Script file detection method and device, equipment and storage medium

Abstract

This application discloses a method, apparatus, device, and storage medium for detecting script files. The method includes: acquiring a target script file to be detected; tracing target tainted variables in the target script file; obtaining the tainted variable propagation path in response to the target tainted variable being passed to a target leaking function; performing path backtracking on the tainted variable propagation path in response to the path backtracking result indicating that the tainted variable propagation path satisfies the leakage condition, and determining that the target script file is an adversarial malicious script file. This process incorporates consideration of target tainted variables that meet adversarial attack conditions, enabling the detection of adversarial malicious script files. This improves the accuracy of malicious script file detection results and provides a significant degree of defense against adversarial attacks using adversarial malicious script files, resulting in higher network security.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a method, apparatus, device, and storage medium for detecting script files. Background Technology

[0002] With the continuous development of internet technology, network security issues are receiving increasing attention. Currently, hackers can employ various methods to attack networks, one common method being the use of malicious script files. To prevent detection, hackers encrypt, transform, and obfuscate malicious script files, creating adversarial malicious script files, which they then use to launch countermeasures attacks on the network.

[0003] Adversarial malicious script files can easily bypass detection, resulting in low accuracy of detection results and poor network security. Therefore, how to detect adversarial malicious script files is a pressing issue that needs to be addressed. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for detecting script files, which can be used to detect adversarial malicious script files and improve the accuracy of malicious script file detection results. The technical solution is as follows:

[0005] On one hand, embodiments of this application provide a method for detecting script files, the method comprising:

[0006] Obtain the target script file to be detected;

[0007] The target tainted variable in the target script file is traced, and in response to the target tainted variable being passed to the target leaking function in the target script file, the tainted propagation path of the target tainted variable is obtained. The target tainted variable is a variable that satisfies the conditions of an adversarial attack.

[0008] In response to the taint propagation path of the target taint variable satisfying the path backtracking condition, the taint propagation path of the target taint variable is backtracked.

[0009] In response to the result of the path backtracking indicating that the taint propagation path of the target tainted variable meets the leakage condition, the target script file is determined to be an adversarial malicious script file.

[0010] On the other hand, a script file detection device is provided, the device comprising:

[0011] The first acquisition unit is used to acquire the target script file to be detected;

[0012] A tracking unit is used to track target taint variables in the target script file;

[0013] The second acquisition unit is used to acquire the taint propagation path of the target tainted variable in response to the target leaking function in the target script file, wherein the target tainted variable is a variable that satisfies the conditions of an adversarial attack.

[0014] The backtracking unit is used to perform path backtracking on the taint propagation path of the target taint variable in response to the taint propagation path of the target taint variable satisfying the path backtracking condition.

[0015] A determining unit is configured to determine that the target script file is an adversarial malicious script file in response to the result of the path backtracking indicating that the taint propagation path of the target taint variable meets the leakage condition.

[0016] In one possible implementation, the device further includes:

[0017] The detection unit is used to detect the variables to be detected in the target script file;

[0018] The determining unit is further configured to, in response to the variable to be detected satisfying the adversarial attack conditions, designate the variable to be detected as a target taint variable;

[0019] The variable to be detected satisfies the conditions for an adversarial attack, including: the variable to be detected is a string variable and the string variable satisfies a first condition, wherein the string variable satisfies the first condition as follows: the length of the string variable is greater than a first threshold and the string variable contains characters of a non-target type; or, the variable to be detected is an array variable and the length of the array variable is greater than a second threshold; or, the variable to be detected is obtained by string concatenation and the number of string concatenation operations is greater than a third threshold.

[0020] In one possible implementation, the determining unit is further configured to determine a target parameter to be detected from the parameters of the target leakage function; and in response to the target parameter being different from the target taint variable, to determine that the taint propagation path of the target taint variable satisfies the path backtracking condition.

[0021] In one possible implementation, the target leaking function is of a primitive type, which indicates that the target leaking function is provided by the scripting language used to write the target script file; the determining unit is further configured to use the parameters of the target leaking function used to implement the leaking function as the target parameters to be detected.

[0022] In one possible implementation, the target leaking function is of a non-native type; the determining unit is further configured to obtain a sub-leaking function called within the target leaking function; in response to the sub-leaking function being of a native type, the parameter used to implement the leaking function is taken as a first parameter; in response to the first parameter being different from the target tainted variable, a first transmission path corresponding to the first parameter within the target leaking function is obtained; in response to the transmission methods existing on the first transmission path all being assignments and the starting variable of the first transmission path being the same as any parameter in the parameters of the target leaking function, the any parameter is taken as a target parameter to be detected.

[0023] In one possible implementation, the backtracking unit is used to detect the propagation methods existing on the taint propagation path of the target taint variable; in response to the fact that not all propagation methods existing on the taint propagation path of the target taint variable are assignments, the result of the path backtracking is a first result, which is used to indicate that the taint propagation path of the target taint variable meets the leakage condition; in response to the fact that all propagation methods existing on the taint propagation path of the target taint variable are assignments, the result of the path backtracking is a second result, which is used to indicate that the taint propagation path of the target taint variable does not meet the leakage condition.

[0024] In one possible implementation, the device further includes:

[0025] A conversion unit is used to convert the target script file into a target abstract syntax tree;

[0026] The determining unit is further configured to determine the variables to be detected in the target script file based on the target abstract syntax tree.

[0027] On the other hand, a computer device is provided, the computer device including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the script file detection method described above.

[0028] On the other hand, a computer-readable storage medium is also provided, wherein at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the script file detection method described above.

[0029] On the other hand, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the script file detection method described above.

[0030] The technical solution provided in this application has at least the following beneficial effects:

[0031] In this embodiment, consideration is added for target tainted variables that meet the conditions for adversarial attacks. By tracking the target tainted variables and analyzing the tainted propagation path of the target tainted variables, adversarial malicious script files can be detected, which helps to improve the accuracy of the detection results of malicious script files. This can effectively defend against adversarial attacks by adversarial malicious script files, resulting in higher network security. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a schematic diagram of the implementation environment of a script file detection method provided in an embodiment of this application;

[0034] Figure 2 This is a flowchart of a script file detection method provided in an embodiment of this application;

[0035] Figure 3 This is a schematic diagram illustrating a process for detecting a variable to be detected, as provided in an embodiment of this application.

[0036] Figure 4 This is a schematic diagram illustrating the basic process of a script file detection method provided in an embodiment of this application;

[0037] Figure 5 This is a schematic diagram illustrating the processing procedure when the target leaking function is of a non-native type, as provided in an embodiment of this application.

[0038] Figure 6 This is a schematic diagram illustrating a process of tracing back the taint propagation path of a target taint variable, as provided in an embodiment of this application.

[0039] Figure 7This is a schematic diagram illustrating a process for analyzing the taint propagation path of a target taint variable, as provided in an embodiment of this application.

[0040] Figure 8 This is a schematic diagram of a script file detection device provided in an embodiment of this application;

[0041] Figure 9 This is a schematic diagram of a script file detection device provided in an embodiment of this application;

[0042] Figure 10 This is a schematic diagram of the structure of a server provided in an embodiment of this application;

[0043] Figure 11 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0045] To facilitate understanding of the technical process of the embodiments of this application, some terms involved in the embodiments of this application will be explained below.

