

[0032] Optionally, the node information includes a node label, and the edge information includes an edge label.

[0033] The present application also discloses a script detection device, which includes:

[0034] A code attribute graph acquisition module, used to acquire a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and an edge connecting the target node, and the malicious code attribute graph includes a malicious node and an edge connecting the malicious node, wherein the node has corresponding node information and the edge has corresponding edge information;

[0035] A matching sequence determination module, used to determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph;

[0036] A parent node information acquisition module, used to obtain corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node;

[0037] A current state space determination module, used to determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space;

[0038] The script matching determination module is used to determine whether the malicious script matches the target script when the current state space meets a preset condition.

[0039] Optionally, the device also includes: an obfuscation conversion module, used to obtain a script to be detected; perform obfuscation conversion processing on the script to obtain a target script after obfuscation conversion; the obfuscation conversion processing at least includes variable conversion, alias conversion, relative path conversion to absolute path and obfuscation semantic conversion.

[0040] Optionally, the matching sequence determination module is used to compare the node mapping degrees of malicious nodes in the malicious code attribute graph; if the node mapping degrees are the same, the node probabilities of the malicious nodes are compared; the node probabilities are generated based on node information, edge information, node in-degree and node out-degree; if the node probabilities are the same, the node in-degree and node out-degree of the malicious nodes are compared; through comparison, all malicious nodes in the malicious code attribute graph are added to the matching sequence in sequence.

[0041] Optionally, the parent node of the malicious node is the adjacent node that appears earliest before the malicious node in the matching sequence, and the current state space determination module is used to obtain a previous state space, the previous state space includes a matched node pair, the matched node pair includes a previous matched node pair, the previous matched node pair includes a previous matched malicious node and a previous matched target node; determine the next matching malicious node of the previous matching malicious node, the next matching malicious node is the next malicious node corresponding to the previous matching malicious node in the matching sequence; determine a candidate matching target node of the previous matching target node; the candidate matching target node is a target node in the target code graph that is not in the previous state space and has the same node information as the next matching malicious node; when the next matching is determined according to the malicious parent node information When the parent node of the malicious node is not empty, if the next matching malicious node is the successor node of its parent node, then the successor node of the node corresponding to the previous matching malicious node and the node with the same node information and edge information as the next matching malicious node are randomly selected from the candidate matching target nodes as the next matching target node; when it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is the predecessor node of its parent node, then the node that is the predecessor node of the node corresponding to the previous matching malicious node and the node with the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node; the next matching malicious node and the next matching target node are added to the previous state space as a next matching node pair to obtain the current state space.

[0042] Optionally, the current state space determination module is used to randomly select a node with matching node information from the candidate matching target nodes as the next matching target node when it is determined according to the malicious parent node information that the parent node of the next matching malicious node is empty.

[0043] Optionally, the script matching determination module is used to determine that the malicious script matches the target script when the current state space satisfies preset semantic information rules and preset topological structure information, and the next matching malicious node in the current state space is the last malicious node in the matching sequence.

[0044] An embodiment of the present application further discloses an electronic device, including: a processor; and a memory, on which executable code is stored. When the executable code is executed, the processor executes the script detection method as described in one or more of the embodiments of the present application.

[0045] The embodiments of the present application also disclose one or more machine-readable media on which executable codes are stored. When the executable codes are executed, the processor executes the script detection method as described in one or more of the embodiments of the present application.

[0046] Compared with the prior art, the embodiments of the present application have the following advantages:

[0047] In an embodiment of the present application, a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script are obtained, a matching sequence is determined for the malicious code attribute graph, and corresponding parent node information is obtained according to the malicious code attribute graph preprocessing, wherein the parent node information combines the matching sequence and the connection information between the malicious nodes, and the next matching node pair is determined according to the matching sequence and the parent node information, and added to the current state space, and when the current state space meets the preset conditions, it is determined that the malicious script matches the target script. The embodiment of the present application prunes the current state space based on the parent node information, reduces the matching content, and thus improves the script matching accuracy and detection efficiency. In addition, the embodiment of the present invention is scalable. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a flowchart of the steps of an embodiment of a script detection method of the present application;

[0049] Figure 2 It is a code property graph based on shell script in this application;

[0050] Figure 3 This is a code schematic diagram of obtaining the next matching node pair in the present application;

[0051] Figure 4 This is a schematic diagram of obtaining matching nodes in the present application;

[0052] Figure 5 It is a matching code schematic diagram of the present application;