[0046] Webshell: A webshell is a command execution environment that exists in the form of web page files such as PHP (Hypertext Preprocessor), JSP (Java Server Pages), and ASP (Active Server Pages). It can also be called a web backdoor. After hacking into a webpage, a hacker can mix the webshell with normal web page files stored in the web (webpage) directory of the web server. Subsequently, the hacker can access the webshell through a browser, thereby gaining control of the web server, such as: deleting web pages, modifying the homepage, uploading and downloading files, viewing the database, and executing arbitrary program commands.

[0047] Adversarial webshells: In order to prevent webshells from being detected by antivirus engines, hackers will encrypt, transform, obfuscate, and perform other adversarial processing on the malicious code in the webshell, thus obtaining an adversarial webshell.

[0048] Tainted variables: Variables in code that can be controlled by external users, or variables that are infected by other tainted variables.

[0049] Tainted variable propagation: By passing a tainted variable 'a' to a tainted variable 'b' through assignment, function call, or other methods, variable 'b' becomes a tainted variable.

[0050] Leaking functions: Sensitive or dangerous functions (such as the eval function in PHP) can obtain users' private information or control the computer to perform arbitrary actions.

[0051] This application provides a method for detecting script files. Please refer to... Figure 1 This diagram illustrates the implementation environment of the script file detection method provided in this application embodiment. The implementation environment includes: a terminal 11 and a server 12.

[0052] The script file detection method provided in this application embodiment can be applied to terminal 11 or server 12, and this application embodiment does not limit it in this way. For example, when the script file detection method provided in this application embodiment is applied to terminal 11, terminal 11 can obtain the detection result of the script file and then send the detection result of the script file to server 12. For example, when the script file detection method provided in this application embodiment is applied to server 12, server 12 can obtain the detection result of the script file and then send the detection result of the script file to terminal 11.

[0053] In one possible implementation, terminal 11 can be any electronic product capable of human-computer interaction with the user through one or more methods such as a keyboard, touchpad, touchscreen, remote control, voice interaction, or handwriting device, such as a PC (Personal Computer), mobile phone, smartphone, PDA (Personal Digital Assistant), wearable device, Pocket PC, tablet computer, smart car system, smart TV, smart speaker, etc. Server 12 can be a single server, a server cluster consisting of multiple servers, or a cloud computing service center. Terminal 11 and server 12 establish a communication connection through a wired or wireless network.

[0054] Those skilled in the art should understand that the above-described terminal 11 and server 12 are merely examples. Other existing or future terminals or servers that are applicable to this application should also be included within the scope of protection of this application, and are hereby incorporated by reference.

[0055] Based on the above Figure 1 The implementation environment shown in this application provides a method for detecting script files, taking the application of this method to terminal 11 as an example. Figure 2 As shown, the method provided in this application embodiment includes the following steps 201 to 203.

[0056] In step 201, the target script file to be detected is obtained.

[0057] Target script files refer to script files that need to be detected. Target script files can be executed in a network environment. By detecting target script files, it is possible to determine whether the target script file is a malicious script file, thereby avoiding the execution of malicious script files, defending against attacks by malicious script files on the network, and ensuring network security.

[0058] This application does not limit the method of obtaining the target script file. For example, if the target script file is a script file generated by the terminal, the terminal can obtain the target script file to be detected locally. If the target script file is a script file generated by the server, the terminal can obtain the target script file to be detected from the server.

[0059] Based on the method provided in this application, it is possible to detect when a target script file is an adversarial malicious script file, thereby defending against adversarial attacks by adversarial malicious script files. In this application, an adversarial malicious script file refers to a malicious script file obtained by performing adversarial processing such as encryption, deformation, and obfuscation on a basic malicious script file to circumvent basic detection methods. The basic malicious script file refers to a malicious script file that has not undergone adversarial processing. This application does not limit the type of the basic malicious script file; for example, the basic malicious script file refers to a webshell file. In this case, the adversarial malicious script file refers to an adversarial webshell file.

[0060] It should be noted that the target script file may be a combative malicious script file, a basic malicious script file, or a normal script file; this application does not limit this. If the target script file is a combative malicious script file, it means that the code in the target script file is combative malicious code; if the target script file is a basic malicious script file, it means that the code in the target script file is basic malicious code. If the target script file is a normal script file, it means that the code in the target script file is normal code.

[0061] This application does not limit the scripting language of the target script file. For example, the scripting language of the target script file may be PHP, JSP, or ASP. Furthermore, this application does not limit the execution network environment or the functionality of the target script file.

[0062] In step 202, the target tainted variable in the target script file is tracked. In response to the target tainted variable being passed to the target leaking function in the target script file, the tainted propagation path of the target tainted variable is obtained. The target tainted variable is a variable that satisfies the conditions of an adversarial attack.

[0063] Target tainted variables refer to variables in a target script file that meet the conditions for adversarial attacks. By adding consideration to target tainted variables, it is possible to determine whether a target script file is an adversarial malicious script file, thereby realizing the function of detecting adversarial malicious script files and improving the accuracy of the detection results of target script files.

[0064] Before executing step 202, it is necessary to first identify the target tainted variables in the target script file. In one possible implementation, the target tainted variables in the target script file are identified by: detecting the variables to be detected in the target script file; and, in response to the variables to be detected satisfying the adversarial attack conditions, designating the variables to be detected as target tainted variables.

[0065] The variable to be detected in the target script file refers to the variable in the target script file that needs to be detected. The target script file consists of multiple lines of code, and each line of code includes multiple variables. During the detection process of the target script file, the variables in each line of code are detected sequentially from beginning to end. In the embodiments of this application, the variable to be detected can refer to a variable in the first line of code in the target script file, or it can refer to a variable in any other line of code besides the first line of code, depending on the actual detection process.

[0066] After identifying the variable to be detected, the variable is then tested. The testing process is as follows: The variable is checked to see if it meets the conditions for an adversarial attack. If it does, it is designated as a target tainted variable. If it does not meet these conditions, the variable is checked to see if it meets the conditions for a basic attack. If it does, it is designated as a basic tainted variable. If it does not meet these conditions, it is treated as a normal variable.

[0067] For example, adversarial malicious script files generally have the following characteristics: They contain excessively long, meaningless string variables, which typically require decoding or string processing before use; they contain excessively long, meaningless array variables, which typically need to be concatenated into a long string before decoding or string processing; and they contain string variables with excessive concatenation, which typically require piecing together fragmented strings into critical code before use. These three types of variables allow malicious code that was previously directly detected by the basic detection process to bypass detection. Based on the above analysis, in this embodiment, for adversarial malicious script files, consideration is added for tainted variables that meet the conditions for adversarial attacks, laying the foundation for detecting adversarial malicious script files.

[0068] In this application embodiment, the variable to be detected satisfies the conditions for an adversarial attack, including but not limited to the following three cases:

[0069] Case 1: The variable to be detected is a string variable and the string variable meets the first condition. The string variable meets the first condition if the length of the string variable is greater than the first threshold and the string variable contains characters of a non-target type.

[0070] The first threshold is set based on experience or adjusted flexibly according to the application scenario; this application embodiment does not limit this. The target type of character refers to characters that are easy to directly identify. For example, the target type of character refers to ASCII (American Standard Code for Information Interchange) characters. In this case 1, the variable to be detected is an excessively long string variable and contains characters that are difficult to directly identify.

[0071] Case 2: The variable to be detected is an array variable and the length of the array variable is greater than the second threshold.