[0053] Figure 6 It is a flowchart of converting a shell script of the present application into a code property graph;

[0054] Figure 7 It is a matching flow chart of this application;

[0055] Figure 8 It is a structural block diagram of an embodiment of a script detection device of the present application;

[0056] Fig. 9 It is a schematic diagram of the structure of a device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0057] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0058] In the related art, the commonly used detection methods for malicious scripts include detection methods based on code similarity and detection methods based on machine learning. Among them, the detection method based on code similarity detects malicious code by comparing the code to be detected with the malicious code library. Common code representation methods include text-based, tree-based, and graph-based representation methods. Among these representation methods, the code information represented in the graph-based representation is the most comprehensive, where the nodes of the graph represent expressions or statements, and the edges represent control flow, control dependency, or data dependency. By analyzing the grammatical structure of the source code and the function call relationship, control dependency relationship, data flow, etc., a program dependency graph is constructed, and subgraph matching is performed to discover malicious code. The current subgraph matching vulnerability detection method needs to comprehensively consider the grammatical and semantic features of the program, and has good detection capabilities, but the cost of establishing the graph structure is very high, and the matching algorithm for finding graph similarities is highly complex and has low time and space efficiency.

[0059] The detection method based on machine learning requires manual definition of feature attributes, and then uses machine learning methods such as support vector machines and k-nearest neighbors for classification. This type of method relies on experts to manually define feature attributes, and because the code granularity input into the machine learning model is usually coarse, it is impossible to determine the exact location of the vulnerability line, and the detection result is not intuitive enough. For example: a static detection method for malicious scripts based on support vector machines, the method includes the following steps: 1. crawling web pages from the Internet to obtain web page links; 2. obtaining the Javascript script content corresponding to the link; 3. analyzing the features of script-based web intrusions such as SQL injection, obtaining intrusion-related features, and extracting features from the obtained script content based on the intrusion features, and converting each script into a feature-based feature vector; 4. using the classification algorithm SVM to obtain a classification model, and using the model to classify the obtained feature vector.

[0060] To this end, an embodiment of the present application proposes a script detection method based on subgraph matching, which improves the script matching accuracy and detection efficiency by pruning the state space.

[0061] Reference Figure 1 , is a flowchart of a script detection method embodiment of the present application, comprising the following steps:

[0062] Step 102: Obtain a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and edges connecting the target nodes, and the malicious code attribute graph includes malicious nodes and edges connecting the malicious nodes, wherein the nodes have corresponding node information and the edges have corresponding edge information.

[0063] In a specific implementation, the script detection method of the embodiment of the present application can be implemented in a terminal device or a server. Among them, the terminal device can be a terminal specifically used for script detection, or it can be an ordinary computer terminal on which an application for script detection is installed. The embodiment of the terminal device includes a desktop computer, a portable computer, a mobile phone, a personal digital assistant (PDA), and a vehicle-mounted device. The server can be an independent server or a server cluster composed of multiple servers.

[0064] The script (script code / code) can be a shell script. A code property graph is a data structure that describes the code, combining the code's abstract syntax tree, control flow graph, and program dependency graph. Figure 3 Partial information. The code attribute graph includes nodes and edges for connecting nodes, wherein the nodes have corresponding node information, the edges have corresponding edge information, the node information includes node labels, and the edge information includes edge labels. Specifically, a node in the code attribute graph is the intersection of one or more edges, the node is connected to a neighbor node through an edge (for example, the node is connected to its parent node or its child node through an edge), and the edge represents the association relationship between the node connected to the edge and the neighbor node of the node.

[0065] In the embodiment of the present application, the code attribute graph of the target script to be detected is the target code attribute graph, and the code attribute graph of the known malicious script is the malicious code attribute graph. As an optional example, the user can upload the target code attribute graph and the malicious code attribute graph to the terminal device or server, or the terminal device or server can grab the target code attribute graph and the malicious code attribute graph from a specified location. Among them, the malicious code attribute graph is the object to be searched, and the target code attribute graph is the object in which the isomorphic graph of the malicious code attribute graph is searched.

[0066] In an embodiment of the present application, code property graphs are constructed for the malicious code library and the target detection code respectively. The specific analysis process includes: analyzing the script, constructing a syntax analysis tree, a function flow chart and a program dependency graph, and combining the three parts of information to construct a code property graph. Among them, the nodes in the code property graph mainly include shell command nodes, function nodes, variable nodes, operator nodes, etc., and the edges mainly include syntax tree edges, function dependency edges, control flow edges, etc.

[0067] For example, the following shell script:

[0068]

[0069]

[0070] Reference Figure 2 , is a code attribute graph based on shell scripts, in which the edge 202 represents the data flow, the edge 204 represents the control relationship, and the remaining edges represent the connection in the syntax tree. Specifically, FunDecl represents the function definition node in the syntax tree, Assign represents the assignment node, ForClause represents the for loop statement, Loop represents the judgment statement in the For statement, the Do node represents the execution body part in the For statement, and CallExpr represents the method call. Of course, in practice, there are many more nodes and edges in the syntax tree, which are not listed here one by one, but it should be understood that the embodiments of the present application are not limited to the above examples.

[0071] Step 104: determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph.

[0072] Step 106: Obtain corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node.

[0073] Step 108: Determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space.

[0074] The matching sequence is a sequence list of all malicious nodes in the malicious code attribute graph. The parent node information is the connection information between malicious nodes in the malicious code attribute graph. For example, for a malicious node, its parent node can be determined based on the parent node information.

[0075] When the script detection starts, a state space is created, and in the script detection process, matching node pairs composed of malicious nodes in the malicious code attribute graph and target nodes in the target code attribute graph are continuously added to the state space. In an embodiment of the present application, the parent node information of each malicious node in the malicious code attribute graph is constructed to facilitate the subsequent script detection process to quickly obtain matching nodes to be added to the state space.

[0076] Step 110: When the current state space meets a preset condition, determine that the malicious script matches the target script.

[0077] In the embodiment of the present invention, when the current state space meets the preset conditions, it can be determined that the malicious script matches the target script, and the target script can also be determined as a malicious script. Of course, if the current state space does not meet the preset conditions, it can be determined that the malicious script does not match the target script, and the target script can also be determined as a normal script.

[0078] The embodiment of the present application is based on a subgraph script detection method, which matches the code to be detected with the malicious code library through an automated process. The entire process does not require the extraction of script features or reliance on subjective experience. The results are highly interpretable and more accurate.

[0079] In the above-mentioned script detection method, the target code attribute graph of the target script to be detected and the malicious code attribute graph of the known malicious script are obtained, a matching sequence is determined for the malicious code attribute graph, and the corresponding parent node information is obtained according to the preprocessing of the malicious code attribute graph, wherein the parent node information combines the matching sequence and the connection information between the malicious nodes, and the next matching node pair is determined according to the matching sequence and the parent node information, and added to the current state space, and when the current state space meets the preset conditions, it is determined that the malicious script matches the target script. The embodiment of the present application prunes the current state space based on the parent node information, reduces the matching content, and thus improves the script matching accuracy and detection efficiency. In addition, the embodiment of the present invention is scalable.

[0080] In an exemplary embodiment, the method may further include the following steps:

[0081] Get the script to be tested;

[0082] The script is subjected to obfuscation conversion processing to obtain an obfuscated target script; the obfuscation conversion processing at least includes variable conversion, alias conversion, relative path conversion to absolute path and obfuscation semantic conversion.

[0083] In specific implementations, many malicious scripts use a variety of script obfuscation techniques to disguise the commands that are actually executed. For this reason, in an embodiment of the present application, a sandbox is built to analyze the script to obtain the commands that are actually executed.

[0084] Specifically, by executing the script to be detected in the sandbox, a target script can be obtained, wherein the target script code is parsed by a syntax interpreter and converted into an obfuscated and logically clear script. The subsequent script detection process is performed on the converted target script, so that subsequent matching based on the target script can improve the accuracy.

[0085] As an optional example, the steps of obfuscation conversion performed on the script to be detected in the sandbox may at least include: 1. Lexical analysis; Syntax analysis, that is, obtaining an abstract syntax tree through analysis; 2. Variable replacement; 3. Alias ​​replacement; 4. Conversion of relative paths to absolute paths; 5. Individual obfuscation semantic replacement, such as echo " / fr-mr" | rev | bash, removing the rev command.

[0086] In an exemplary embodiment, the step 104, determining a matching sequence according to the target code attribute graph and the malicious code attribute graph, may include the following steps:

[0087] Comparing the node mapping degrees of malicious nodes in the malicious code attribute graph;

[0088] If the node mapping degrees are the same, the node probabilities of the malicious nodes are compared; the node probabilities are generated according to the node information, the edge information, the node in-degree and the node out-degree;

[0089] If the node probabilities are the same, compare the node in-degree and node out-degree of the malicious node;

[0090] By comparison, all malicious nodes in the malicious code attribute graph are sequentially added to the matching sequence.