[0072] The second threshold can be set based on experience or adjusted flexibly according to the application scenario; this application embodiment does not limit this. The second threshold can be the same as or different from the first threshold. In this case 2, the variable to be detected is an excessively long array variable.

[0073] Case 3: The variable to be detected is obtained through string concatenation and the number of string concatenation operations is greater than the third threshold.

[0074] The third threshold can be set based on experience or adjusted flexibly according to the application scenario; this application embodiment does not limit this. The third threshold can be the same as the first threshold or the second threshold, or it can be different from both the first and second thresholds. In this case 3, the variable to be detected is a string variable with too many concatenation operations.

[0075] In the exemplary embodiment, the first threshold, the second threshold, and the third threshold are set based on the actual situation of existing black samples and white samples, with the aim of minimizing both false positives of white samples and false negatives of black samples. Here, white samples refer to normal script files, and black samples refer to abnormal script files. Abnormal malicious script files include adversarial malicious script files and basic malicious script files.

[0076] When the variable to be detected meets any of the above three conditions, it is determined that the variable meets the adversarial attack conditions, and the variable to be detected is designated as the target tainted variable. When it is determined that the variable to be detected does not meet the adversarial attack conditions, it is checked whether the variable to be detected meets the basic attack conditions. For example, the basic attack conditions for the variable to be detected include, but are not limited to: the variable to be detected is a variable that can be manipulated by external users; or, the variable to be detected is a variable that has a transitive relationship with existing tainted variables. When it is determined that the variable to be detected meets the basic attack conditions, the variable to be detected is designated as a basic tainted variable; when it is determined that the variable to be detected does not meet the basic attack conditions, the variable to be detected is designated as a normal variable.

[0077] In one possible implementation, before detecting the variables to be detected in the target script file, the method further includes: converting the target script file into a target abstract syntax tree (AST); and determining the variables to be detected in the target script file based on the AST. That is, the variables to be detected are determined based on the AST. In an exemplary embodiment, directly processing the script file requires tedious text processing, while an abstract syntax tree is a classic tree-like data structure that facilitates automatic processing by the program. Therefore, after obtaining the target script file, it can be converted into a AST to speed up subsequent processing.

[0078] An Abstract Syntax Tree (AST) is a tree-like representation of the abstract syntactic structure of source code. Each node in the tree represents a structure within the source code. It is described as abstract because the AST does not represent every detail of the actual syntax; for example, nested parentheses are implicitly present in the tree structure and not explicitly shown as nodes. The AST does not depend on the syntax of the source code because equivalent transformations are frequently performed during grammar writing. Many scripting languages ​​are first processed into an AST by the executor before subsequent optimization and execution. For example, the PHP scripting language is processed by the Zend engine (an open-source scripting engine). Therefore, many open-source AST extraction tools can be used to convert target script files into target ASTs, and the embodiments in this application are not limited to any particular AST.

[0079] After obtaining the target abstract syntax tree (API), the nodes in the API are traversed and analyzed to determine the type of the node to be detected. Then, the variable to be detected is determined based on the type of the node. For example, the node to be detected refers to the node identified during the traversal and analysis of the nodes in the API. For example, if the node to be detected is a string variable node, the string variable represented by the node is directly used as the variable to be detected; if the node to be detected is an array variable node, the array variable represented by the node is directly used as the variable to be detected; if the node to be detected is a string concatenation operation node, the concatenated variable determined by the node and its related concatenation operation child nodes is used as the variable to be detected.

[0080] For example, the process of detecting the variable to be detected is as follows: Figure 3 As shown, Figure 3 The process shown includes the following 8 steps:

[0081] 1. Convert the target script file into a target abstract syntax tree (API). Identify the node to be detected within the API and determine its type. If the node is a string variable node, proceed to step 2; if it is an array variable node, proceed to step 3; if it is a string concatenation operation node, proceed to step 4; otherwise, proceed to step 5.

[0082] 2. Obtain the length of the string variable represented by the node to be detected. If the length of the string variable is not greater than the first threshold n (n is an integer not less than 1), then jump to step 5. Otherwise, continue to determine whether the string variable contains non-ASCII characters. If it does not contain non-ASCII characters, then jump to step 5. Otherwise, jump to step 8.

[0083] 3. Obtain the length of the array variable representing the node to be detected. If the length of the array variable is not greater than the second threshold m (m is an integer not less than 1), then jump to step 5; otherwise, jump to step 8.

[0084] 4. Continue to traverse the child nodes of the node to be tested, and get the number of string concatenation operations. If the number of string concatenation operations is not greater than the third threshold k (k is an integer not less than 1), then jump to step 5; otherwise, jump to step 8.

[0085] 5. Determine whether the variable to be detected, determined based on the node to be detected, meets the basic attack conditions. This mainly includes: determining whether the variable to be detected, determined based on the node to be detected, is a variable that can be manipulated by external users, and whether there is a transitive relationship between it and existing tainted variables. If the variable to be detected, determined based on the node to be detected, meets the basic attack conditions, proceed to step 6; otherwise, proceed to step 7.

[0086] 6. Use the variables to be detected, determined based on the nodes to be detected, as the basic taint variables.

[0087] 7. Treat the variables to be detected, determined based on the nodes to be detected, as ordinary variables.

[0088] 8. Use the variables to be detected, determined based on the nodes to be detected, as the target taint variables.

[0089] Based on the above steps, the type of the variable to be detected can be determined. Different types of variables to be detected correspond to different subsequent execution processes. For example, if the variable to be detected is a target tainted variable, then step 202 is executed; if the variable to be detected is a basic tainted variable, then the basic detection process is executed; if the variable to be detected is a normal variable, then the next variable to be detected is obtained until the target tainted variable or the basic tainted variable is detected, or until all variables have been detected.

[0090] In an exemplary embodiment, the basic detection process involves: tracking basic tainted variables; and, in response to the basic tainted variables being passed to the leaking function, determining whether the target script file is a malicious script file. The basic detection process is the traditional process for detecting whether a script file is malicious, and this embodiment will not elaborate further.

[0091] This application uses the variable to be detected as the target tainted variable as an example for illustration. When the variable to be detected is determined to be the target tainted variable, the target tainted variable in the target script file is identified, and then the target tainted variable is tracked. The process of tracking the target tainted variable refers to the process of performing taint propagation analysis on the target tainted variable.

[0092] During taint transitivity analysis of a target tainted variable, variables or functions in the target script file that have direct or indirect transitivity relationships with the target tainted variable are continuously searched. Variables or functions with a direct transitivity relationship with the target tainted variable directly use the target tainted variable through assignment or function calls. Variables or functions with an indirect transitivity relationship with the target tainted variable either directly use variables or functions with a direct transitivity relationship, or vice versa. By continuously searching for variables or functions in the target script file that have direct or indirect transitivity relationships with the target tainted variable, the transitivity path of the target tainted variable can be continuously determined. Among the found variables or functions with direct or indirect transitivity relationships with the target tainted variable, the path from a certain variable or function to a variable or function that directly uses that variable or function through assignment or function calls is a transitivity sub-path within the transitivity path of the target tainted variable.

[0093] In an exemplary embodiment, variables that have a direct or indirect transitive relationship with the target taint variable are referred to as basic taint variables.