[0091] In the embodiment of the present application, before performing script detection, the matching sequence N is first calculated. G Specifically, first, the node mapping degrees d of all malicious nodes in the malicious code attribute graph are compared. M For a node, the mapping degree represents the number of connections between the node and the matched nodes. Each time a new node is matched, the node mapping degree needs to be recalculated; if the node mapping degrees of malicious nodes are the same, the node probability P of the malicious nodes is compared. f (u), where the node probability P f (u) is calculated through node labels, edge labels, node in-degree, node out-degree and other information. If the node mapping degree and node probability of the malicious node are the same, the node in-degree and node out-degree of the malicious node are compared, and finally the node is sorted and added to the matching sequence.

[0092] As a specific example, the formula for node probability can be:

[0093]

[0094] Among them, u represents the node, and P in the formula f (u) represents the probability of node u, λ v1 (u) means to find the node label of node u, λ e1 (e) indicates finding the edge label of edge e, F l(l) represents the probability that the label of node u is 1, P t (t) represents the probability that edge e has label t. e∈adjEdge(u) represents all adjacent edges of node u, represents the probability of a node with in-degree (d′), It represents the probability that the node out-degree is (d′).

[0095] d M (u)=Count(u n ), (u, u n )∈E G |(u n ,u)∈E G

[0096] Among them, d M (u) represents the sum of the node out-degree and node in-degree of node u.

[0097] In an exemplary embodiment, the parent node of the malicious node is the adjacent node that appears earliest before the malicious node in the matching sequence, and the step 108, determining the next matching node pair according to the matching sequence and the malicious parent node information, may include the following steps:

[0098] Acquire a previous state space, wherein the previous state space includes a matched node pair, the matched node pair includes a previous matched node pair, and the previous matched node pair includes a previous matched malicious node and a previous matched target node;

[0099] Determine a next matching malicious node of the previous matching malicious node, where the next matching malicious node is the next malicious node corresponding to the previous matching malicious node in the matching sequence;

[0100] Determine a candidate matching target node of the previous matching target node; the candidate matching target node is a target node in the target code graph that is not in the previous state space and has the same node information as the next matching malicious node;

[0101] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is the successor node of its parent node, a node which is the successor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node;

[0102] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is a predecessor node of its parent node, a node which is a predecessor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node;

[0103] The next matching malicious node and the next matching target node are added to the previous state space as a next matching node pair to obtain a current state space.

[0104] In the embodiment of the present application, the parent node information of each malicious node in the malicious script is constructed to facilitate the rapid acquisition of candidate nodes in the state space in the subsequent matching process, wherein the parent node of the malicious node is the earliest adjacent node that appears before the malicious node in the matching sequence. It should be noted that in addition to recording the parent node of each malicious node, the parent node information also records the type information of the related connection edges, which is convenient for further pruning of the state space.

[0105] Specifically, it is assumed that a plurality of matched node pairs have been saved in the previous state space, wherein the matched node pairs include the previous matched node pair (u c , v c ), where node u c Indicates the last matching malicious node, node v c represents the last matching target node. In this embodiment of the application, the last state space S c , matching sequence N G , graph G1 (malicious code attribute graph) and graph G2 (target code attribute graph), obtain the next matching node pair (u n , v n ), where node u n Indicates the next matching malicious node, node v n Indicates the next matching target node.

[0106] Among them, node u n The node u in the matching sequence is selected c The next malicious node, R2(S c ,ψ(u n )) represents node v n A set of candidate matching target nodes, specifically, candidate matching target nodes are those in G2 that are not in the previous state space and are related to v n As an example, the candidate matching target node is represented as:

[0107]

[0108] Among them, M2(S c ) represents the target node that has been matched in G2, ψ(v n )=ψ(u n ) represents node v n The node label and node u n The node labels are the same as

[0109] in, Represents a set of candidate matching target nodes that combines node information and edge information, where is u n The node corresponding to the parent node in the state space, e is u n with u n The edge between the parent nodes of The formula is as follows:

[0110]

[0111] Among them, λ e1 (u c ,u n ) represents the node u in G1 c and node u n The edge label between them, P2(v) represents the set of successor nodes of node v.

[0112] In an exemplary embodiment, the method may further include the following steps:

[0113] When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is empty, a node whose node information matches is randomly selected from the candidate matching target nodes as the next matching target node.