[0094] This application does not limit the specific implementation of tracking target tainted variables in a target script file, as long as the propagation path of the target tainted variable can be analyzed. During the tracking process, if it is found that the target tainted variable is propagated to a target leaking function in the target script file, the propagation path of the target tainted variable is taken as the tainted propagation path of the target tainted variable, thus obtaining the tainted propagation path of the target tainted variable. The starting point and ending point of the tainted propagation path of the target tainted variable are the target tainted variable and the target leaking function, respectively. The propagation sub-paths constituting the tainted propagation path are called tainted propagation sub-paths. There is at least one tainted propagation sub-path between the starting point and the ending point. Each tainted propagation sub-path corresponds to a propagation method. Different tainted propagation sub-paths can have the same or different propagation methods, which is not limited in this application. For example, this application does not limit the types of supported propagation methods. For instance, the types of supported propagation methods include, but are not limited to, assignment and function calls.

[0095] A target leaking function refers to any leaking function in a target script file. A leaking function is a sensitive or dangerous function that can leak user privacy information or control the computer to perform malicious behavior. Before implementing step 202, it is necessary to identify the leaking functions in the target script file. For example, the process of identifying leaking functions in a target script file is as follows: determine the target scripting language of the target script file; determine the candidate leaking functions corresponding to the target scripting language in the correspondence between scripting languages ​​and candidate leaking functions; match each function in the target script file with the candidate leaking functions corresponding to the target scripting language, and identify the successfully matched functions as the leaking functions in the target script file.

[0096] The correspondence between scripting languages ​​and candidate leaking functions is established based on experience. A candidate leaking function for any scripting language refers to a leaking function that may appear in a script file written in that scripting language. Different scripting languages ​​may have the same or different candidate leaking functions. For example, if any function in the target script file successfully matches any candidate leaking function in the target scripting language, it could mean that the function is the same as the candidate leaking function; or it could mean that a sub-function called within the function includes the candidate leaking function.

[0097] It should be noted that the target script file may contain one or more leaking functions. A target leaking function refers to the function to which the target tainted variable is passed. It should be further clarified that the passing of the target tainted variable to the target leaking function can mean that the target tainted variable is passed directly to the target leaking function, or it can mean that the target tainted variable is passed indirectly to the target leaking function; this application does not limit this. In the case where the target tainted variable is indirectly passed to the target leaking function, the target tainted variable may be passed to the target leaking function after multiple rounds of passing.

[0098] In an exemplary embodiment, if tracking of the target tainted variable reveals that it has not been passed to any leaking function in the target script file, it indicates that the target tainted variable poses no risk of leakage. In this case, the next variable to be detected is determined.

[0099] This application uses the example of a leaky function in the target script file for illustration. In the exemplary embodiment, if no leaky function exists in the target script file, it indicates that the target script file is a normal script file.

[0100] The target tainted variable is a tainted variable that meets the conditions for adversarial attacks. These tainted variables (e.g., excessively long string variables containing characters of non-target types, excessively long numeric variables, string variables with excessive concatenation operations) are special tainted variables proposed for adversarial malicious script files. Because many developers have poor script writing habits—for example, some hardcode large blocks of fixed text or string arrays in their code for easy use; or they perform multiple concatenations when outputting strings in a specified format—it is necessary to analyze the tainted propagation path of the target tainted variable to distinguish whether the leak was maliciously caused by a hacker or unintentionally by a developer, thus reducing false positives. In other words, this application's embodiments, by analyzing the tainted propagation path of the target tainted variable to determine the detection results of the target script file, can improve the accuracy of the target script file detection results.

[0101] For example, the process of converting a target script file into a target abstract syntax tree is implemented using an abstract syntax tree generation module; the process of tracking target tainted variables in the target script file is implemented using a tainted tracking module; and the process of analyzing the tainted propagation path of the target tainted variables is implemented using a tainted propagation path analysis module. The basic process of the script file detection method provided in this application embodiment is as follows: Figure 4 As shown. The process involves: obtaining the target script file to be detected; converting the target script file into a target abstract syntax tree using the abstract syntax tree generation module; tracking the target tainted variables in the target script file using the taint tracking module; analyzing the taint propagation path of the target tainted variables using the taint propagation path analysis module; and obtaining the detection results for the target script file.

[0102] In one possible implementation, the process of analyzing the taint propagation path of the target tainted variable includes: determining the target parameter to be detected from the parameters of the target leakage function; and determining that the taint propagation path of the target tainted variable satisfies the path backtracking condition in response to the target parameter being different from the target tainted variable. In this case, step 203 is executed.

[0103] In one possible implementation, the target parameter might be the same as the target tainted variable. In this case, it indicates that the target tainted variable was passed directly to the target leaking function without any processing; that is, the target leaking function directly used the target tainted variable. In this situation, it is considered that the passing of the target tainted variable to the target leaking function was unintentional on the part of the developer, and the tainted variable's propagation path does not meet the leakage condition. Therefore, the detection result of the target script file cannot be directly determined based on the tainted variable's propagation path; it is necessary to determine the next variable to be detected and continue the detection.

[0104] In one possible implementation, the target leaking function has two possible types: either it is a primitive type, or it is a non-primitive type. A primitive type indicates that the target leaking function is provided by the scripting language used to write the target script file, while a non-primitive type indicates that the target leaking function is user-defined. It should be noted that different types of scripting languages ​​may provide the same or different leaking functions, and this application does not limit this. For example, when the target leaking function is of a primitive type, the target leaking function refers to a primitive leaking function.

[0105] The target parameter to be detected refers to the parameter in the target leakage function that needs to be compared with the target taint variable. Depending on the type of the target leakage function, the method for determining the target parameter to be detected within the parameters of the target leakage function also differs.

[0106] In one possible implementation, when the target leaking function is of a primitive type, the method for determining the target parameter to be detected within the parameters of the target leaking function is as follows: the parameter used to implement the leaking function is taken as the target parameter to be detected. The position of the parameter used to implement the leaking function within the parameters of the primitive leaking function (i.e., the leaking function of a primitive type) is determined. The terminal stores information indicating which position in the parameters of the primitive leaking function is the parameter that implements the leaking function. When the target leaking function is of a primitive type, the terminal can directly determine the parameter used to implement the leaking function from the parameters of the target leaking function and then take that parameter as the target parameter to be detected.

[0107] In one possible implementation, for the case where the target leaking function is of a non-native type, the process of determining the target parameter to be detected from the parameters of the target leaking function includes the following steps a to d:

[0108] Step a: Obtain the sub-leaking functions called within the target leaking function.

[0109] When the target leaking function is of a non-primitive type, it leaks by calling a leaking function of the primitive type. The target leaking function may call one or more sub-leaking functions. In step a, these sub-leaking functions are obtained through iteration. For each sub-leaking function obtained, its type is checked. If it is, step b is executed; otherwise, the next sub-leaking function called within the target leaking function is obtained, until a sub-leaking function of the primitive type is found, at which point step b is executed.

[0110] For example, the subsequent processing when the target leak function is of a non-native type is implemented using the user leak function auditing module. When the sub-leaked function is of a non-native type, the process of obtaining the next sub-leaked function called within the target leaked function is implemented by recursively calling the user leak function auditing module.

[0111] Step b: In response to the sub-leaking function being of a primitive type, the parameter used to implement the leakage function is taken as the first parameter.

[0112] The implementation process of step b is the same as the process of determining the target parameter in the parameters of the target leaking function when the type of the target leaking function is a primitive type, and will not be repeated here.

[0113] After using the parameter used to implement the leakage function as the first parameter in the sub-leaking function, the first parameter is compared with the target tainted variable to determine if the first parameter is the same as the target tainted variable. If the first parameter is different from the target tainted variable, step c is executed; if the first parameter is the same as the target parameter, it is not necessary to determine the target parameter to be detected in the parameters of the target leakage function. It is directly determined that the tainted propagation path of the target tainted variable does not meet the leakage condition, and the next variable to be detected in the target script file needs to be obtained for further detection.

[0114] Step c: In response to the first parameter being different from the target taint variable, obtain the first propagation path corresponding to the first parameter within the target leak function.

[0115] When it is determined that the first parameter is different from the target taint variable, the first propagation path corresponding to the first parameter within the target leak function is obtained. The first propagation path corresponding to the first parameter within the target leak function records the propagation path of the first parameter within the target leak function.

[0116] It should be noted that this application embodiment uses the existence of a corresponding transmission path for the first parameter within the target leaking function as an example for illustration, and this application embodiment is not limited to this. For example, if the first parameter does not have a corresponding transmission path within the target leaking function, it is directly determined whether the first parameter is the same as any parameter in the parameters of the target leaking function. If the first parameter is the same as any parameter in the parameters of the target leaking function, then that parameter is taken as the target parameter to be detected; if the first parameter is different from all parameters in the parameters of the target leaking function, then the target script file is directly determined to be an adversarial malicious script file.

[0117] After obtaining the first transmission path corresponding to the first parameter within the target leak function, the first transmission path is analyzed. The analysis process is as follows: It is determined whether all transmission methods existing on the first transmission path are assignments. If not all transmission methods existing on the first transmission path are assignments, the target script file is directly identified as an adversarial malicious script file. If all transmission methods existing on the first transmission path are assignments, it is determined whether the starting variable of the first transmission path is the same as any parameter in the target leak function. If all transmission methods existing on the first transmission path are assignments and the starting variable of the first transmission path is the same as any parameter in the target leak function, step d is executed.

[0118] If all transmission methods along the first transmission path are assignments and the starting variable of the first transmission path differs from all parameters in the target leak function, it is not necessary to determine the target parameter to be detected from the parameters of the target leak function. Instead, continue to determine if the starting variable of the first transmission path is the same as the target tainted variable. If the starting variable of the first transmission path is different from the target tainted variable, the target script file is directly determined to be an adversarial malicious script file. If the starting variable of the first transmission path is the same as the target tainted variable, it is directly determined that the tainted transmission path of the target tainted variable does not meet the leakage conditions, and the next variable to be detected in the target script file needs to be obtained for further detection.

[0119] Step d: In response to the fact that all transmission methods on the first transmission path are assignments and the starting variable of the first transmission path is the same as any parameter in the parameters of the target leakage function, take any parameter as the target parameter to be detected.

[0120] When it is determined that all transmission methods on the first transmission path are assignments and the starting variable of the first transmission path is the same as any parameter in the parameters of the target leakage function, it indicates that further judgment is needed on that parameter. In this case, that parameter is taken as the target parameter to be detected.

[0121] For example, the user-leaked function auditing module determines whether there are any interruptions to the assignment and passing of target tainted variables within a non-native type of target leaked function. If so, the target script file is identified as an adversarial malicious script file. If the assignment and passing of target tainted variables are not interrupted, and the target leaked function contains the target parameter to be detected, then it needs to be handed over to an external module for further processing. The external module's further processing involves comparing the target parameter with the target tainted variable, and then performing subsequent operations based on the comparison result.

[0122] For example, the handling process when the target leaking function is of a non-primitive type is as follows: Figure 5 As shown. Figure 5 The processing flow shown includes the following 6 steps:

[0123] 1. Obtain the sub-leaking function called within the target leaking function; determine whether the type of the sub-leaking function is a primitive type. If it is, jump to step 3; otherwise, jump to step 2.

[0124] 2. Recursively call the user leak function audit module until a sub-leaked function of type primitive is obtained, then jump to step 3.

[0125] 3. Take the parameter used to implement the leakage function from the sub-leaking function as the first parameter and compare it with the target tainted variable. Determine if the first parameter is the same as the target tainted variable. If they are the same, directly determine that the taint propagation path of the target tainted variable does not meet the leakage condition; otherwise, obtain the first propagation path of the first parameter within the target leaking function and jump to step 4.

[0126] 4. Determine whether all transmission methods on the first transmission path are assignments. If so, proceed to step 5; otherwise, directly determine that the target script file is an adversarial malicious script file.

[0127] 5. Determine whether the starting variable of the first transmission path is the same as any parameter in the target leakage function. If so, take any parameter as the target parameter to be detected and continue to execute the external module (i.e. continue to execute the step of comparing the target parameter with the target taint variable). Otherwise, jump to step 6.

[0128] 6. Determine whether the starting variable of the first transmission path is the same as the target tainted variable. If they are the same, determine that the tainted transmission path of the target tainted variable does not meet the leakage condition. Otherwise, determine that the target script file is an adversarial malicious script file.

[0129] Regardless of the type of the target leakage function, the target parameter to be detected can be determined from its parameters. After determining the target parameter, it is compared with the target tainted variable to determine if they are the same. If they are different, it indicates that the tainted propagation path of the target tainted variable needs further backtracking. In this case, it is determined that the tainted propagation path of the target tainted variable meets the path backtracking condition, and step 203 is executed. If they are the same, it is directly determined that the tainted propagation path of the target tainted variable does not meet the leakage condition.

[0130] In step 203, in response to the taint propagation path of the target tainted variable satisfying the path backtracking condition, the taint propagation path of the target tainted variable is backtracked; in response to the result of the path backtracking indicating that the taint propagation path of the target tainted variable satisfies the leakage condition, the target script file is determined to be an adversarial malicious script file.

[0131] When it is determined that the taint propagation path of the target taint variable meets the path backtracking condition, the taint propagation path of the target taint variable is backtracked, and the result of the path backtracking is obtained. When the result of the path backtracking indicates that the taint propagation path of the target taint variable meets the leakage condition, the target script file is determined to be an adversarial malicious script file.

[0132] In an exemplary embodiment, when the path backtracking result indicates that the taint propagation path of the target tainted variable does not meet the leakage condition, it is necessary to obtain the next variable to be detected in the target script file for continued detection.

[0133] In one possible implementation, the process of backtracking the taint propagation path of the target tainted variable is as follows: The propagation methods existing along the taint propagation path of the target tainted variable are detected; if not all propagation methods along the taint propagation path are assignments, the backtracking result is a first result, indicating that the taint propagation path of the target tainted variable meets the leakage condition; if all propagation methods along the taint propagation path of the target tainted variable are assignments, the backtracking result is a second result, indicating that the taint propagation path of the target tainted variable does not meet the leakage condition. If the backtracking result is the first result, the target script file is directly determined to be an adversarial malicious script file.

[0134] Each taint propagation sub-path in the taint propagation path of the target tainted variable corresponds to a propagation method. The propagation methods existing in the taint propagation path of the target tainted variable include the propagation methods corresponding to each taint propagation sub-path. When the propagation methods corresponding to each taint propagation sub-path are all assignments, it indicates that the target tainted variable is only propagated to the target leaking function through assignment, which is not malicious behavior. The second result, indicating that the taint propagation path of the target tainted variable does not meet the leak condition, is used as the result of path backtracking. When the propagation methods corresponding to each taint propagation sub-path are not all assignments, it indicates that the target tainted variable is propagated to the target leaking function using a more complex propagation method, which is malicious behavior. The first result, indicating that the taint propagation path of the target tainted variable meets the leak condition, is used as the result of path backtracking.