[0114] Of course, if it is determined based on the parent node information that the parent node of the next matching malicious node is empty, the node information can be randomly selected from the candidate matching target nodes, that is, the node with the matching node label is the next matching target node, so that it can form the next matching node pair with the next matching malicious node and add it to the state space.

[0115] As a specific example, see Figure 3 , get the next matching node pair (u n , v n ) is as follows:

[0116] Input data: previous state space S c , the previous matching node pair (u c , v c ), matching sequence N G , Figure G1 and Figure G2:

[0117] Output result: next matching node pair (u n , v n );

[0118] If u n is the last node in the matching sequence, and ends the acquisition of the next matching node pair (u n , v n ):

[0119] If u n If the parent node is empty, you can c ,ψ(u n )) Randomly find a node v n , and returns (u n , v n );

[0120] If u n The parent node of is not empty, and u n is the successor node of the parent node, then c The corresponding node's successor node Right now Randomly find a node v with the same node information and edge information n , and returns (u n , v n );

[0121] If u n The parent node of is not empty, and u n is the predecessor node of the parent node, then from u c The predecessor node of the corresponding node corresponds to Right now Randomly find a node v with the same node information and edge information n , and returns (u n , v n ).

[0122] Reference Figure 4 , is a schematic diagram of obtaining matching nodes in the present application, including matching node pairs (u3, v3) and (u4, v 14 ), where u2's parent node is u3, then u3's corresponding node v3's corresponding node In the example above, we get the node v with the edge label e1. 11 .

[0123] In an exemplary embodiment, the step 110, when the current state space satisfies a preset condition, determining that the malicious script matches the target script, may include the following steps:

[0124] When the current state space satisfies the preset semantic information rule and the preset topological structure information, and the next matching malicious node in the current state space is the last malicious node in the matching sequence, it is determined that the malicious script matches the target script.

[0125] In the embodiment of the present application, a command vectorization model is constructed. Taking the shell command as an example, the shell command is first converted into a short text describing the function, wherein the short text is obtained from the man manual, and then TFI-DF (term frequency inverse document frequency) is used to extract the key verbs in the text, and the word2vec model is used to vectorize the key verbs, and finally the vectorized representation of the shell command is obtained.

[0126] As an optional example of the present application, a feasible rule is constructed. The feasible rule mainly considers two aspects: the semantic information rule F of the node s (s c ,u n , v n ) and the topological structure information of the node F t (s c ,u n , v n ). The feasible rules related to semantics mainly consider calculating the similarity through the node feature vector and comparing it with the preset threshold. If it is greater than the preset threshold of the algorithm attribute graph, it means that the single node semantics matches, and if it is less than the single node threshold, it means that the node semantics does not match; the feasible rules related to structure include the feasibility test of the current state space, one-step forward rule and two-step forward rule. The formula is as follows:

[0127] IsFeasible(s c ,u n , v n )=F s (s c ,u n , v n )∩F t (s c ,u n , v n )

[0128] F t (s c ,u n , v n )=F c (s c ,u n , v n )∩F la1 (s c,u n , v n )∩F la2 (s c ,u n , v n )

[0129] Among them, s c represents the current state space, u n represents the node of the target graph to be added to the state space, v n Represents a node in the malicious code property graph to be added to the state space. la1 (s c ,u n , v n ) Check u n The number of neighbor nodes in each category must be less than or equal to v n , the number of the same category. F la2 (s c ,u n , v n ) Check u n The number of neighbor nodes of the neighbor node in each category must be less than or equal to v n The number of the same category.

[0130] In the embodiment of the present application, subgraph matching is performed, and the process of subgraph matching is to perform a state space search. The state space is initialized to be empty, and then each step adds candidate node pairs to the current state space according to the matching sequence, and then the validity of the state space is judged according to the feasible rules. If valid, recursively search the state space of the next step, and if invalid, return; when the number of node pairs in the state space is equal to the number of nodes in the malicious script attribute graph, it indicates that there is a function attribute graph in the script to be detected that is isomorphic to the script in the malicious script library.

[0131] As a specific example, see Figure 5 , the specific process of subgraph matching is:

[0132] Input data: current state space S c , matching sequence N G , Figure G1 and Figure G2;

[0133] Output result: whether it matches, true or false;

[0134] If the current state space S c If it meets the preset conditions and is the target state space, then the state space is added to the result set and true is returned;

[0135] If the current state space S c If the preset conditions are not met, false is returned.