[0135] For example, the process of tracing back the taint propagation path of the target taint variable is as follows: Figure 6As shown. If the taint propagation path of the target tainted variable satisfies the path backtracking condition, the propagation methods existing along the taint propagation path of the target tainted variable are detected; it is determined whether all propagation methods along the taint propagation path of the target tainted variable are assignments. If not all propagation methods along the taint propagation path of the target tainted variable are assignments, the first result is used as the path backtracking result, confirming that the target script file is an adversarial malicious script file; if all propagation methods along the taint propagation path of the target tainted variable are assignments, the second result is used as the path backtracking result, confirming that the taint propagation path of the target tainted variable does not satisfy the leakage condition, and the next variable to be detected in the target script file needs to be obtained for further detection.

[0136] For example, the process of tracing the taint propagation path of the target tainted variable is implemented using the taint propagation path backtracking module. The function of the taint propagation path backtracking module is to determine whether assignment is the only propagation method along the entire taint propagation path.

[0137] For example, the process of analyzing the taint propagation path of the target taint variable is as follows: Figure 7 As shown. Obtain the target leaking function at the end of the taint propagation path of the target tainted variable. Determine if the target leaking function is of a primitive type. If the target leaking function is of a primitive type, use the parameters used to implement the leaking function as the target parameters to be detected. If the target leaking function is of a non-primitive type, use the user leaking function auditing module to determine the target parameters to be detected from the parameters of the target leaking function.

[0138] After determining the target parameter to be detected, it is compared with the target tainted variable to determine if they are the same. If they are different, the tainted propagation path of the target tainted variable satisfies the path backtracking condition, and the tainted propagation path backtracking module is used to perform path backtracking. If they are the same, the tainted propagation path of the target tainted variable does not satisfy the leakage condition.

[0139] The core idea of ​​the processing procedure in this application embodiment is: if the target tainted variable that meets the conditions for an adversarial attack is not processed in any way, or is only passed to the target leaking function through assignment, it is not considered malicious behavior; otherwise, the target script file is treated as an adversarial malicious script file. This processing procedure is based on the fact that developers do not perform complex processing on target tainted variables that meet the conditions for an adversarial attack (such as excessively long string variables or array variables hard-coded in the code), but rather use them directly or pass them directly by assignment; while hackers, in order to evade detection, adversarially process malicious code into target tainted variables that meet the conditions for an adversarial attack, and then need to restore it to the malicious code before the adversarial processing at runtime.

[0140] Assuming the target tainted variable is test_special_taint, and sink is a leaked function of primitive type, the following example illustrates this:

[0141] Example 1, sink (“test_special_taint”)

[0142] This is the most common case. In this case, the target leaking function is of a primitive type, and the parameters of the target leaking function are the same as the target tainted variable. In this case, the leak is not a malicious act.

[0143] Example 2, function taint_pass ($a) {

[0144] $b=$a

[0145] return $b

[0146] }

[0147] sink (taint_pass (“test_special_taint”));

[0148] In this case, the target leak function is of a primitive type, and the parameter taint_pass (“test_special_taint”) of the target leak function is different from the target tainted variable. In this case, the tainted propagation path backtracking module needs to be used for subsequent processing.

[0149] Example 3. function my_sink_func ($a) {

[0150] sink ($a);

[0151] }

[0152] $a = "test_special_taint";

[0153] my_sink_func ($a);

[0154] In this case, the target leaked function is `my_sink_func`, which is a non-native type leaked function. This means the target leaked function's type is non-native and requires processing using the user leaked function auditing module. The parameter `$a` of the target leaked function is the target parameter, and this target parameter differs from the target tainted variable; therefore, it needs processing using the tainted propagation path backtracking module.

[0155] This application proposes a method for detecting adversarial malicious script files. It considers excessively long string variables, excessively long array variables, and string variables with excessive concatenation operations as target tainted variables. Using traditional taint analysis techniques, it records the taint propagation path of the target tainted variables. By analyzing the taint propagation path of the target tainted variables, false positives are eliminated. Based on the method provided in this application, the detection rate of adversarial malicious script files by antivirus engines can be improved, thus enhancing the performance of antivirus engines. Furthermore, this application can be implemented based on static taint analysis, without running the script to be detected. It only needs to read the content of the script to determine whether it is an adversarial malicious script file, resulting in high execution efficiency. Moreover, the method provided in this application has high universality and versatility; it can identify any adversarial malicious script file without needing to add separate features for each type of adversarial malicious script file.

[0156] For example, the method provided in this application embodiment can be applied to the script file detection logic of antivirus engines, and has the characteristics of being fast, efficient, versatile, and having a low false positive rate.

[0157] In this embodiment, consideration is added for target tainted variables that meet the conditions for adversarial attacks. By tracking the target tainted variables and analyzing the tainted propagation path of the target tainted variables, adversarial malicious script files can be detected, which helps to improve the accuracy of the detection results of malicious script files. This can effectively defend against adversarial attacks by adversarial malicious script files, resulting in higher network security.

[0158] See Figure 8 This application provides a script file detection device, which includes:

[0159] The first acquisition unit 801 is used to acquire the target script file to be detected;

[0160] The tracing unit 802 is used to trace target tainted variables in the target script file;

[0161] The second acquisition unit 803 is used to acquire the taint propagation path of the target tainted variable in response to the target leaking function in the target script file. The target tainted variable is a variable that satisfies the conditions of an adversarial attack.

[0162] The backtracking unit 804 is used to perform path backtracking on the taint propagation path of the target taint variable in response to the taint propagation path of the target taint variable satisfying the path backtracking condition.

[0163] The determination unit 805 is used to determine that the target script file is an adversarial malicious script file in response to the result of the path backtracking indicating that the taint propagation path of the target taint variable meets the leakage condition.

[0164] In one possible implementation, see Figure 9 The device also includes:

[0165] The detection unit 806 is used to detect the variables to be detected in the target script file;

[0166] The determination unit 805 is also used to treat the variable to be detected as a target tainted variable in response to the variable to be detected satisfying the adversarial attack conditions;

[0167] Among them, the variable to be detected meets the conditions for adversarial attack, including: the variable to be detected is a string variable and the string variable meets the first condition, the string variable meeting the first condition includes the length of the string variable being greater than the first threshold and the string variable containing characters of non-target type; or, the variable to be detected is an array variable and the length of the array variable is greater than the second threshold; or, the variable to be detected is obtained by string concatenation operation and the number of string concatenation operations is greater than the third threshold.

[0168] In one possible implementation, the determining unit 805 is further configured to determine the target parameter to be detected from the parameters of the target leakage function; in response to the target parameter being different from the target taint variable, to determine that the taint propagation path of the target taint variable satisfies the path backtracking condition.

[0169] In one possible implementation, the target leaking function is of a primitive type, which indicates that the target leaking function is provided by the scripting language used to write the target script file; the determining unit 805 is also used to take the parameters of the target leaking function used to implement the leaking function as the target parameters to be detected.

[0170] In one possible implementation, the target leaking function is of a non-native type; the determining unit 805 is further configured to obtain the sub-leaking function called within the target leaking function; in response to the sub-leaking function being of a native type, the parameter used to implement the leaking function is taken as the first parameter; in response to the first parameter being different from the target tainted variable, the first propagation path corresponding to the first parameter within the target leaking function is obtained; in response to the propagation methods existing on the first propagation path being all assignments and the starting variable of the first propagation path being the same as any parameter in the parameters of the target leaking function, any parameter is taken as the target parameter to be detected.

[0171] In one possible implementation, the backtracking unit 804 is used to detect the propagation methods existing in the taint propagation path of the target taint variable; in response to the fact that not all the propagation methods existing in the taint propagation path of the target taint variable are assignments, the result of the path backtracking is a first result, which is used to indicate that the taint propagation path of the target taint variable meets the leakage condition; in response to the fact that all the propagation methods existing in the taint propagation path of the target taint variable are assignments, the result of the path backtracking is a second result, which is used to indicate that the taint propagation path of the target taint variable does not meet the leakage condition.

[0172] In one possible implementation, see Figure 9 The device also includes:

[0173] Transformation unit 807 is used to convert the target script file into a target abstract syntax tree;

[0174] Unit 805 is also used to determine the variables to be detected in the target script file based on the target abstract syntax tree.

[0175] In this embodiment, consideration is added for target tainted variables that meet the conditions for adversarial attacks. By tracking the target tainted variables and analyzing the tainted propagation path of the target tainted variables, adversarial malicious script files can be detected, which helps to improve the accuracy of the detection results of malicious script files. This can effectively defend against adversarial attacks by adversarial malicious script files, resulting in higher network security.

[0176] It should be noted that the apparatus provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0177] Figure 10This is a schematic diagram of a server structure provided in an embodiment of this application. The server can vary significantly due to differences in configuration or performance. It may include one or more Central Processing Units (CPUs) 1001 and one or more memories 1002. The one or more memories 1002 store at least one computer program, which is loaded and executed by the one or more processors 1001 to implement the script file detection method provided in the various method embodiments described above. Of course, the server may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input and output. The server may also include other components for implementing device functions, which will not be elaborated upon here.

[0178] Figure 11 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. The terminal can be a smartphone, tablet computer, laptop computer, or desktop computer. The terminal may also be referred to as user equipment, portable terminal, laptop terminal, desktop terminal, or other names.

[0179] Typically, a terminal includes a processor 1101 and a memory 1102.

[0180] Processor 1101 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 1101 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). Processor 1101 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 1101 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed on the screen. In some embodiments, processor 1101 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0181] The memory 1102 may include one or more computer-readable storage media, which may be non-transitory. The memory 1102 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 1102 is used to store at least one instruction, which is executed by the processor 1101 to implement the script file detection method provided in the method embodiments of this application.

[0182] In some embodiments, the terminal may also optionally include: a peripheral device interface 1103 and at least one peripheral device. The processor 1101, memory 1102, and peripheral device interface 1103 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 1103 via a bus, signal line, or circuit board. Specifically, the peripheral device includes at least one of: a radio frequency circuit 1104, a display screen 1105, a camera assembly 1106, an audio circuit 1107, and a power supply 1109.

[0183] Peripheral device interface 1103 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 1101 and memory 1102. In some embodiments, processor 1101, memory 1102 and peripheral device interface 1103 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 1101, memory 1102 and peripheral device interface 1103 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0184] The radio frequency (RF) circuit 1104 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 1104 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 1104 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. Optionally, the RF circuit 1104 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The RF circuit 1104 can communicate with other terminals through at least one wireless communication protocol. This wireless communication protocol includes, but is not limited to: metropolitan area networks (MANs), various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks (WLANs), and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 1104 may also include circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0185] Display screen 1105 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 1105 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 1101 for processing. In this case, display screen 1105 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, display screen 1105 can be a single screen, disposed on the front panel of the terminal; in other embodiments, display screen 1105 can be at least two screens, disposed on different surfaces of the terminal or in a folded design; in other embodiments, display screen 1105 can be a flexible display screen, disposed on a curved or folded surface of the terminal. Furthermore, display screen 1105 can be configured as a non-rectangular, irregular shape, i.e., a non-rectangular screen. Display screen 1105 can be made of materials such as LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0186] The camera assembly 1106 is used to acquire images or videos. Optionally, the camera assembly 1106 includes a front-facing camera and a rear-facing camera. Typically, the front-facing camera is located on the front panel of the terminal, and the rear-facing camera is located on the back of the terminal. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments, the camera assembly 1106 may also include a flash. The flash can be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cool light flash, which can be used for light compensation at different color temperatures.

[0187] The audio circuit 1107 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, converting the sound waves into electrical signals that are input to the processor 1101 for processing, or input to the radio frequency circuit 1104 to achieve voice communication. For stereo sound acquisition or noise reduction purposes, multiple microphones may be used, each positioned at a different location on the terminal. The microphone may also be an array microphone or an omnidirectional microphone. The speaker is used to convert electrical signals from the processor 1101 or the radio frequency circuit 1104 into sound waves. The speaker may be a conventional diaphragm speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can convert electrical signals not only into audible sound waves but also into inaudible sound waves for purposes such as distance measurement. In some embodiments, the audio circuit 1107 may also include a headphone jack.

[0188] Power supply 1109 is used to power the various components in the terminal. Power supply 1109 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 1109 includes a rechargeable battery, the rechargeable battery can support wired charging or wireless charging. The rechargeable battery can also be used to support fast charging technology.

[0189] In some embodiments, the terminal further includes one or more sensors 1110. The one or more sensors 1110 include, but are not limited to: an acceleration sensor 1111, a gyroscope sensor 1112, a pressure sensor 1113, an optical sensor 1115, and a proximity sensor 1116.

[0190] Accelerometer 1111 can detect the magnitude of acceleration along the three coordinate axes of a coordinate system established by the terminal. For example, accelerometer 1111 can be used to detect the components of gravitational acceleration along the three coordinate axes. Processor 1101 can control display screen 1105 to display the user interface in either a landscape or portrait view based on the gravitational acceleration signal acquired by accelerometer 1111. Accelerometer 1111 can also be used for collecting game or user motion data.

[0191] The gyroscope sensor 1112 can detect the terminal's orientation and rotation angle. The gyroscope sensor 1112 can work in conjunction with the accelerometer sensor 1111 to collect the user's 3D movements on the terminal. Based on the data collected by the gyroscope sensor 1112, the processor 1101 can perform the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0192] The pressure sensor 1113 can be disposed on the side bezel of the terminal and / or the lower layer of the display screen 1105. When the pressure sensor 1113 is disposed on the side bezel of the terminal, it can detect the user's grip signal on the terminal, and the processor 1101 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor 1113. When the pressure sensor 1113 is disposed on the lower layer of the display screen 1105, the processor 1101 can control the operable controls on the UI interface based on the user's pressure operation on the display screen 1105. The operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0193] An optical sensor 1115 is used to collect ambient light intensity. In one embodiment, the processor 1101 can control the display brightness of the display screen 1105 based on the ambient light intensity collected by the optical sensor 1115. Specifically, when the ambient light intensity is high, the display brightness of the display screen 1105 is increased; when the ambient light intensity is low, the display brightness of the display screen 1105 is decreased. In another embodiment, the processor 1101 can also dynamically adjust the shooting parameters of the camera assembly 1106 based on the ambient light intensity collected by the optical sensor 1115.