[0136] Reference Figure 6 , is a flowchart of converting a shell script into a code attribute graph of the present application, and the specific steps of converting a shell script into a code attribute graph include: 1. executing a shell script in a simple sandbox to obtain a target script; 2. analyzing the target script and constructing a code attribute graph; 3. constructing a shell command vectorization model; 4. preprocessing the code attribute graph.

[0137] In the embodiment of the present application, after obtaining the code attribute graph, the code attribute graph can also be preprocessed to further improve the efficiency of script matching. It is specifically divided into three steps: 1. Delete the node information of the ordinary text node and only retain the node type, thereby eliminating the influence of the ordinary text information on the matching link; 2. Perform word vector representation on the command node of the shell script, which is used for calculating the similarity of the shell command in the subsequent matching process; 3. Merge the function nodes and variable nodes to ensure the uniqueness of the same nodes in the graph (that is, the same node can only appear once in the code attribute graph); Serialize the code in the processed malicious code library and store it to obtain the processed malicious code library, which is convenient for the subsequent subgraph matching process.

[0138] Reference Figure 7 ,The subgraph matching process specifically includes: 1. Serializing and storing malicious scripts; 2. Loading malicious scripts; 3. Obtaining the target script to be detected; 4. Converting the target script into a code attribute graph; 5. Calculating the matching sequence; 6. Constructing the parent node information of the malicious script; 7. Performing subgraph matching based on the matching sequence, parent node information and state space.

[0139] In summary, 1. A new malicious script detection method is proposed. The method mainly includes three stages. First, the shell script is converted into a target script, then a code attribute graph is constructed, and finally, isomorphic subgraphs are matched with the malicious code library; 2. A vectorization method is provided for shell commands. First, the shell commands are converted into short texts describing the functions. The short texts here are obtained from the man manual; then TF-IDF is used to extract the key verbs in the text, and word2vec is used to vectorize the key verbs; finally, the vectorized representation of the shell command is obtained; for isomorphic subgraph matching, a new matching method VF3+ is proposed. VF3+ is based on VF3 and combines the information of edges to prune the state space. By pruning the state space, the matching speed is improved.

[0140] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of the present application are not limited by the described order of actions, because according to the embodiments of the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of the present application.

[0141] On the basis of the above embodiments, this embodiment further provides a script detection device, which is applied to electronic devices such as terminal devices and servers.

[0142] Reference Figure 8 , shows a structural block diagram of an embodiment of a script detection device of the present application, which may specifically include the following modules:

[0143] The code attribute graph acquisition module 802 is used to acquire a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and an edge connecting the target node, and the malicious code attribute graph includes a malicious node and an edge connecting the malicious node, wherein the node has corresponding node information and the edge has corresponding edge information;

[0144] A matching sequence determination module 804 is used to determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph;

[0145] A parent node information acquisition module 806 is used to obtain corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node;

[0146] A current state space determination module 808 is used to determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space;

[0147] The script matching determination module 810 is used to determine whether the malicious script matches the target script when the current state space meets a preset condition.

[0148] In an exemplary embodiment, the device also includes: an obfuscation conversion module, which is used to obtain a script to be detected; perform obfuscation conversion processing on the script to obtain a target script after obfuscation conversion; the obfuscation conversion processing at least includes variable conversion, alias conversion, relative path conversion to absolute path and obfuscation semantic conversion.

[0149] In an exemplary embodiment, the matching sequence determination module is used to compare the node mapping degrees of malicious nodes in the malicious code attribute graph; if the node mapping degrees are the same, the node probabilities of the malicious nodes are compared; the node probabilities are generated based on node information, edge information, node in-degree and node out-degree; if the node probabilities are the same, the node in-degree and node out-degree of the malicious nodes are compared; through comparison, all malicious nodes in the malicious code attribute graph are added to the matching sequence in sequence.

[0150] In an exemplary embodiment, the parent node of the malicious node is the adjacent node that appears earliest before the malicious node in the matching sequence, and the current state space determination module is used to obtain a previous state space, wherein the previous state space includes a matched node pair, wherein the matched node pair includes a previous matched node pair, wherein the previous matched node pair includes a previous matched malicious node and a previous matched target node; determine the next matching malicious node of the previous matching malicious node, wherein the next matching malicious node is the next malicious node corresponding to the previous matching malicious node in the matching sequence; determine a candidate matching target node of the previous matching target node; the candidate matching target node is a target node in the target code graph that is not in the previous state space and has the same node information as the next matching malicious node; when the next matching malicious node is determined according to the malicious parent node information When the parent node of a matching malicious node is not empty, if the next matching malicious node is the successor node of its parent node, then the successor node of the node corresponding to the previous matching malicious node and the node with the same node information and edge information as the next matching malicious node are randomly selected from the candidate matching target nodes as the next matching target node; when it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is the predecessor node of its parent node, then the node that is the predecessor node of the node corresponding to the previous matching malicious node and the node with the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node; the next matching malicious node and the next matching target node are added to the previous state space as a next matching node pair to obtain the current state space.