[0194] The proximity sensor 1116, also known as a distance sensor, is typically installed on the front panel of the terminal. The proximity sensor 1116 is used to detect the distance between the user and the front of the terminal. In one embodiment, when the proximity sensor 1116 detects that the distance between the user and the front of the terminal is gradually decreasing, the processor 1101 controls the display screen 1105 to switch from a screen-on state to a screen-off state; when the proximity sensor 1116 detects that the distance between the user and the front of the terminal is gradually increasing, the processor 1101 controls the display screen 1105 to switch from a screen-off state to a screen-on state.

[0195] Those skilled in the art will understand that Figure 11 The structure shown does not constitute a limitation on the terminal and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0196] In an exemplary embodiment, a computer device is also provided, comprising a processor and a memory storing at least one computer program. The at least one computer program is loaded and executed by one or more processors to implement any of the script file detection methods described above.

[0197] In an exemplary embodiment, a computer-readable storage medium is also provided, which stores at least one computer program, which is loaded and executed by a processor of a computer device to implement any of the above-described script file detection methods.

[0198] In one possible implementation, the aforementioned computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device, etc.

[0199] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform any of the script file detection methods described above.

[0200] It should be noted that the terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the above exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0201] It should be understood that "multiple" as used in this article refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. The character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0202] The above description is merely an exemplary embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for detecting script files, characterized in that, The method includes: Obtain the target script file to be detected; The target tainted variable in the target script file is traced, and in response to the target tainted variable being passed to the target leaking function in the target script file, the tainted propagation path of the target tainted variable is obtained. The target tainted variable is a variable that satisfies the conditions of an adversarial attack. When the type of the target leaking function is a primitive type, the primitive type is used to indicate that the target leaking function is provided by the scripting language used to write the target script file; the parameters of the target leaking function used to implement the leaking function are taken as the target parameters to be detected; In response to the fact that the target parameter is different from the target taint variable, it is determined that the taint propagation path of the target taint variable satisfies the path backtracking condition; In response to the taint propagation path of the target taint variable satisfying the path backtracking condition, the taint propagation path of the target taint variable is backtracked. In response to the result of the path backtracking indicating that the taint propagation path of the target tainted variable meets the leakage condition, the target script file is determined to be an adversarial malicious script file.

2. The method according to claim 1, characterized in that, Before tracking the target tainted variables in the target script file, the method further includes: The variables to be detected in the target script file are then detected. In response to the variable to be detected satisfying the adversarial attack conditions, the variable to be detected is designated as the target tainted variable. The variable to be detected satisfies the conditions for an adversarial attack, including: the variable to be detected is a string variable and the string variable satisfies a first condition, wherein the string variable satisfies the first condition as follows: the length of the string variable is greater than a first threshold and the string variable contains characters of a non-target type; or, the variable to be detected is an array variable and the length of the array variable is greater than a second threshold; or, the variable to be detected is obtained by string concatenation and the number of string concatenation operations is greater than a third threshold.

3. The method according to claim 1, characterized in that, When the type of the target leaking function is a non-primitive type, the method further includes: Obtain the sub-leaking function called within the target leaking function; In response to the fact that the type of the sub-leaking function is a primitive type, the parameter used to implement the leakage function in the parameters of the sub-leaking function is taken as the first parameter; In response to the fact that the first parameter is different from the target taint variable, the first propagation path corresponding to the first parameter in the target leakage function is obtained; In response to the fact that all transmission methods on the first transmission path are assignments and the starting variable of the first transmission path is the same as any parameter in the parameters of the target leakage function, the parameter is taken as the target parameter to be detected.

4. The method according to any one of claims 1-3, characterized in that, The step of tracing the taint propagation path of the target taint variable includes: The propagation methods existing in the taint propagation path of the target taint variable are detected; In response to the fact that the propagation methods on the taint propagation path of the target taint variable are not all assignments, the result of the path backtracking is the first result, which is used to indicate that the taint propagation path of the target taint variable meets the leakage condition. Since all propagation methods on the taint propagation path of the target taint variable are assignments, the result of the path backtracking is the second result, which is used to indicate that the taint propagation path of the target taint variable does not meet the leakage condition.

5. The method according to claim 2, characterized in that, Before detecting the variable to be detected in the target script file, the method further includes: Convert the target script file into a target abstract syntax tree; Based on the target abstract syntax tree, the variables to be detected in the target script file are determined.

6. A script file detection device, characterized in that, The device includes: The first acquisition unit is used to acquire the target script file to be detected; A tracking unit is used to track target taint variables in the target script file; The second acquisition unit is used to acquire the taint propagation path of the target tainted variable in response to the target leaking function in the target script file, wherein the target tainted variable is a variable that satisfies the conditions of an adversarial attack. When the type of the target leaking function is a primitive type, the primitive type is used to indicate that the target leaking function is provided by the scripting language used to write the target script file; the determining unit is used to take the parameters of the target leaking function that are used to implement the leaking function as the target parameters to be detected; in response to the target parameters being different from the target tainted variable, the unit determines that the tainted propagation path of the target tainted variable satisfies the path backtracking condition; The backtracking unit is used to perform path backtracking on the taint propagation path of the target taint variable in response to the taint propagation path of the target taint variable satisfying the path backtracking condition. The determining unit is further configured to determine that the target script file is an adversarial malicious script file in response to the result of the path backtracking indicating that the taint propagation path of the target taint variable meets the leakage condition.

7. The apparatus according to claim 6, characterized in that, The device further includes: The detection unit is used to detect the variables to be detected in the target script file; The determining unit is further configured to, in response to the variable to be detected satisfying the adversarial attack conditions, designate the variable to be detected as a target taint variable; The variable to be detected satisfies the conditions for an adversarial attack, including: the variable to be detected is a string variable and the string variable satisfies a first condition, wherein the string variable satisfies the first condition as follows: the length of the string variable is greater than a first threshold and the string variable contains characters of a non-target type; or, the variable to be detected is an array variable and the length of the array variable is greater than a second threshold; or, the variable to be detected is obtained by string concatenation and the number of string concatenation operations is greater than a third threshold.

8. The apparatus according to claim 6, characterized in that, When the type of the target leaking function is not a native type, the determining unit is further configured to obtain the sub-leaking function called within the target leaking function; in response to the type of the sub-leaking function being a native type, the parameter used to implement the leaking function in the parameters of the sub-leaking function is taken as the first parameter; in response to the first parameter being different from the target taint variable, the first transmission path corresponding to the first parameter within the target leaking function is obtained; in response to the transmission methods existing on the first transmission path being all assignments and the starting variable of the first transmission path being the same as any parameter in the parameters of the target leaking function, the any parameter is taken as the target parameter to be detected.

9. The apparatus according to any one of claims 6-8, characterized in that, The backtracking unit is used to detect the propagation methods existing in the taint propagation path of the target taint variable; in response to the fact that the propagation methods existing in the taint propagation path of the target taint variable are not all assignments, the result of the path backtracking is a first result, which is used to indicate that the taint propagation path of the target taint variable meets the leakage condition. Since all propagation methods on the taint propagation path of the target taint variable are assignments, the result of the path backtracking is the second result, which is used to indicate that the taint propagation path of the target taint variable does not meet the leakage condition.

10. The apparatus according to claim 7, characterized in that, The device further includes: A conversion unit is used to convert the target script file into a target abstract syntax tree; The determining unit is further configured to determine the variables to be detected in the target script file based on the target abstract syntax tree.

11. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one computer program, which is loaded and executed by the processor to implement the script file detection method as described in any one of claims 1 to 5.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the script file detection method as described in any one of claims 1 to 5.

Images