[0151] In an exemplary embodiment, the current state space determination module is used to randomly select a node with matching node information from the candidate matching target nodes as the next matching target node when it is determined according to the malicious parent node information that the parent node of the next matching malicious node is empty.

[0152] In an exemplary embodiment, the script matching determination module is used to determine that the malicious script matches the target script when the current state space satisfies preset semantic information rules and preset topological structure information, and the next matching malicious node in the current state space is the last malicious node in the matching sequence.

[0153] In an exemplary embodiment, the node information includes a node label, and the edge information includes an edge label.

[0154] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0155] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, an electronic device executes one or more of the methods described in the above embodiments. In the present application embodiment, the electronic device includes various types of devices such as terminal devices and servers (clusters).

[0156] The embodiments of the present disclosure may be implemented as a device configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the device may include electronic devices such as terminal devices and servers (clusters). Fig. 9 An exemplary apparatus 900 that can be used to implement various embodiments described in this application is schematically illustrated.

[0157] For one embodiment, Fig. 9 An exemplary apparatus 900 is shown having one or more processors 902, a control module (chip set) 904 coupled to at least one of the processor(s) 902, a memory 906 coupled to the control module 904, a non-volatile memory (NVM) / storage device 908 coupled to the control module 904, one or more input / output devices 910 coupled to the control module 904, and a network interface 912 coupled to the control module 904.

[0158] The processor 902 may include one or more single-core or multi-core processors, and the processor 902 may include any combination of general-purpose processors or special-purpose processors (such as graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 900 can be used as a terminal device, server (cluster), etc. described in the embodiments of the present application.

[0159] In some embodiments, the apparatus 900 may include one or more computer-readable media (e.g., memory 906 or NVM / storage device 908) having instructions 914 and one or more processors 902 combined with the one or more computer-readable media and configured to execute the instructions 914 to implement a module to perform the actions described in the present disclosure.

[0160] For one embodiment, the control module 904 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 902 and / or any suitable device or component in communication with the control module 904 .

[0161] The control module 904 may include a memory controller module to provide an interface to the memory 906. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0162] The memory 906 may be used, for example, to load and store data and / or instructions 914 for the device 900. For one embodiment, the memory 906 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 906 may include double data rate type four synchronous dynamic random access memory (DDR4 SDRAM).

[0163] For one embodiment, control module 904 may include one or more input / output controllers to provide an interface to NVM / storage device 908 and input / output device(s) 910 .

[0164] For example, NVM / storage 908 may be used to store data and / or instructions 914. NVM / storage 908 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable non-volatile storage device(s) (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives).

[0165] NVM / storage device 908 may include storage resources that are physically part of the device on which apparatus 900 is installed, or it may be accessible to the device without being part of the device. For example, NVM / storage device 908 may be accessed via (one or more) input / output devices 910 over a network.

[0166] (One or more) input / output devices 910 may provide an interface for the apparatus 900 to communicate with any other appropriate device, and the input / output device 910 may include a communication component, an audio component, a sensor component, etc. The network interface 912 may provide an interface for the apparatus 900 to communicate through one or more networks, and the apparatus 900 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, accessing a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication.

[0167] For one embodiment, at least one of the processor(s) 902 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 904. For one embodiment, at least one of the processor(s) 902 may be packaged together with the logic of one or more controllers of the control module 904 to form a system-in-package (SiP). For one embodiment, at least one of the processor(s) 902 may be integrated on the same die with the logic of one or more controllers of the control module 904. For one embodiment, at least one of the processor(s) 902 may be integrated on the same die with the logic of one or more controllers of the control module 904 to form a system-on-chip (SoC).

[0168] In various embodiments, the device 900 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the device 900 may have more or fewer components and / or a different architecture. For example, in some embodiments, the device 900 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0169] Among them, the main control chip can be used as a processor or control module in the detection device, sensor data, location information, etc. are stored in a memory or NVM / storage device, the sensor group can be used as an input / output device, and the communication interface may include a network interface.

[0170] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0171] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0172] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable script detection terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable script detection terminal device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0173] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable script to detect that the terminal device operates in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0174] These computer program instructions may also be loaded onto a computer or other programmable script detection terminal device, so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions executed on the computer or other programmable terminal device for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0175] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0176] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0177] The above is a detailed introduction to a script detection method and device, an electronic device and a storage medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A script detection method, characterized in that: The method comprises: Obtain a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and an edge connecting the target node, and the malicious code attribute graph includes a malicious node and an edge connecting the malicious node, wherein the node has corresponding node information and the edge has corresponding edge information; Determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph; Acquire corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node; Determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space; When the current state space meets a preset condition, it is determined that the malicious script matches the target script.

2. The method according to claim 1, characterized in that The method further comprises: Get the script to be tested; The script is subjected to obfuscation conversion processing to obtain an obfuscated target script; the obfuscation conversion processing includes variable conversion, alias conversion, relative path conversion to absolute path and obfuscation semantic conversion.

3. The method according to claim 1, characterized in that The determining a matching sequence for the malicious code attribute graph includes: Comparing the node mapping degrees of malicious nodes in the malicious code attribute graph; If the node mapping degrees are the same, the node probabilities of the malicious nodes are compared; the node probabilities are generated according to the node information, the edge information, the node in-degree and the node out-degree; If the node probabilities are the same, compare the node in-degree and node out-degree of the malicious node; By comparison, all malicious nodes in the malicious code attribute graph are sequentially added to the matching sequence.

4. The method according to claim 1, characterized in that The parent node of the malicious node is the adjacent node that appears earliest before the malicious node in the matching sequence, and the next matching node pair is determined according to the matching sequence and the malicious parent node information, including: Acquire a previous state space, wherein the previous state space includes a matched node pair, the matched node pair includes a previous matched node pair, and the previous matched node pair includes a previous matched malicious node and a previous matched target node; Determine a next matching malicious node of the previous matching malicious node, where the next matching malicious node is the next malicious node corresponding to the previous matching malicious node in the matching sequence; Determine a candidate matching target node of the previous matching target node; the candidate matching target node is a target node in the target code attribute graph that is not in the previous state space and has the same node information as the next matching malicious node; When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is the successor node of its parent node, a node which is the successor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node; When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is not empty, if the next matching malicious node is a predecessor node of its parent node, a node which is a predecessor node of the node corresponding to the previous matching malicious node and has the same node information and edge information as the next matching malicious node is randomly selected from the candidate matching target nodes as the next matching target node; The next matching malicious node and the next matching target node are added to the previous state space as a next matching node pair to obtain a current state space.

5. The method according to claim 4, characterized in that The method further comprises: When it is determined according to the malicious parent node information that the parent node of the next matching malicious node is empty, a node whose node information matches is randomly selected from the candidate matching target nodes as the next matching target node.

6. The method according to claim 1, characterized in that When the current state space satisfies a preset condition, determining that the malicious script matches the target script includes: When the current state space satisfies the preset semantic information rule and the preset topological structure information, and the next matching malicious node in the current state space is the last malicious node in the matching sequence, it is determined that the malicious script matches the target script.

7. The method according to claim 1, characterized in that The node information includes a node label, and the edge information includes an edge label.

8. A script detection device, characterized in that: The device comprises: A code attribute graph acquisition module, used to acquire a target code attribute graph of a target script to be detected and a malicious code attribute graph of a known malicious script; the target code attribute graph includes a target node and an edge connecting the target node, and the malicious code attribute graph includes a malicious node and an edge connecting the malicious node, wherein the node has corresponding node information and the edge has corresponding edge information; A matching sequence determination module, used to determine a matching sequence for the malicious code attribute graph; the matching sequence includes all malicious nodes in the malicious code attribute graph; A parent node information acquisition module, used to obtain corresponding parent node information according to the malicious code attribute graph preprocessing; the parent node information combines the connection information between the matching sequence and the malicious node; A current state space determination module, used to determine the next matching node pair according to the matching sequence and the parent node information, and add it to the current state space; The script matching determination module is used to determine whether the malicious script matches the target script when the current state space meets a preset condition.

9. An electronic device, characterized in that: include: processor; and A memory having executable codes stored thereon, which, when executed, causes the processor to execute the script detection method as described in one or more of claims 1-7.

10. One or more machine-readable media having executable codes stored thereon, which, when executed, cause a processor to perform the script detection method according to one or more of claims 1-7.

Images